apache / apache/maven-surefire

[SUREFIRE-2069] Utf8RecodingDeferredFileOutputStream write doesn't protect caller from privileged action

Open
#3,126 0 comments 0 reactions 0 assignees View on GitHub
bug priority:major
Dominant language
Java
Stars
461
Forks
588
Avg merge
1d 8h
Merged PRs (30d)
19

Description

**[Tom Watson](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=tjwatson)** opened **[SUREFIRE-2069](https://issues.apache.org/jira/browse/SUREFIRE-2069?redirect=false)** and commented

See https://github.com/eclipse-equinox/equinox.framework/issues/32

We see the following exception:

> Caused by: java.lang.SecurityException: Unable to create temporary file or directory
> at java.base/java.nio.file.TempFileHelper.create(TempFileHelper.java:142)
> at java.base/java.nio.file.TempFileHelper.createTempFile(TempFileHelper.java:160)
> at java.base/java.nio.file.Files.createTempFile(Files.java:912)
> at org.apache.maven.plugin.surefire.report.Utf8RecodingDeferredFileOutputStream.write(Utf8RecodingDeferredFileOutputStream.java:69)
> at org.apache.maven.plugin.surefire.report.TestSetRunListener.writeTestOutput(TestSetRunListener.java:180)
> at org.apache.maven.plugin.surefire.report.TestSetRunListener.writeTestOutput(TestSetRunListener.java:49)
> at org.apache.maven.surefire.junitplatform.RunListenerAdapter.writeTestOutput(RunListenerAdapter.java:379)
> at org.apache.maven.surefire.api.report.ConsoleOutputCapture$ForwardingPrintStream.println(ConsoleOutputCapture.java:138)
> at security.b.Activator.start(Activator.java:28)

Where the class security.b.Activator doesn't have permission to create files in the directory there.

---
No further details from [SUREFIRE-2069](https://issues.apache.org/jira/browse/SUREFIRE-2069?redirect=false)

Contributor guide

Open the contributing guide

Research direction

Start in surefire-report's Utf8RecodingDeferredFileOutputStream.write method at the reported line 69, then trace the call from TestSetRunListener.writeTestOutput. Use the linked Equinox security issue and the exception to understand the permission boundary; done means the write no longer exposes the caller to the temporary-file operation's privileged-action failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.