Pārlūkot izejas kodu

Merge pull request #94 from BulkSecurityGeneratorProjectV2/fix/JLL/temporary_file_local_information_disclosure

[SECURITY] Fix Temporary File Information Disclosure Vulnerability
MaxKey 2 gadi atpakaļ
vecāks
revīzija
1f86fb4a74

+ 2 - 1
maxkey-common/src/main/java/org/maxkey/crypto/cert/NetUtil.java

@@ -31,6 +31,7 @@ import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URL;
 import java.net.URLConnection;
+import java.nio.file.Files;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -140,7 +141,7 @@ public final class NetUtil
 
 		try
 		{
-			tempFile = File.createTempFile("portecle", null);
+			tempFile = Files.createTempFile("portecle",null).toFile();
 			out = new BufferedOutputStream(new FileOutputStream(tempFile));
 			byte[] buf = new byte[2048];
 			int n;