CVE-2020-8908: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.


CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 3.3
Published: 2020-12-10T23:15Z
Repository: https://github.com/google/guava
Language: Java
Files changed: android/guava/src/com/google/common/io/Files.java, guava/src/com/google/common/io/Files.java
Commit date: 2020-08-27 11:38:43 -0400
Commit message: Deprecate Files.createTempDir(), noting that better alternatives exist for Android as well as for users running Java 7 or later.

RELNOTES=`io`: Deprecated `Files.createTempDir()`.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=328552787

Diff: diff --git a/android/guava/src/com/google/common/io/Files.java b/android/guava/src/com/google/common/io/Files.java
index a23cd96b3..34de31eff 100644
--- a/android/guava/src/com/google/common/io/Files.java
+++ b/android/guava/src/com/google/common/io/Files.java
@@ -396,20 +396,32 @@ public final class Files {
    * create a directory, not a regular file. A common pitfall is to call {@code createTempFile},
    * delete the file and create a directory in its place, but this leads a race condition which can
    * be exploited to create security vulnerabilities, especially when executable files are to be
    * written into the directory.
    *
+   * <p>Depending on the environmment that this code is run in, the system temporary directory (and
+   * thus the directory this method creates) may be more visible that a program would like - files
+   * written to this directory may be read or overwritten by hostile programs running on the same
+   * machine.
+   *
    * <p>This method assumes that the temporary volume is writable, has free inodes and free blocks,
    * and that it will not be called thousands of times per second.
    *
    * <p><b>{@link java.nio.file.Path} equivalent:</b> {@link
    * java.nio.file.Files#createTempDirectory}.
    *
    * @return the newly-created directory
    * @throws IllegalStateException if the directory could not be created
+   * @deprecated For Android users, see the <a
+   *     href="https://developer.android.com/training/data-storage" target="_blank">Data and File
+   *     Storage overview</a> to select an appropriate temporary directory (perhaps {@code
+   *     context.getCacheDir()}). For developers on Java 7 or later, use {@link
+   *     java.nio.file.Files#createTempDirectory}, transforming it to a {@link File} using {@link
+   *     java.nio.file.Path#toFile() toFile()} if needed.
    */
   @Beta
+  @Deprecated
   public static File createTempDir() {
     File baseDir = new File(System.getProperty("java.io.tmpdir"));
     @SuppressWarnings("GoodTime") // reading system time without TimeSource
     String baseName = System.currentTimeMillis() + "-";
 
diff --git a/guava/src/com/google/common/io/Files.java b/guava/src/com/google/common/io/Files.java
index a23cd96b3..34de31eff 100644
--- a/guava/src/com/google/common/io/Files.java
+++ b/guava/src/com/google/common/io/Files.java
@@ -396,20 +396,32 @@ public final class Files {
    * create a directory, not a regular file. A common pitfall is to call {@code createTempFile},
    * delete the file and create a directory in its place, but this leads a race condition which can
    * be exploited to create security vulnerabilities, especially when executable files are to be
    * written into the directory.
    *
+   * <p>Depending on the environmment that this code is run in, the system temporary directory (and
+   * thus the directory this method creates) may be more visible that a program would like - files
+   * written to this directory may be read or overwritten by hostile programs running on the same
+   * machine.
+   *
    * <p>This method assumes that the temporary volume is writable, has free inodes and free blocks,
    * and that it will not be called thousands of times per second.
    *
    * <p><b>{@link java.nio.file.Path} equivalent:</b> {@link
    * java.nio.file.Files#createTempDirectory}.
    *
    * @return the newly-created directory
    * @throws IllegalStateException if the directory could not be created
+   * @deprecated For Android users, see the <a
+   *     href="https://developer.android.com/training/data-storage" target="_blank">Data and File
+   *     Storage overview</a> to select an appropriate temporary directory (perhaps {@code
+   *     context.getCacheDir()}). For developers on Java 7 or later, use {@link
+   *     java.nio.file.Files#createTempDirectory}, transforming it to a {@link File} using {@link
+   *     java.nio.file.Path#toFile() toFile()} if needed.
    */
   @Beta
+  @Deprecated
   public static File createTempDir() {
     File baseDir = new File(System.getProperty("java.io.tmpdir"));
     @SuppressWarnings("GoodTime") // reading system time without TimeSource
     String baseName = System.currentTimeMillis() + "-";
 

Fixed code:    * <p>Depending on the environmment that this code is run in, the system temporary directory (and
   * thus the directory this method creates) may be more visible that a program would like - files
   * written to this directory may be read or overwritten by hostile programs running on the same
   * machine.
   *
   * @deprecated For Android users, see the <a
   *     href="https://developer.android.com/training/data-storage" target="_blank">Data and File
   *     Storage overview</a> to select an appropriate temporary directory (perhaps {@code
   *     context.getCacheDir()}). For developers on Java 7 or later, use {@link
   *     java.nio.file.Files#createTempDirectory}, transforming it to a {@link File} using {@link
   *     java.nio.file.Path#toFile() toFile()} if needed.
  @Deprecated
   * <p>Depending on the environmment that this code is run in, the system temporary directory (and
   * thus the directory this method creates) may be more visible that a program would like - files
   * written to this directory may be read or overwritten by hostile programs running on the same
   * machine.
   *
   * @deprecated For Android users, see the <a
   *     href="https://developer.android.com/training/data-storage" target="_blank">Data and File
   *     Storage overview</a> to select an appropriate temporary directory (perhaps {@code
   *     context.getCacheDir()}). For developers on Java 7 or later, use {@link
   *     java.nio.file.Files#createTempDirectory}, transforming it to a {@link File} using {@link
   *     java.nio.file.Path#toFile() toFile()} if needed.
  @Deprecated