[PHOENIX-6576] Do not use guava's Files.createTempDir()

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.17.0, 5.2.0, 4.16.2, 5.1.3
• Labels: beginner
• Assignee: Istvan Toth
• Reporter: lujie
• Created: 18/Oct/21 12:06
• Updated: 08/Feb/22 05:35
• Resolved: 08/Feb/22 05:35

Description

see https://www.cvedetails.com/cve/CVE-2020-8908/

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Issue Links

• is duplicated by: PHOENIX-6439 Remove uses of Guava's Files#createTempDir
• links to: GitHub Pull Request #1333
• links to: GitHub Pull Request #1392
• links to: new PR