apache / apache/maven-surefire
[SUREFIRE-2069] Utf8RecodingDeferredFileOutputStream write doesn't protect caller from privileged action
- Dominant language
- Java
- Stars
- 461
- Forks
- 588
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 19
Description
**[Tom Watson](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=tjwatson)** opened **[SUREFIRE-2069](https://issues.apache.org/jira/browse/SUREFIRE-2069?redirect=false)** and commented
See https://github.com/eclipse-equinox/equinox.framework/issues/32
We see the following exception:
> Caused by: java.lang.SecurityException: Unable to create temporary file or directory
> at java.base/java.nio.file.TempFileHelper.create(TempFileHelper.java:142)
> at java.base/java.nio.file.TempFileHelper.createTempFile(TempFileHelper.java:160)
> at java.base/java.nio.file.Files.createTempFile(Files.java:912)
> at org.apache.maven.plugin.surefire.report.Utf8RecodingDeferredFileOutputStream.write(Utf8RecodingDeferredFileOutputStream.java:69)
> at org.apache.maven.plugin.surefire.report.TestSetRunListener.writeTestOutput(TestSetRunListener.java:180)
> at org.apache.maven.plugin.surefire.report.TestSetRunListener.writeTestOutput(TestSetRunListener.java:49)
> at org.apache.maven.surefire.junitplatform.RunListenerAdapter.writeTestOutput(RunListenerAdapter.java:379)
> at org.apache.maven.surefire.api.report.ConsoleOutputCapture$ForwardingPrintStream.println(ConsoleOutputCapture.java:138)
> at security.b.Activator.start(Activator.java:28)
Where the class security.b.Activator doesn't have permission to create files in the directory there.
---
No further details from [SUREFIRE-2069](https://issues.apache.org/jira/browse/SUREFIRE-2069?redirect=false)
Contributor guide
Research direction
Start in surefire-report's Utf8RecodingDeferredFileOutputStream.write method at the reported line 69, then trace the call from TestSetRunListener.writeTestOutput. Use the linked Equinox security issue and the exception to understand the permission boundary; done means the write no longer exposes the caller to the temporary-file operation's privileged-action failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100