CVE-2021-21290: Creation of Temporary File in Directory with Insecure Permissions (CWE-379)
value: Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.
CWE description: The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
CVSS v3 base score: 5.5
Published: 2021-02-08T20:15Z
Repository: https://github.com/netty/netty
Language: Java
Files changed: buffer/src/test/java/io/netty/buffer/AbstractByteBufTest.java, buffer/src/test/java/io/netty/buffer/ReadOnlyDirectByteBufferBufTest.java, codec-http/src/main/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpData.java, codec-http/src/test/java/io/netty/handler/codec/http/HttpChunkedInputTest.java, codec-http/src/test/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpDataTest.java, codec-http/src/test/java/io/netty/handler/codec/http/multipart/AbstractMemoryHttpDataTest.java, codec-http/src/test/java/io/netty/handler/codec/http/multipart/DiskFileUploadTest.java, common/src/main/java/io/netty/util/internal/NativeLibraryLoader.java, common/src/main/java/io/netty/util/internal/PlatformDependent.java, handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java, handler/src/test/java/io/netty/handler/stream/ChunkedWriteHandlerTest.java, handler/src/test/java/io/netty/handler/traffic/FileRegionThrottleTest.java, testsuite/src/main/java/io/netty/testsuite/transport/socket/SocketFileRegionTest.java, transport-native-epoll/src/test/java/io/netty/channel/epoll/EpollSpliceTest.java, transport-native-unix-common-tests/src/main/java/io/netty/channel/unix/tests/UnixTestUtils.java, transport/src/test/java/io/netty/channel/DefaultFileRegionTest.java
Commit date: 2021-02-08 11:44:05 +0100
Commit message: Use Files.createTempFile(...) to ensure the file is created with proper permissions

Motivation:

File.createTempFile(String, String)` will create a temporary file in the system temporary directory if the 'java.io.tmpdir'. The permissions on that file utilize the umask. In a majority of cases, this means that the file that java creates has the permissions: `-rw-r--r--`, thus, any other local user on that system can read the contents of that file.
This can be a security concern if any sensitive data is stored in this file.

This was reported by Jonathan Leitschuh <jonathan.leitschuh@gmail.com> as a security problem.

Modifications:

Use Files.createTempFile(...) which will use safe-defaults when running on java 7 and later. If running on java 6 there isnt much we can do, which is fair enough as java 6 shouldnt be considered "safe" anyway.

Result:

Create temporary files with sane permissions by default.

Diff: diff --git a/buffer/src/test/java/io/netty/buffer/AbstractByteBufTest.java b/buffer/src/test/java/io/netty/buffer/AbstractByteBufTest.java
index 0c1bc7fa3..6b3ee2ed0 100644
--- a/buffer/src/test/java/io/netty/buffer/AbstractByteBufTest.java
+++ b/buffer/src/test/java/io/netty/buffer/AbstractByteBufTest.java
@@ -4549,11 +4549,11 @@ public abstract class AbstractByteBufTest {
         buffer.release();
     }
 
     @Test
     public void testReadBytesAndWriteBytesWithFileChannel() throws IOException {
-        File file = File.createTempFile("file-channel", ".tmp");
+        File file = PlatformDependent.createTempFile("file-channel", ".tmp", null);
         RandomAccessFile randomAccessFile = null;
         try {
             randomAccessFile = new RandomAccessFile(file, "rw");
             FileChannel channel = randomAccessFile.getChannel();
             // channelPosition should never be changed
@@ -4592,11 +4592,11 @@ public abstract class AbstractByteBufTest {
         }
     }
 
     @Test
     public void testGetBytesAndSetBytesWithFileChannel() throws IOException {
-        File file = File.createTempFile("file-channel", ".tmp");
+        File file = PlatformDependent.createTempFile("file-channel", ".tmp", null);
         RandomAccessFile randomAccessFile = null;
         try {
             randomAccessFile = new RandomAccessFile(file, "rw");
             FileChannel channel = randomAccessFile.getChannel();
             // channelPosition should never be changed
diff --git a/buffer/src/test/java/io/netty/buffer/ReadOnlyDirectByteBufferBufTest.java b/buffer/src/test/java/io/netty/buffer/ReadOnlyDirectByteBufferBufTest.java
index 725aaf6a2..c77b733f4 100644
--- a/buffer/src/test/java/io/netty/buffer/ReadOnlyDirectByteBufferBufTest.java
+++ b/buffer/src/test/java/io/netty/buffer/ReadOnlyDirectByteBufferBufTest.java
@@ -304,11 +304,11 @@ public class ReadOnlyDirectByteBufferBufTest {
         buf.release();
     }
 
     @Test
     public void testWrapMemoryMapped() throws Exception {
-        File file = File.createTempFile("netty-test", "tmp");
+        File file = PlatformDependent.createTempFile("netty-test", "tmp", null);
         FileChannel output = null;
         FileChannel input = null;
         ByteBuf b1 = null;
         ByteBuf b2 = null;
 
diff --git a/codec-http/src/main/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpData.java b/codec-http/src/main/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpData.java
index db6e0a223..54baafa56 100644
--- a/codec-http/src/main/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpData.java
+++ b/codec-http/src/main/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpData.java
@@ -17,10 +17,11 @@ package io.netty.handler.codec.http.multipart;
 
 import io.netty.buffer.ByteBuf;
 import io.netty.handler.codec.http.HttpConstants;
 import io.netty.util.internal.EmptyArrays;
 import io.netty.util.internal.ObjectUtil;
+import io.netty.util.internal.PlatformDependent;
 import io.netty.util.internal.logging.InternalLogger;
 import io.netty.util.internal.logging.InternalLoggerFactory;
 
 import java.io.File;
 import java.io.IOException;
@@ -86,13 +87,13 @@ public abstract class AbstractDiskHttpData extends AbstractHttpData {
             newpostfix = getPostfix();
         }
         File tmpFile;
         if (getBaseDirectory() == null) {
             // create a temporary file
-            tmpFile = File.createTempFile(getPrefix(), newpostfix);
+            tmpFile = PlatformDependent.createTempFile(getPrefix(), newpostfix, null);
         } else {
-            tmpFile = File.createTempFile(getPrefix(), newpostfix, new File(
+            tmpFile = PlatformDependent.createTempFile(getPrefix(), newpostfix, new File(
                     getBaseDirectory()));
         }
         if (deleteOnExit()) {
             // See https://github.com/netty/netty/issues/10351
             DeleteFileOnExitHook.add(tmpFile.getPath());
diff --git a/codec-http/src/test/java/io/netty/handler/codec/http/HttpChunkedInputTest.java b/codec-http/src/test/java/io/netty/handler/codec/http/HttpChunkedInputTest.java
index f3cc36dee..7a2d1452f 100644
--- a/codec-http/src/test/java/io/netty/handler/codec/http/HttpChunkedInputTest.java
+++ b/codec-http/src/test/java/io/netty/handler/codec/http/HttpChunkedInputTest.java
@@ -23,10 +23,11 @@ import io.netty.handler.stream.ChunkedFile;
 import io.netty.handler.stream.ChunkedInput;
 import io.netty.handler.stream.ChunkedNioFile;
 import io.netty.handler.stream.ChunkedNioStream;
 import io.netty.handler.stream.ChunkedStream;
 import io.netty.handler.stream.ChunkedWriteHandler;
+import io.netty.util.internal.PlatformDependent;
 import org.junit.Test;
 
 import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.FileOutputStream;
@@ -44,11 +45,11 @@ public class HttpChunkedInputTest {
             BYTES[i] = (byte) i;
         }
 
         FileOutputStream out = null;
         try {
-            TMP = File.createTempFile("netty-chunk-", ".tmp");
+            TMP = PlatformDependent.createTempFile("netty-chunk-", ".tmp", null);
             TMP.deleteOnExit();
             out = new FileOutputStream(TMP);
             out.write(BYTES);
             out.flush();
         } catch (IOException e) {
diff --git a/codec-http/src/test/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpDataTest.java b/codec-http/src/test/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpDataTest.java
index 082edabfc..8d450e0e1 100644
--- a/codec-http/src/test/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpDataTest.java
+++ b/codec-http/src/test/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpDataTest.java
@@ -37,11 +37,11 @@ public class AbstractDiskHttpDataTest {
 
     @Test
     public void testGetChunk() throws Exception {
         TestHttpData test = new TestHttpData("test", UTF_8, 0);
         try {
-            File tmpFile = File.createTempFile(UUID.randomUUID().toString(), ".tmp");
+            File tmpFile = PlatformDependent.createTempFile(UUID.randomUUID().toString(), ".tmp", null);
             tmpFile.deleteOnExit();
             FileOutputStream fos = new FileOutputStream(tmpFile);
             byte[] bytes = new byte[4096];
             PlatformDependent.threadLocalRandom().nextBytes(bytes);
             try {
diff --git a/codec-http/src/test/java/io/netty/handler/codec/http/multipart/AbstractMemoryHttpDataTest.java b/codec-http/src/test/java/io/netty/handler/codec/http/multipart/AbstractMemoryHttpDataTest.java
index 480437b48..587e3c1bb 100644
--- a/codec-http/src/test/java/io/netty/handler/codec/http/multipart/AbstractMemoryHttpDataTest.java
+++ b/codec-http/src/test/java/io/netty/handler/codec/http/multipart/AbstractMemoryHttpDataTest.java
@@ -41,11 +41,11 @@ public class AbstractMemoryHttpDataTest {
 
     @Test
     public void testSetContentFromFile() throws Exception {
         TestHttpData test = new TestHttpData("test", UTF_8, 0);
         try {
-            File tmpFile = File.createTempFile(UUID.randomUUID().toString(), ".tmp");
+            File tmpFile = PlatformDependent.createTempFile(UUID.randomUUID().toString(), ".tmp", null);
             tmpFile.deleteOnExit();
             FileOutputStream fos = new FileOutputStream(tmpFile);
             byte[] bytes = new byte[4096];
             PlatformDependent.threadLocalRandom().nextBytes(bytes);
             try {
@@ -68,11 +68,11 @@ public class AbstractMemoryHttpDataTest {
 
     @Test
     public void testRenameTo() throws Exception {
         TestHttpData test = new TestHttpData("test", UTF_8, 0);
         try {
-            File tmpFile = File.createTempFile(UUID.randomUUID().toString(), ".tmp");
+            File tmpFile = PlatformDependent.createTempFile(UUID.randomUUID().toString(), ".tmp", null);
             tmpFile.deleteOnExit();
             final int totalByteCount = 4096;
             byte[] bytes = new byte[totalByteCount];
             PlatformDependent.threadLocalRandom().nextBytes(bytes);
             ByteBuf content = Unpooled.wrappedBuffer(bytes);
diff --git a/codec-http/src/test/java/io/netty/handler/codec/http/multipart/DiskFileUploadTest.java b/codec-http/src/test/java/io/netty/handler/codec/http/multipart/DiskFileUploadTest.java
index 6c494335f..138d0855b 100644
--- a/codec-http/src/test/java/io/netty/handler/codec/http/multipart/DiskFileUploadTest.java
+++ b/codec-http/src/test/java/io/netty/handler/codec/http/multipart/DiskFileUploadTest.java
@@ -271,11 +271,11 @@ public class DiskFileUploadTest {
             assertNotNull(originalFile);
             assertEquals(maxSize, originalFile.length());
             assertEquals(maxSize, f1.length());
             byte[] bytes = new byte[8];
             PlatformDependent.threadLocalRandom().nextBytes(bytes);
-            File tmpFile = File.createTempFile(UUID.randomUUID().toString(), ".tmp");
+            File tmpFile = PlatformDependent.createTempFile(UUID.randomUUID().toString(), ".tmp", null);
             tmpFile.deleteOnExit();
             FileOutputStream fos = new FileOutputStream(tmpFile);
             try {
                 fos.write(bytes);
                 fos.flush();
diff --git a/common/src/main/java/io/netty/util/internal/NativeLibraryLoader.java b/common/src/main/java/io/netty/util/internal/NativeLibraryLoader.java
index dc99f1b95..4a5fb2fd4 100644
--- a/common/src/main/java/io/netty/util/internal/NativeLibraryLoader.java
+++ b/common/src/main/java/io/netty/util/internal/NativeLibraryLoader.java
@@ -175,11 +175,11 @@ public final class NativeLibraryLoader {
 
             int index = libname.lastIndexOf('.');
             String prefix = libname.substring(0, index);
             String suffix = libname.substring(index);
 
-            tmpFile = File.createTempFile(prefix, suffix, WORKDIR);
+            tmpFile = PlatformDependent.createTempFile(prefix, suffix, WORKDIR);
             in = url.openStream();
             out = new FileOutputStream(tmpFile);
 
             if (shouldShadedLibraryIdBePatched(packagePrefix)) {
                 patchShadedLibraryId(in, out, originalName, name);
diff --git a/common/src/main/java/io/netty/util/internal/PlatformDependent.java b/common/src/main/java/io/netty/util/internal/PlatformDependent.java
index 20251b316..89daf214b 100644
--- a/common/src/main/java/io/netty/util/internal/PlatformDependent.java
+++ b/common/src/main/java/io/netty/util/internal/PlatformDependent.java
@@ -36,10 +36,11 @@ import java.io.IOException;
 import java.io.InputStreamReader;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
 import java.nio.ByteBuffer;
 import java.nio.ByteOrder;
+import java.nio.file.Files;
 import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.Deque;
@@ -1387,10 +1388,28 @@ public final class PlatformDependent {
 
     public static Set<String> normalizedLinuxClassifiers() {
         return LINUX_OS_CLASSIFIERS;
     }
 
+    @SuppressJava6Requirement(reason = "Guarded by version check")
+    public static File createTempFile(String prefix, String suffix, File directory) throws IOException {
+        if (javaVersion() >= 7) {
+            if (directory == null) {
+                return Files.createTempFile(prefix, suffix).toFile();
+            }
+            return Files.createTempFile(directory.toPath(), prefix, suffix).toFile();
+        }
+        if (directory == null) {
+            return File.createTempFile(prefix, suffix);
+        }
+        File file = File.createTempFile(prefix, suffix, directory);
+        // Try to adjust the perms, if this fails there is not much else we can do...
+        file.setReadable(false, false);
+        file.setReadable(true, true);
+        return file;
+    }
+
     /**
      * Adds only those classifier strings to <tt>dest</tt> which are present in <tt>allowed</tt>.
      *
      * @param allowed          allowed classifiers
      * @param dest             destination set
diff --git a/handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java b/handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java
index 04e84cafc..46a28d272 100644
--- a/handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java
+++ b/handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java
@@ -18,20 +18,22 @@ package io.netty.handler.ssl.util;
 
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.Unpooled;
 import io.netty.handler.codec.base64.Base64;
 import io.netty.util.CharsetUtil;
+import io.netty.util.internal.PlatformDependent;
 import io.netty.util.internal.SystemPropertyUtil;
 import io.netty.util.internal.ThrowableUtil;
 import io.netty.util.internal.logging.InternalLogger;
 import io.netty.util.internal.logging.InternalLoggerFactory;
 
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.NoSuchAlgorithmException;
 import java.security.PrivateKey;
 import java.security.SecureRandom;
@@ -328,11 +330,11 @@ public final class SelfSignedCertificate {
             }
         } finally {
             wrappedBuf.release();
         }
 
-        File keyFile = File.createTempFile("keyutil_" + fqdn + '_', ".key");
+        File keyFile = PlatformDependent.createTempFile("keyutil_" + fqdn + '_', ".key", null);
         keyFile.deleteOnExit();
 
         OutputStream keyOut = new FileOutputStream(keyFile);
         try {
             keyOut.write(keyText.getBytes(CharsetUtil.US_ASCII));
@@ -359,11 +361,11 @@ public final class SelfSignedCertificate {
             }
         } finally {
             wrappedBuf.release();
         }
 
-        File certFile = File.createTempFile("keyutil_" + fqdn + '_', ".crt");
+        File certFile = PlatformDependent.createTempFile("keyutil_" + fqdn + '_', ".crt", null);
         certFile.deleteOnExit();
 
         OutputStream certOut = new FileOutputStream(certFile);
         try {
             certOut.write(certText.getBytes(CharsetUtil.US_ASCII));
diff --git a/handler/src/test/java/io/netty/handler/stream/ChunkedWriteHandlerTest.java b/handler/src/test/java/io/netty/handler/stream/ChunkedWriteHandlerTest.java
index 8be269ca3..780fec6fe 100644
--- a/handler/src/test/java/io/netty/handler/stream/ChunkedWriteHandlerTest.java
+++ b/handler/src/test/java/io/netty/handler/stream/ChunkedWriteHandlerTest.java
@@ -24,10 +24,11 @@ import io.netty.channel.ChannelHandlerContext;
 import io.netty.channel.ChannelOutboundHandlerAdapter;
 import io.netty.channel.ChannelPromise;
 import io.netty.channel.embedded.EmbeddedChannel;
 import io.netty.util.CharsetUtil;
 import io.netty.util.ReferenceCountUtil;
+import io.netty.util.internal.PlatformDependent;
 import org.junit.Assert;
 import org.junit.Test;
 
 import java.io.ByteArrayInputStream;
 import java.io.File;
@@ -53,11 +54,11 @@ public class ChunkedWriteHandlerTest {
             BYTES[i] = (byte) i;
         }
 
         FileOutputStream out = null;
         try {
-            TMP = File.createTempFile("netty-chunk-", ".tmp");
+            TMP = PlatformDependent.createTempFile("netty-chunk-", ".tmp", null);
             TMP.deleteOnExit();
             out = new FileOutputStream(TMP);
             out.write(BYTES);
             out.flush();
         } catch (IOException e) {
diff --git a/handler/src/test/java/io/netty/handler/traffic/FileRegionThrottleTest.java b/handler/src/test/java/io/netty/handler/traffic/FileRegionThrottleTest.java
index 5b127151a..46ed1b467 100644
--- a/handler/src/test/java/io/netty/handler/traffic/FileRegionThrottleTest.java
+++ b/handler/src/test/java/io/netty/handler/traffic/FileRegionThrottleTest.java
@@ -30,10 +30,11 @@ import io.netty.channel.nio.NioEventLoopGroup;
 import io.netty.channel.socket.SocketChannel;
 import io.netty.channel.socket.nio.NioServerSocketChannel;
 import io.netty.channel.socket.nio.NioSocketChannel;
 import io.netty.handler.codec.LineBasedFrameDecoder;
 import io.netty.util.CharsetUtil;
+import io.netty.util.internal.PlatformDependent;
 import org.junit.After;
 import org.junit.Before;
 import org.junit.BeforeClass;
 import org.junit.Test;
 
@@ -59,11 +60,11 @@ public class FileRegionThrottleTest {
         final Random r = new Random();
         for (int i = 0; i < BYTES.length; i++) {
             BYTES[i] = (byte) r.nextInt(255);
         }
 
-        tmp = File.createTempFile("netty-traffic", ".tmp");
+        tmp = PlatformDependent.createTempFile("netty-traffic", ".tmp", null);
         tmp.deleteOnExit();
         FileOutputStream out = null;
         try {
             out = new FileOutputStream(tmp);
             out.write(BYTES);
diff --git a/testsuite/src/main/java/io/netty/testsuite/transport/socket/SocketFileRegionTest.java b/testsuite/src/main/java/io/netty/testsuite/transport/socket/SocketFileRegionTest.java
index 213ff277e..5639e5cb0 100644
--- a/testsuite/src/main/java/io/netty/testsuite/transport/socket/SocketFileRegionTest.java
+++ b/testsuite/src/main/java/io/netty/testsuite/transport/socket/SocketFileRegionTest.java
@@ -100,11 +100,11 @@ public class SocketFileRegionTest extends AbstractSocketTest {
     public void testFileRegionVoidPromiseNotAutoRead(ServerBootstrap sb, Bootstrap cb) throws Throwable {
         testFileRegion0(sb, cb, true, false, true);
     }
 
     public void testFileRegionCountLargerThenFile(ServerBootstrap sb, Bootstrap cb) throws Throwable {
-        File file = File.createTempFile("netty-", ".tmp");
+        File file = PlatformDependent.createTempFile("netty-", ".tmp", null);
         file.deleteOnExit();
 
         final FileOutputStream out = new FileOutputStream(file);
         out.write(data);
         out.close();
@@ -134,11 +134,11 @@ public class SocketFileRegionTest extends AbstractSocketTest {
             throws Throwable {
         sb.childOption(ChannelOption.AUTO_READ, autoRead);
         cb.option(ChannelOption.AUTO_READ, autoRead);
 
         final int bufferSize = 1024;
-        final File file = File.createTempFile("netty-", ".tmp");
+        final File file = PlatformDependent.createTempFile("netty-", ".tmp", null);
         file.deleteOnExit();
 
         final FileOutputStream out = new FileOutputStream(file);
         final Random random = PlatformDependent.threadLocalRandom();
 
diff --git a/transport-native-epoll/src/test/java/io/netty/channel/epoll/EpollSpliceTest.java b/transport-native-epoll/src/test/java/io/netty/channel/epoll/EpollSpliceTest.java
index e13de3246..a43d9b4d9 100644
--- a/transport-native-epoll/src/test/java/io/netty/channel/epoll/EpollSpliceTest.java
+++ b/transport-native-epoll/src/test/java/io/netty/channel/epoll/EpollSpliceTest.java
@@ -26,10 +26,11 @@ import io.netty.channel.ChannelHandlerContext;
 import io.netty.channel.ChannelInboundHandlerAdapter;
 import io.netty.channel.EventLoopGroup;
 import io.netty.channel.SimpleChannelInboundHandler;
 import io.netty.channel.unix.FileDescriptor;
 import io.netty.util.NetUtil;
+import io.netty.util.internal.PlatformDependent;
 import org.junit.Assert;
 import org.junit.Test;
 
 import java.io.File;
 import java.io.FileInputStream;
@@ -190,11 +191,11 @@ public class EpollSpliceTest {
     }
 
     @Test(timeout = 10000)
     public void spliceToFile() throws Throwable {
         EventLoopGroup group = new EpollEventLoopGroup(1);
-        File file = File.createTempFile("netty-splice", null);
+        File file = PlatformDependent.createTempFile("netty-splice", null, null);
         file.deleteOnExit();
 
         SpliceHandler sh = new SpliceHandler(file);
         ServerBootstrap bs = new ServerBootstrap();
         bs.channel(EpollServerSocketChannel.class);
diff --git a/transport-native-unix-common-tests/src/main/java/io/netty/channel/unix/tests/UnixTestUtils.java b/transport-native-unix-common-tests/src/main/java/io/netty/channel/unix/tests/UnixTestUtils.java
index 346be7b04..7ee43e1e3 100644
--- a/transport-native-unix-common-tests/src/main/java/io/netty/channel/unix/tests/UnixTestUtils.java
+++ b/transport-native-unix-common-tests/src/main/java/io/netty/channel/unix/tests/UnixTestUtils.java
@@ -15,20 +15,21 @@
  */
 package io.netty.channel.unix.tests;
 
 import io.netty.channel.unix.DomainSocketAddress;
 import io.netty.channel.unix.Socket;
+import io.netty.util.internal.PlatformDependent;
 
 import java.io.File;
 import java.io.IOException;
 
 public final class UnixTestUtils {
     public static DomainSocketAddress newSocketAddress() {
         try {
             File file;
             do {
-                file = File.createTempFile("NETTY", "UDS");
+                file = PlatformDependent.createTempFile("NETTY", "UDS", null);
                 if (!file.delete()) {
                     throw new IOException("failed to delete: " + file);
                 }
             } while (file.getAbsolutePath().length() > 128);
             return new DomainSocketAddress(file);
diff --git a/transport/src/test/java/io/netty/channel/DefaultFileRegionTest.java b/transport/src/test/java/io/netty/channel/DefaultFileRegionTest.java
index dce19709d..7523a198e 100644
--- a/transport/src/test/java/io/netty/channel/DefaultFileRegionTest.java
+++ b/transport/src/test/java/io/netty/channel/DefaultFileRegionTest.java
@@ -37,11 +37,11 @@ public class DefaultFileRegionTest {
     static {
         PlatformDependent.threadLocalRandom().nextBytes(data);
     }
 
     private static File newFile() throws IOException {
-        File file = File.createTempFile("netty-", ".tmp");
+        File file = PlatformDependent.createTempFile("netty-", ".tmp", null);
         file.deleteOnExit();
 
         final FileOutputStream out = new FileOutputStream(file);
         out.write(data);
         out.close();

Vulnerable code:         File file = File.createTempFile("file-channel", ".tmp");
        File file = File.createTempFile("file-channel", ".tmp");
        File file = File.createTempFile("netty-test", "tmp");
            tmpFile = File.createTempFile(getPrefix(), newpostfix);
            tmpFile = File.createTempFile(getPrefix(), newpostfix, new File(
            TMP = File.createTempFile("netty-chunk-", ".tmp");
            File tmpFile = File.createTempFile(UUID.randomUUID().toString(), ".tmp");
            File tmpFile = File.createTempFile(UUID.randomUUID().toString(), ".tmp");
            File tmpFile = File.createTempFile(UUID.randomUUID().toString(), ".tmp");
            File tmpFile = File.createTempFile(UUID.randomUUID().toString(), ".tmp");
            tmpFile = File.createTempFile(prefix, suffix, WORKDIR);
        File keyFile = File.createTempFile("keyutil_" + fqdn + '_', ".key");
        File certFile = File.createTempFile("keyutil_" + fqdn + '_', ".crt");
            TMP = File.createTempFile("netty-chunk-", ".tmp");
        tmp = File.createTempFile("netty-traffic", ".tmp");
        File file = File.createTempFile("netty-", ".tmp");
        final File file = File.createTempFile("netty-", ".tmp");
        File file = File.createTempFile("netty-splice", null);
                file = File.createTempFile("NETTY", "UDS");
        File file = File.createTempFile("netty-", ".tmp");
Fixed code:         File file = PlatformDependent.createTempFile("file-channel", ".tmp", null);
        File file = PlatformDependent.createTempFile("file-channel", ".tmp", null);
        File file = PlatformDependent.createTempFile("netty-test", "tmp", null);
import io.netty.util.internal.PlatformDependent;
            tmpFile = PlatformDependent.createTempFile(getPrefix(), newpostfix, null);
            tmpFile = PlatformDependent.createTempFile(getPrefix(), newpostfix, new File(
import io.netty.util.internal.PlatformDependent;
            TMP = PlatformDependent.createTempFile("netty-chunk-", ".tmp", null);
            File tmpFile = PlatformDependent.createTempFile(UUID.randomUUID().toString(), ".tmp", null);
            File tmpFile = PlatformDependent.createTempFile(UUID.randomUUID().toString(), ".tmp", null);
            File tmpFile = PlatformDependent.createTempFile(UUID.randomUUID().toString(), ".tmp", null);
            File tmpFile = PlatformDependent.createTempFile(UUID.randomUUID().toString(), ".tmp", null);
            tmpFile = PlatformDependent.createTempFile(prefix, suffix, WORKDIR);
import java.nio.file.Files;
    @SuppressJava6Requirement(reason = "Guarded by version check")
    public static File createTempFile(String prefix, String suffix, File directory) throws IOException {
        if (javaVersion() >= 7) {
            if (directory == null) {
                return Files.createTempFile(prefix, suffix).toFile();
            }
            return Files.createTempFile(directory.toPath(), prefix, suffix).toFile();
        }
        if (directory == null) {
            return File.createTempFile(prefix, suffix);
        }
        File file = File.createTempFile(prefix, suffix, directory);
        // Try to adjust the perms, if this fails there is not much else we can do...
        file.setReadable(false, false);
        file.setReadable(true, true);
        return file;
    }

import io.netty.util.internal.PlatformDependent;
import java.nio.file.Files;
        File keyFile = PlatformDependent.createTempFile("keyutil_" + fqdn + '_', ".key", null);
        File certFile = PlatformDependent.createTempFile("keyutil_" + fqdn + '_', ".crt", null);
import io.netty.util.internal.PlatformDependent;
            TMP = PlatformDependent.createTempFile("netty-chunk-", ".tmp", null);
import io.netty.util.internal.PlatformDependent;
        tmp = PlatformDependent.createTempFile("netty-traffic", ".tmp", null);
        File file = PlatformDependent.createTempFile("netty-", ".tmp", null);
        final File file = PlatformDependent.createTempFile("netty-", ".tmp", null);
import io.netty.util.internal.PlatformDependent;
        File file = PlatformDependent.createTempFile("netty-splice", null, null);
import io.netty.util.internal.PlatformDependent;
                file = PlatformDependent.createTempFile("NETTY", "UDS", null);
        File file = PlatformDependent.createTempFile("netty-", ".tmp", null);