Race Condition vulnerability #135
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes a race condition vulnerability in the createTempDirectory method that could allow attackers to exploit the gap between file deletion and directory creation
Problem
The original implementation used an unsafe pattern:
This creates a window where an attacker could:
Solution
Replace the unsafe temporary directory creation with Files.createTempDirectory() from Java NIO.2, which creates directories atomically and securely without the race condition
References:
https://cwe.mitre.org/data/definitions/362.html
UniversaBlockchain/universa@1e34b18