CVE-2022-21126: Exposure of Resource to Wrong Sphere (CWE-668)
value: The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 7.8
Published: 2022-11-29T17:15Z
Repository: https://github.com/samtools/htsjdk
Language: Java
Files changed: src/main/java/htsjdk/samtools/CoordinateSortedPairInfoMap.java, src/main/java/htsjdk/samtools/util/IOUtil.java, src/test/java/htsjdk/samtools/BAMMergerTest.java, src/test/java/htsjdk/samtools/CRAMFileWriterTest.java, src/test/java/htsjdk/samtools/CRAMMergerTest.java, src/test/java/htsjdk/samtools/reference/FastaSequenceIndexCreatorTest.java, src/test/java/htsjdk/samtools/seekablestream/SeekableStreamFactoryTest.java, src/test/java/htsjdk/samtools/util/IOUtilTest.java, src/test/java/htsjdk/tribble/index/IndexFactoryTest.java, src/test/java/htsjdk/tribble/index/IndexTest.java, src/test/java/htsjdk/tribble/index/tabix/TabixIndexTest.java, src/test/java/htsjdk/variant/vcf/VCFFileReaderTest.java, src/test/java/htsjdk/variant/vcf/VCFMergerTest.java
Commit date: 2022-09-23 16:32:37 -0400
Commit message: Fix temporary directory hijacking or temporary directory information disclosure (#1621)

This replaces and closes #1617.

Fix a vulnerability which allows a malicious user access files created in a temp directory if it was created using IOUtils.createTempDir.  
The implementation has been changed to use the more secure Files.createTemporaryDirectory(). This has a side effect of making the second "suffix" argument no longer usable and it is now simply appended to the existing prefix.  
Deprecating IOUtils.createTempDir(String, String) and adding a new single argument version instead which returns a Path.

This potentially exposed data created by CoordinateSortedPairInfoMaps on shared systems to a malicious users with access to the global temp directory.  

It is recommended that user upgrade if they use CoordinateSortedPairInfoMap or IOUTils.createTempDir() in their code.

* vuln-fix: Temporary Directory Hijacking or Information Disclosure

This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure.

Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions
Severity: High
CVSSS: 7.3
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/10

Co-authored-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Co-authored-by: Moderne <team@moderne.io>
Diff: diff --git a/src/main/java/htsjdk/samtools/CoordinateSortedPairInfoMap.java b/src/main/java/htsjdk/samtools/CoordinateSortedPairInfoMap.java
index 37c200cc..f28b003e 100644
--- a/src/main/java/htsjdk/samtools/CoordinateSortedPairInfoMap.java
+++ b/src/main/java/htsjdk/samtools/CoordinateSortedPairInfoMap.java
@@ -54,11 +54,11 @@ public class CoordinateSortedPairInfoMap<KEY, REC> implements Iterable<Map.Entry
     // -1 is a valid sequence index in this case
     private final int INVALID_SEQUENCE_INDEX = -2;
     /**
      * directory where files will go
      */
-    private final File workDir = IOUtil.createTempDir("CSPI.", null);
+    private final File workDir = IOUtil.createTempDir("CSPI.tmp").toFile();
     private int sequenceIndexOfMapInRam = INVALID_SEQUENCE_INDEX;
     private Map<KEY, REC> mapInRam = null;
     private final FileAppendStreamLRUCache outputStreams;
     private final Codec<KEY, REC> elementCodec;
     // Key is reference index (which is in the range [-1 .. max sequence index].
diff --git a/src/main/java/htsjdk/samtools/util/IOUtil.java b/src/main/java/htsjdk/samtools/util/IOUtil.java
old mode 100755
new mode 100644
index 81351e29..d473bebb
--- a/src/main/java/htsjdk/samtools/util/IOUtil.java
+++ b/src/main/java/htsjdk/samtools/util/IOUtil.java
@@ -972,29 +972,38 @@ public class IOUtil {
             }
         }
     }
 
     /**
-     * Create a temporary subdirectory in the default temporary-file directory, using the given prefix and suffix to generate the name.
+     * Create a temporary subdirectory in the default temporary-file directory, using the given prefix and morePrefix to generate the name.
      * Note that this method is not completely safe, because it create a temporary file, deletes it, and then creates
      * a directory with the same name as the file.  Should be good enough.
      *
-     * @param prefix The prefix string to be used in generating the file's name; must be at least three characters long
-     * @param suffix The suffix string to be used in generating the file's name; may be null, in which case the suffix ".tmp" will be used
+     * This has been updated to avoid the problem in https://github.com/samtools/htsjdk/pull/1617
+     *
+     * @param prefix The prefix string to be used in generating the file's name;
+     * @param morePrefix This was previously a suffix but the implementation changed; may be null, in which case the morePrefix ".tmp" will be used
      * @return File object for new directory
+     * @deprecated  Use {@link #createTempDir(String)} instead.
+     *              It turns out the mechanism was not "good enough" and caused security issues, the new implementation
+     *              combines the prefix/morePrefix into a single prefix.  The security flaw is fixed but due to the now
+     *              extraneous morePrefix argument it is recommended to use the 1 argument form.
+     */
+    @Deprecated
+    public static File createTempDir(final String prefix, final String morePrefix) {
+        final String dotSeparatedSuffix = morePrefix == null ? ".tmp" : morePrefix.startsWith(".") ? morePrefix : "." + morePrefix;
+        return createTempDir(prefix + dotSeparatedSuffix).toFile() ;
+    }
+
+    /*
+     * Create a temporary subdirectory in the default temporary-file directory, using the given prefix and suffix to generate the name.
+     * @param prefix The prefix string to be used in generating the file's name, may be null
      */
-    public static File createTempDir(final String prefix, final String suffix) {
+    public static Path createTempDir(final String prefix) {
         try {
-            final File tmp = File.createTempFile(prefix, suffix);
-            if (!tmp.delete()) {
-                throw new SAMException("Could not delete temporary file " + tmp);
-            }
-            if (!tmp.mkdir()) {
-                throw new SAMException("Could not create temporary directory " + tmp);
-            }
-            return tmp;
-        } catch (IOException e) {
+            return Files.createTempDirectory(prefix);
+        } catch (final IOException e) {
             throw new SAMException("Exception creating temporary directory.", e);
         }
     }
 
     /** Checks that a file exists and is readable, and then returns a buffered reader for it. */
diff --git a/src/test/java/htsjdk/samtools/BAMMergerTest.java b/src/test/java/htsjdk/samtools/BAMMergerTest.java
index f8dd4064..a86de2de 100644
--- a/src/test/java/htsjdk/samtools/BAMMergerTest.java
+++ b/src/test/java/htsjdk/samtools/BAMMergerTest.java
@@ -220,11 +220,11 @@ public class BAMMergerTest extends HtsjdkTest {
         return textBai;
     }
 
     @Test
     public void test() throws IOException {
-        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".", ".tmp").toPath();
+        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".tmp");
         IOUtil.deleteOnExit(outputDir);
 
         final Path outputBam = File.createTempFile(this.getClass().getSimpleName() + ".", ".bam").toPath();
         IOUtil.deleteOnExit(outputBam);
 
diff --git a/src/test/java/htsjdk/samtools/CRAMFileWriterTest.java b/src/test/java/htsjdk/samtools/CRAMFileWriterTest.java
index c61f9acd..87482ee2 100644
--- a/src/test/java/htsjdk/samtools/CRAMFileWriterTest.java
+++ b/src/test/java/htsjdk/samtools/CRAMFileWriterTest.java
@@ -269,15 +269,15 @@ public class CRAMFileWriterTest extends HtsjdkTest {
 
     @Test
     public void test_roundtrip_many_reads() throws IOException {
 
         // Create the input file
-        final File outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".", ".tmp");
+        final File outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".tmp").toFile();
         outputDir.deleteOnExit();
         final Path output = new File(outputDir, "input.cram").toPath();
         IOUtil.deleteOnExit(output);
-        final Path fastaDir = IOUtil.createTempDir("CRAMFileWriterTest", "").toPath();
+        final Path fastaDir = IOUtil.createTempDir("CRAMFileWriterTest");
         IOUtil.deleteOnExit(fastaDir);
         final Path newFasta = fastaDir.resolve("input.fasta");
         IOUtil.deleteOnExit(newFasta);
         IOUtil.deleteOnExit(ReferenceSequenceFileFactory.getFastaIndexFileName(newFasta));
         IOUtil.deleteOnExit(ReferenceSequenceFileFactory.getDefaultDictionaryForReferenceSequence(newFasta));
diff --git a/src/test/java/htsjdk/samtools/CRAMMergerTest.java b/src/test/java/htsjdk/samtools/CRAMMergerTest.java
index 34f793cc..3272a776 100644
--- a/src/test/java/htsjdk/samtools/CRAMMergerTest.java
+++ b/src/test/java/htsjdk/samtools/CRAMMergerTest.java
@@ -191,11 +191,11 @@ public class CRAMMergerTest extends HtsjdkTest {
         return crai;
     }
 
     @Test
     public void test() throws IOException {
-        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".", ".tmp").toPath();
+        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".tmp");
         IOUtil.deleteOnExit(outputDir);
 
         final Path outputCram = File.createTempFile(this.getClass().getSimpleName() + ".", FileExtensions.CRAM).toPath();
         IOUtil.deleteOnExit(outputCram);
 
diff --git a/src/test/java/htsjdk/samtools/reference/FastaSequenceIndexCreatorTest.java b/src/test/java/htsjdk/samtools/reference/FastaSequenceIndexCreatorTest.java
index 193770ab..41c3d7bc 100644
--- a/src/test/java/htsjdk/samtools/reference/FastaSequenceIndexCreatorTest.java
+++ b/src/test/java/htsjdk/samtools/reference/FastaSequenceIndexCreatorTest.java
@@ -61,11 +61,11 @@ public class FastaSequenceIndexCreatorTest extends HtsjdkTest {
     }
 
     @Test(dataProvider = "indexedSequences")
     public void testCreate(final File indexedFile) throws Exception {
         // copy the file to index
-        final File tempDir = IOUtil.createTempDir("FastaSequenceIndexCreatorTest", "testCreate");
+        final File tempDir = IOUtil.createTempDir("FastaSequenceIndexCreatorTest.testCreate").toFile();
         final File copied = new File(tempDir, indexedFile.getName());
         copied.deleteOnExit();
         Files.copy(indexedFile.toPath(), copied.toPath());
 
         // create the index for the copied file
diff --git a/src/test/java/htsjdk/samtools/seekablestream/SeekableStreamFactoryTest.java b/src/test/java/htsjdk/samtools/seekablestream/SeekableStreamFactoryTest.java
index 26e7868d..c5e6126e 100644
--- a/src/test/java/htsjdk/samtools/seekablestream/SeekableStreamFactoryTest.java
+++ b/src/test/java/htsjdk/samtools/seekablestream/SeekableStreamFactoryTest.java
@@ -50,11 +50,11 @@ public class SeekableStreamFactoryTest extends HtsjdkTest {
     @Test
     public void testPathWithEmbeddedSpace() throws IOException {
         final File testBam =  new File(TEST_DATA_DIR, "BAMFileIndexTest/index_test.bam");
 
         //create a temp dir with a space in the name and copy the test file there
-        final File tempDir = IOUtil.createTempDir("test spaces", "");
+        final File tempDir = IOUtil.createTempDir("test spaces").toFile();
         Assert.assertTrue(tempDir.getAbsolutePath().contains(" "));
         tempDir.deleteOnExit();
         final File inputBam = new File(tempDir, "index_test.bam");
         inputBam.deleteOnExit();
         IOUtil.copyFile(testBam, inputBam);
diff --git a/src/test/java/htsjdk/samtools/util/IOUtilTest.java b/src/test/java/htsjdk/samtools/util/IOUtilTest.java
index 9b3b60ff..8354b5ba 100644
--- a/src/test/java/htsjdk/samtools/util/IOUtilTest.java
+++ b/src/test/java/htsjdk/samtools/util/IOUtilTest.java
@@ -310,11 +310,11 @@ public class IOUtilTest extends HtsjdkTest {
         }
     }
 
     @Test(dataProvider = "fileNamesForDelete")
     public void testDeletePathLocal(final List<String> fileNames) throws Exception {
-        final File tmpDir = IOUtil.createTempDir("testDeletePath", "");
+        final Path tmpDir = IOUtil.createTempDir("testDeletePath");
         final List<Path> paths = createLocalFiles(tmpDir, fileNames);
         testDeletePaths(paths);
     }
 
     @Test
@@ -339,11 +339,11 @@ public class IOUtilTest extends HtsjdkTest {
         testDeletePaths(paths);
     }
 
     @Test(dataProvider = "fileNamesForDelete")
     public void testDeleteArrayPathLocal(final List<String> fileNames) throws Exception {
-        final File tmpDir = IOUtil.createTempDir("testDeletePath", "");
+        final Path tmpDir = IOUtil.createTempDir("testDeletePath");
         final List<Path> paths = createLocalFiles(tmpDir, fileNames);
         testDeletePathArray(paths);
     }
 
     @Test(dataProvider = "fileNamesForDelete")
@@ -363,16 +363,15 @@ public class IOUtilTest extends HtsjdkTest {
         paths.forEach(p -> Assert.assertTrue(Files.exists(p)));
         IOUtil.deletePaths(paths.toArray(new Path[paths.size()]));
         paths.forEach(p -> Assert.assertFalse(Files.exists(p)));
     }
 
-    private static List<Path> createLocalFiles(final File tmpDir, final List<String> fileNames) throws Exception {
+    private static List<Path> createLocalFiles(final Path tmpDir, final List<String> fileNames) throws Exception {
         final List<Path> paths = new ArrayList<>(fileNames.size());
         for (final String f: fileNames) {
-            final File file = new File(tmpDir, f);
-            Assert.assertTrue(file.createNewFile(), "failed to create test file" +file);
-            paths.add(file.toPath());
+            final Path file = Files.createFile(tmpDir.resolve(f));
+            paths.add(file);
         }
         return paths;
     }
 
     private List<Path> createJimfsFiles(final String folderName, final List<String> fileNames) throws Exception {
diff --git a/src/test/java/htsjdk/tribble/index/IndexFactoryTest.java b/src/test/java/htsjdk/tribble/index/IndexFactoryTest.java
index e127fd4b..3897cbc9 100644
--- a/src/test/java/htsjdk/tribble/index/IndexFactoryTest.java
+++ b/src/test/java/htsjdk/tribble/index/IndexFactoryTest.java
@@ -164,11 +164,11 @@ public class IndexFactoryTest extends HtsjdkTest {
     @Test(dataProvider = "vcfDataProvider")
     public void testCreateTabixIndexFromVCF(
             final File inputVCF,
             final Interval queryInterval) throws IOException {
         // copy the original file and create the index for the copy
-        final File tempDir = IOUtil.createTempDir("testCreateTabixIndexFromVCF", null);
+        final File tempDir = IOUtil.createTempDir("testCreateTabixIndexFromVCF").toFile();
         tempDir.deleteOnExit();
         final File tmpVCF = new File(tempDir, inputVCF.getName());
         Files.copy(inputVCF, tmpVCF);
         tmpVCF.deleteOnExit();
 
@@ -206,11 +206,11 @@ public class IndexFactoryTest extends HtsjdkTest {
     }
 
     @Test(dataProvider = "bcfDataFactory")
     public void testCreateLinearIndexFromBCF(final File inputBCF) throws IOException {
         // copy the original file and create the index for the copy
-        final File tempDir = IOUtil.createTempDir("testCreateIndexFromBCF", null);
+        final File tempDir = IOUtil.createTempDir("testCreateIndexFromBCF").toFile();
         tempDir.deleteOnExit();
         final File tmpBCF = new File(tempDir, inputBCF.getName());
         Files.copy(inputBCF, tmpBCF);
         tmpBCF.deleteOnExit();
 
@@ -248,11 +248,11 @@ public class IndexFactoryTest extends HtsjdkTest {
     }
 
     @Test(dataProvider = "getRedirectFiles")
     public void testIndexRedirectedFiles(String input, IndexFactory.IndexType type) throws IOException {
         final VCFRedirectCodec codec = new VCFRedirectCodec();
-        final File dir = IOUtil.createTempDir("redirec-test", "dir");
+        final File dir = IOUtil.createTempDir("redirec-test.dir").toFile();
         try {
             final File tmpInput = new File(dir, new File(input).getName());
             Files.copy(new File(input), tmpInput);
             final File tmpDataFile = new File(codec.getPathToDataFile(tmpInput.toString()));
             Assert.assertTrue(new File(tmpDataFile.getAbsoluteFile().getParent()).mkdir());
diff --git a/src/test/java/htsjdk/tribble/index/IndexTest.java b/src/test/java/htsjdk/tribble/index/IndexTest.java
index 55a92a11..516e7883 100644
--- a/src/test/java/htsjdk/tribble/index/IndexTest.java
+++ b/src/test/java/htsjdk/tribble/index/IndexTest.java
@@ -129,11 +129,11 @@ public class IndexTest extends HtsjdkTest {
         }
     }
 
     @Test(dataProvider = "writeIndexData")
     public void testWriteBasedOnNonRegularFeatureFile(final File inputFile, final IndexFactory.IndexType type, final  FeatureCodec codec) throws Exception {
-        final File tmpFolder = IOUtil.createTempDir("NonRegultarFeatureFile", null);
+        final File tmpFolder = IOUtil.createTempDir("NonRegultarFeatureFile").toFile();
         // create the index
         final Index index = IndexFactory.createIndex(inputFile, codec, type);
         // try to write based on the tmpFolder
         Assert.assertThrows(IOException.class, () -> index.writeBasedOnFeatureFile(tmpFolder));
     }
diff --git a/src/test/java/htsjdk/tribble/index/tabix/TabixIndexTest.java b/src/test/java/htsjdk/tribble/index/tabix/TabixIndexTest.java
index 87a16f6f..3012952b 100644
--- a/src/test/java/htsjdk/tribble/index/tabix/TabixIndexTest.java
+++ b/src/test/java/htsjdk/tribble/index/tabix/TabixIndexTest.java
@@ -188,11 +188,11 @@ public class TabixIndexTest extends HtsjdkTest {
     public void testBedTabixIndex(
             final File inputBed,
             final List<Interval> queryIntervals
     ) throws Exception {
         // copy the input file and create an index for the copy
-        final File tempDir = IOUtil.createTempDir("testBedTabixIndex", null);
+        final File tempDir = IOUtil.createTempDir("testBedTabixIndex.tmp").toFile();
         tempDir.deleteOnExit();
         final File tmpBed = new File(tempDir, inputBed.getName());
         Files.copy(inputBed, tmpBed);
         tmpBed.deleteOnExit();
         final TabixIndex tabixIndexGz = IndexFactory.createTabixIndex(tmpBed, new BEDCodec(), null);
diff --git a/src/test/java/htsjdk/variant/vcf/VCFFileReaderTest.java b/src/test/java/htsjdk/variant/vcf/VCFFileReaderTest.java
index 383d272a..d848209d 100644
--- a/src/test/java/htsjdk/variant/vcf/VCFFileReaderTest.java
+++ b/src/test/java/htsjdk/variant/vcf/VCFFileReaderTest.java
@@ -108,11 +108,11 @@ public class VCFFileReaderTest extends HtsjdkTest {
         final File testTBI =  new File(TEST_DATA_DIR, "HiSeq.10000.vcf.bgz.tbi");
 
         // Copy the input files into a temporary directory with embedded spaces in the name.
         // This test needs to include the associated .tbi file because we want to force execution
         // of the tabix code path.
-        final File tempDir = IOUtil.createTempDir("test spaces", "");
+        final File tempDir = IOUtil.createTempDir("test spaces").toFile();
         Assert.assertTrue(tempDir.getAbsolutePath().contains(" "));
         tempDir.deleteOnExit();
         final File inputVCF = new File(tempDir, "HiSeq.10000.vcf.bgz");
         inputVCF.deleteOnExit();
         final File inputTBI = new File(tempDir, "HiSeq.10000.vcf.bgz.tbi");
diff --git a/src/test/java/htsjdk/variant/vcf/VCFMergerTest.java b/src/test/java/htsjdk/variant/vcf/VCFMergerTest.java
index 4067e7c8..8c769c85 100644
--- a/src/test/java/htsjdk/variant/vcf/VCFMergerTest.java
+++ b/src/test/java/htsjdk/variant/vcf/VCFMergerTest.java
@@ -204,11 +204,11 @@ public class VCFMergerTest extends HtsjdkTest {
         return tbi;
     }
 
     @Test
     public void test() throws IOException {
-        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".", ".tmp").toPath();
+        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".tmp");
         IOUtil.deleteOnExit(outputDir);
 
         final Path outputVcf = File.createTempFile(this.getClass().getSimpleName() + ".", FileExtensions.COMPRESSED_VCF).toPath();
         IOUtil.deleteOnExit(outputVcf);
 

Vulnerable code:     private final File workDir = IOUtil.createTempDir("CSPI.", null);
     * Create a temporary subdirectory in the default temporary-file directory, using the given prefix and suffix to generate the name.
     * @param prefix The prefix string to be used in generating the file's name; must be at least three characters long
     * @param suffix The suffix string to be used in generating the file's name; may be null, in which case the suffix ".tmp" will be used
    public static File createTempDir(final String prefix, final String suffix) {
            final File tmp = File.createTempFile(prefix, suffix);
            if (!tmp.delete()) {
                throw new SAMException("Could not delete temporary file " + tmp);
            }
            if (!tmp.mkdir()) {
                throw new SAMException("Could not create temporary directory " + tmp);
            }
            return tmp;
        } catch (IOException e) {
        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".", ".tmp").toPath();
        final File outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".", ".tmp");
        final Path fastaDir = IOUtil.createTempDir("CRAMFileWriterTest", "").toPath();
        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".", ".tmp").toPath();
        final File tempDir = IOUtil.createTempDir("FastaSequenceIndexCreatorTest", "testCreate");
        final File tempDir = IOUtil.createTempDir("test spaces", "");
        final File tmpDir = IOUtil.createTempDir("testDeletePath", "");
        final File tmpDir = IOUtil.createTempDir("testDeletePath", "");
    private static List<Path> createLocalFiles(final File tmpDir, final List<String> fileNames) throws Exception {
            final File file = new File(tmpDir, f);
            Assert.assertTrue(file.createNewFile(), "failed to create test file" +file);
            paths.add(file.toPath());
        final File tempDir = IOUtil.createTempDir("testCreateTabixIndexFromVCF", null);
        final File tempDir = IOUtil.createTempDir("testCreateIndexFromBCF", null);
        final File dir = IOUtil.createTempDir("redirec-test", "dir");
        final File tmpFolder = IOUtil.createTempDir("NonRegultarFeatureFile", null);
        final File tempDir = IOUtil.createTempDir("testBedTabixIndex", null);
        final File tempDir = IOUtil.createTempDir("test spaces", "");
        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".", ".tmp").toPath();
Fixed code:     private final File workDir = IOUtil.createTempDir("CSPI.tmp").toFile();
     * Create a temporary subdirectory in the default temporary-file directory, using the given prefix and morePrefix to generate the name.
     * This has been updated to avoid the problem in https://github.com/samtools/htsjdk/pull/1617
     *
     * @param prefix The prefix string to be used in generating the file's name;
     * @param morePrefix This was previously a suffix but the implementation changed; may be null, in which case the morePrefix ".tmp" will be used
     * @deprecated  Use {@link #createTempDir(String)} instead.
     *              It turns out the mechanism was not "good enough" and caused security issues, the new implementation
     *              combines the prefix/morePrefix into a single prefix.  The security flaw is fixed but due to the now
     *              extraneous morePrefix argument it is recommended to use the 1 argument form.
     */
    @Deprecated
    public static File createTempDir(final String prefix, final String morePrefix) {
        final String dotSeparatedSuffix = morePrefix == null ? ".tmp" : morePrefix.startsWith(".") ? morePrefix : "." + morePrefix;
        return createTempDir(prefix + dotSeparatedSuffix).toFile() ;
    }

    /*
     * Create a temporary subdirectory in the default temporary-file directory, using the given prefix and suffix to generate the name.
     * @param prefix The prefix string to be used in generating the file's name, may be null
    public static Path createTempDir(final String prefix) {
            return Files.createTempDirectory(prefix);
        } catch (final IOException e) {
        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".tmp");
        final File outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".tmp").toFile();
        final Path fastaDir = IOUtil.createTempDir("CRAMFileWriterTest");
        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".tmp");
        final File tempDir = IOUtil.createTempDir("FastaSequenceIndexCreatorTest.testCreate").toFile();
        final File tempDir = IOUtil.createTempDir("test spaces").toFile();
        final Path tmpDir = IOUtil.createTempDir("testDeletePath");
        final Path tmpDir = IOUtil.createTempDir("testDeletePath");
    private static List<Path> createLocalFiles(final Path tmpDir, final List<String> fileNames) throws Exception {
            final Path file = Files.createFile(tmpDir.resolve(f));
            paths.add(file);
        final File tempDir = IOUtil.createTempDir("testCreateTabixIndexFromVCF").toFile();
        final File tempDir = IOUtil.createTempDir("testCreateIndexFromBCF").toFile();
        final File dir = IOUtil.createTempDir("redirec-test.dir").toFile();
        final File tmpFolder = IOUtil.createTempDir("NonRegultarFeatureFile").toFile();
        final File tempDir = IOUtil.createTempDir("testBedTabixIndex.tmp").toFile();
        final File tempDir = IOUtil.createTempDir("test spaces").toFile();
        final Path outputDir = IOUtil.createTempDir(this.getClass().getSimpleName() + ".tmp");