From fab41ce35ab324e487d5fa6a2c2409e57a30caed Mon Sep 17 00:00:00 2001 From: Samrat002 Date: Wed, 12 Aug 2026 10:58:50 +0530 Subject: [PATCH] [FLINK-37666] CWE-378: Creation of Temporary File With Insecure Permissions in Temporary File Creation --- .../org/apache/flink/client/program/PackagedProgram.java | 4 +++- .../fs/ChangelogStreamHandleReaderWithCache.java | 3 ++- .../examples/java/basics/StreamWindowSQLExample.java | 3 ++- .../java/org/apache/flink/yarn/YarnClusterDescriptor.java | 8 ++++++-- 4 files changed, 13 insertions(+), 5 deletions(-) diff --git a/flink-clients/src/main/java/org/apache/flink/client/program/PackagedProgram.java b/flink-clients/src/main/java/org/apache/flink/client/program/PackagedProgram.java index 0479cb7a5448ca..2fb1a95de9d533 100644 --- a/flink-clients/src/main/java/org/apache/flink/client/program/PackagedProgram.java +++ b/flink-clients/src/main/java/org/apache/flink/client/program/PackagedProgram.java @@ -45,6 +45,7 @@ import java.net.URISyntaxException; import java.net.URL; import java.net.URLClassLoader; +import java.nio.file.Files; import java.util.ArrayList; import java.util.Collections; import java.util.List; @@ -584,7 +585,8 @@ private static File copyLibToTempFile( private static File createTempFile(Random rnd, JarEntry entry, String name) throws ProgramInvocationException { try { - final File tempFile = File.createTempFile(rnd.nextInt(Integer.MAX_VALUE) + "_", name); + final File tempFile = + Files.createTempFile(rnd.nextInt(Integer.MAX_VALUE) + "_", name).toFile(); tempFile.deleteOnExit(); return tempFile; } catch (IOException e) { diff --git a/flink-dstl/flink-dstl-dfs/src/main/java/org/apache/flink/changelog/fs/ChangelogStreamHandleReaderWithCache.java b/flink-dstl/flink-dstl-dfs/src/main/java/org/apache/flink/changelog/fs/ChangelogStreamHandleReaderWithCache.java index 70f2f66ef35ed5..36b727ce1d891a 100644 --- a/flink-dstl/flink-dstl-dfs/src/main/java/org/apache/flink/changelog/fs/ChangelogStreamHandleReaderWithCache.java +++ b/flink-dstl/flink-dstl-dfs/src/main/java/org/apache/flink/changelog/fs/ChangelogStreamHandleReaderWithCache.java @@ -128,7 +128,8 @@ private RefCountedFile downloadToCacheFile(FileStateHandle fileHandle) { File directory = cacheDirectories[next.getAndIncrement() % cacheDirectories.length]; File file; try { - file = File.createTempFile(CACHE_FILE_PREFIX, null, directory); + file = Files.createTempFile(directory.toPath(), CACHE_FILE_PREFIX, null).toFile(); + file.deleteOnExit(); } catch (IOException e) { ExceptionUtils.rethrow(e); return null; diff --git a/flink-examples/flink-examples-table/src/main/java/org/apache/flink/table/examples/java/basics/StreamWindowSQLExample.java b/flink-examples/flink-examples-table/src/main/java/org/apache/flink/table/examples/java/basics/StreamWindowSQLExample.java index eb3f33de73f769..7c20731bbb1ef1 100644 --- a/flink-examples/flink-examples-table/src/main/java/org/apache/flink/table/examples/java/basics/StreamWindowSQLExample.java +++ b/flink-examples/flink-examples-table/src/main/java/org/apache/flink/table/examples/java/basics/StreamWindowSQLExample.java @@ -24,6 +24,7 @@ import java.io.File; import java.io.IOException; +import java.nio.file.Files; /** * Simple example for demonstrating the use of SQL in Java. @@ -91,7 +92,7 @@ public static void main(String[] args) throws Exception { /** Creates a temporary file with the contents and returns the absolute path. */ private static String createTempFile(String contents) throws IOException { - File tempFile = File.createTempFile("orders", ".csv"); + File tempFile = Files.createTempFile("orders", ".csv").toFile(); tempFile.deleteOnExit(); FileUtils.writeFileUtf8(tempFile, contents); return tempFile.toURI().toString(); diff --git a/flink-yarn/src/main/java/org/apache/flink/yarn/YarnClusterDescriptor.java b/flink-yarn/src/main/java/org/apache/flink/yarn/YarnClusterDescriptor.java index 3736c6d8f3cfc4..ad169a6f52c39b 100644 --- a/flink-yarn/src/main/java/org/apache/flink/yarn/YarnClusterDescriptor.java +++ b/flink-yarn/src/main/java/org/apache/flink/yarn/YarnClusterDescriptor.java @@ -119,6 +119,7 @@ import java.net.URLDecoder; import java.nio.ByteBuffer; import java.nio.charset.Charset; +import java.nio.file.Files; import java.util.Arrays; import java.util.Collection; import java.util.Collections; @@ -1032,7 +1033,8 @@ private ApplicationReport startAppMaster( if (jobGraph != null) { File tmpJobGraphFile = null; try { - tmpJobGraphFile = File.createTempFile(appId.toString(), null); + tmpJobGraphFile = Files.createTempFile(appId.toString(), null).toFile(); + tmpJobGraphFile.deleteOnExit(); try (FileOutputStream output = new FileOutputStream(tmpJobGraphFile); ObjectOutputStream obOutput = new ObjectOutputStream(output)) { obOutput.writeObject(jobGraph); @@ -1064,7 +1066,9 @@ private ApplicationReport startAppMaster( File tmpConfigurationFile = null; try { String flinkConfigFileName = GlobalConfiguration.getFlinkConfFilename(); - tmpConfigurationFile = File.createTempFile(appId + "-" + flinkConfigFileName, null); + tmpConfigurationFile = + Files.createTempFile(appId + "-" + flinkConfigFileName, null).toFile(); + tmpConfigurationFile.deleteOnExit(); // remove localhost bind hosts as they render production clusters unusable removeLocalhostBindHostSetting(configuration, JobManagerOptions.BIND_HOST);