engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

73
test/jdk/java/io/File/createTempFile/NameTooLong.java Normal file
View file

@ -0,0 +1,73 @@
/*
* Copyright (c) 2016, 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8148023
* @summary Verify that createTempFile() will not fail for long component names.
*/
import java.io.File;
import java.io.IOException;
public class NameTooLong {
public static void main(String[] args) {
String[][] prefixSuffix = new String[][] {
new String[] {"1234567890123456789012345678901234567xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx89012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890","txt"},
new String[] {"prefix","1234567890123456789012345678901234567xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx89012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890.txt"},
new String[] {"prefix",".txt1234567890123456789012345678901234567xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx89012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890"}
};
int failures = 0;
int index = 0;
for (String[] ps : prefixSuffix) {
File f;
try {
f = File.createTempFile(ps[0], ps[1],
new File(System.getProperty("test.dir", ".")));
String s = f.toPath().getFileName().toString();
if (!s.startsWith(ps[0].substring(0, 3))) {
System.err.printf("%s did not start with %s%n", s,
ps[0].substring(0, 3));
failures++;
}
if (ps[1].startsWith(".")
&& !s.contains(ps[1].substring(0, 4))) {
System.err.printf("%s did not contain %s%n", s,
ps[1].substring(0, 4));
failures++;
}
} catch (IOException e) {
failures++;
System.err.println();
e.printStackTrace();
System.err.println();
}
index++;
}
if (failures != 0) {
throw new RuntimeException("Test failed!");
}
}
}

72
test/jdk/java/io/File/createTempFile/Patterns.java Normal file
View file

@ -0,0 +1,72 @@
/*
* Copyright (c) 1998, 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
@bug 4152178 8152272
@summary Check various temp-file prefix/suffix cases */
import java.io.File;
import java.io.IOException;
public class Patterns {
static File dir = new File(".");
static void ckn(String prefix, String suffix) throws Exception {
try {
File f = File.createTempFile(prefix, suffix, dir);
f.deleteOnExit();
} catch (Exception x) {
if ((x instanceof IOException)
|| (x instanceof NullPointerException)
|| (x instanceof IllegalArgumentException)) {
System.err.println("\"" + prefix + "\", \"" + suffix
+ "\" failed as expected: " + x.getMessage());
return;
}
throw x;
}
throw new Exception("\"" + prefix + "\", \"" + suffix
+ "\" should have failed");
}
static void cky(String prefix, String suffix) throws Exception {
File f = File.createTempFile(prefix, suffix, dir);
f.deleteOnExit();
System.err.println("\"" + prefix + "\", \"" + suffix
+ "\" --> " + f.getPath());
}
public static void main(String[] args) throws Exception {
ckn(null, null);
ckn("", null);
ckn("x", null);
ckn("xx", null);
cky("xxx", null);
cky("xxx", "");
cky("xxx", "y");
cky("xxx", ".y");
cky("xyz", "Directory" + System.getProperty("file.separator"));
}
}

125
test/jdk/java/io/File/createTempFile/SpecialTempFile.java Normal file
View file

@ -0,0 +1,125 @@
/*
* Copyright (c) 2013, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8013827 8011950 8017212 8025128
* @modules java.base/jdk.internal.util
* @summary Check whether File.createTempFile can handle special parameters
* @author Dan Xu
*/
import java.io.File;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import jdk.internal.util.OperatingSystem;
import jdk.internal.util.OSVersion;
import jdk.internal.util.StaticProperty;
public class SpecialTempFile {
//
// If exceptionExpected == null, then any IOException thrown by
// File.createTempFile is ignored.
//
private static void test(String name, String[] prefix, String[] suffix,
Boolean exceptionExpected) throws IOException
{
if (prefix == null || suffix == null
|| prefix.length != suffix.length)
{
return;
}
final String exceptionMsg = "Unable to create temporary file";
String[] dirs = { null, "." };
Path testPath = Path.of(System.getProperty("test.dir", "."));
for (int i = 0; i < prefix.length; i++) {
boolean exceptionThrown = false;
File f = null;
for (String dir: dirs) {
Path tempDir = Files.createTempDirectory(testPath, dir);
System.out.println("In test " + name +
", creating temp file with prefix, " +
prefix[i] + ", suffix, " + suffix[i] +
", in dir, " + tempDir);
try {
f = File.createTempFile(prefix[i], suffix[i],
tempDir.toFile());
} catch (IOException e) {
if (exceptionExpected != null) {
if (exceptionExpected) {
if (e.getMessage().startsWith(exceptionMsg))
exceptionThrown = true;
else
System.out.println("Wrong error message:" +
e.getMessage());
} else {
throw e;
}
if (exceptionExpected && (!exceptionThrown || f != null))
throw new RuntimeException("IOException expected");
}
}
}
}
}
public static void main(String[] args) throws Exception {
// Common test
final String name = "SpecialTempFile";
String[] nulPre = { name + "\u0000" };
String[] nulSuf = { ".test" };
test("NulName", nulPre, nulSuf, true);
// Test JDK-8025128
String[] goodPre = { "///..///", "/foo" };
String[] goodSuf = { ".temp", ".tmp" };
test("goodName", goodPre, goodSuf, false);
// Test JDK-8011950
String[] slashPre = { "temp", "///..///", "/foo" };
String[] slashSuf = { "///..///..", "///..///..", "///..///.." };
test("SlashedName", slashPre, slashSuf, true);
// Windows tests
if (!OperatingSystem.isWindows())
return;
// Test JDK-8013827
String[] resvPre = { "LPT1.package.zip", "com7.4.package.zip" };
String[] resvSuf = { ".temp", ".temp" };
System.out.println("OS name: " + StaticProperty.osName() + "\n" +
"OS version: " + OSVersion.current());
// Here the test is for whether File.createTempFile hangs, so whether
// an exception is thrown is ignored: expectedException == null
test("ReservedName", resvPre, resvSuf, null);
}
}

113
test/jdk/java/io/File/createTempFile/TargetDirectory.java Normal file
View file

@ -0,0 +1,113 @@
/*
* Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4847239
* @summary Verify directory parameter behavior in File.createTempFile(String,String,File)
* @library /test/lib
* @run junit TargetDirectory
*/
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.io.TempDir;
import org.junit.jupiter.api.io.CleanupMode;
import org.junit.jupiter.api.condition.DisabledIf;
import java.io.File;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.attribute.AclEntry;
import java.nio.file.attribute.AclEntryPermission;
import java.nio.file.attribute.AclFileAttributeView;
import java.nio.file.attribute.PosixFileAttributeView;
import java.nio.file.attribute.PosixFilePermission;
import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import jdk.test.lib.Platform;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
class TargetDirectory {
@TempDir(cleanup = CleanupMode.ALWAYS)
Path tempDir;
@Test
void testWritableDirectory() throws Exception {
Path dir = tempDir.resolve("target");
File target = Files.createDirectory(dir).toFile();
File tmp = File.createTempFile("passes", null, target);
assertTrue(Files.exists(tmp.toPath()), "Temp file not created");
}
@Test
@DisabledIf("jdk.test.lib.Platform#isRoot")
void testReadOnlyDirectory() throws Exception {
Path dir = tempDir.resolve("target");
File target = Files.createDirectory(dir).toFile();
// Make 'target' read-only
if (Files.getFileStore(dir).supportsFileAttributeView("posix")) {
PosixFileAttributeView view =
Files.getFileAttributeView(dir, PosixFileAttributeView.class);
Set<PosixFilePermission> perms = new HashSet<>();
perms.add(PosixFilePermission.OWNER_READ);
view.setPermissions(perms);
} else if (Files.getFileStore(dir).supportsFileAttributeView("acl")) {
AclFileAttributeView view = Files.getFileAttributeView(dir,
AclFileAttributeView.class);
List<AclEntry> entries = new ArrayList<>();
for (AclEntry entry : view.getAcl()) {
Set<AclEntryPermission> perms =
new HashSet<>(entry.permissions());
perms.remove(AclEntryPermission.ADD_FILE);
entries.add(AclEntry.newBuilder().setType(entry.type())
.setPrincipal(entry.principal()).setPermissions(perms)
.build());
}
view.setAcl(entries);
} else {
throw new RuntimeException("Required attribute view not supported");
}
assertThrows(IOException.class,
() -> File.createTempFile("readonly", null, target));
}
@Test
void testNonExistentDirectory() {
assertThrows(IOException.class,
() -> File.createTempFile("nonexistent", null, new File(tempDir.toFile(), "void")));
}
@Test
void testTargetIsFile() throws Exception {
File target = Files.createFile(tempDir.resolve("file")).toFile();
assertThrows(IOException.class,
() -> File.createTempFile("file", null, target));
}
}