
...
The constructors for FileOutputStream
and FileWriter
do not allow the programmer to explicitly specify file access permissions. In this noncompliant code example, the access permissions of any file created are implementation-defined and may not prevent unauthorized access.:
Code Block | ||
---|---|---|
| ||
Writer out = new FileWriter("file");
|
...
Java 1.6 and earlier lack a mechanism for specifying default permissions upon file creation. Consequently, the problem must be avoided or solved using some mechanism external to Java, such as by using native code and the Java Native Interface (JNI).
Compliant Solution (
...
POSIX)
The Java SE 7 new The I/O facility (java.nio
) provides classes for managing file access permissions. Additionally, many of the methods and constructors that create files accept an argument allowing the program to specify the initial file permissions.
The Files.newByteChannel()
method allows a file to be created with specific permissions. This method is platform-independent, but the actual permissions are platform-specific. This compliant solution defines sufficiently restrictive permissions for POSIX platforms.:
Code Block | ||
---|---|---|
| ||
Path file = new File("file").toPath(); // Throw exception rather than overwrite existing file Set<OpenOption> options = new HashSet<OpenOption>(); options.add(StandardOpenOption.CREATE_NEW); options.add(StandardOpenOption.APPEND); // File permissions should be such that only user may read/write file Set<PosixFilePermission> perms = PosixFilePermissions.fromString("rw-------"); FileAttribute<Set<PosixFilePermission>> attr = PosixFilePermissions.asFileAttribute(perms); try (SeekableByteChannel sbc = Files.newByteChannel(file, options, attr)) { // writeWrite data }; |
Exceptions
FIO01-J-EX0: When a file is created inside a directory that is both secure and unreadable by untrusted users, that file may be created with the default access permissions. This could be the case if, for example, the entire file system is trusted or is accessible only to trusted users . See rule (see FIO00-J. Do not operate on files in shared directories for the definition of a secure directory).
FIO01-J-EX1: Files that do not contain privileged information need not be created with specific access permissions.
...
If files are created without appropriate permissions, an attacker may read or write to the files. This could result in the compromise of , possibly resulting in compromised system integrity and information disclosure.
Rule | Severity | Likelihood | Detectable |
---|
Repairable | Priority | Level |
---|---|---|
FIO01-J | Medium |
Probable |
No |
No | P4 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
---|---|---|---|---|---|---|---|---|---|
CodeSonar |
| JAVA.IO.PERM.ACCESS | Accessing file in permissive mode | ||||||
Parasoft Jtest |
| CERT.FIO01.ASNF | Avoid implicit file creation when a String is passed as an argument | ||||||
PVS-Studio |
| V5318 |
Related Guidelines
VOID FIO06-CPP. Create files with appropriate access permissions | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="564327fe-f648-40f4-97f3-b8050e28ac51"><ac:plain-text-body><![CDATA[
ISO/IEC TR 24772:2010 |
Missing or Inconsistent Access Control [XZN |
] |
, Incorrect |
Execution- |
Assigned Permissions |
, Incorrect |
Default Permissions |
, Incorrect |
Bibliography
Permission Assignment for Critical Resource |
Android Implementation Details
Creating files with weak permissions may allow malicious applications to access the files.
Bibliography
[API 2014] | |
[CVE] | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="16f6ae26-e89d-4551-826b-5d5b36686ff7"><ac:plain-text-body><![CDATA[
[[API 2006
AA. Bibliography#API 06]]
]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="93452ab8-5a11-42da-8e2e-1863dc254377"><ac:plain-text-body><![CDATA[
[[CVE
AA. Bibliography#CVE]]
]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="dfc9e262-ff60-48f8-b07b-4397ab9e7165"><ac:plain-text-body><![CDATA[
[[Dowd 2006
] | Chapter 9, "UNIX 1: Privileges and Files" |
]]></ac:plain-text-body></ac:structured-macro>
[ |
AA. Bibliography#J2SE 11]]
] |
[ |
AA. Bibliography#OpenBSD]]
] |
[ |
] |
"The |
Function" |
|
]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4cfbdabd-c364-455e-aab5-9aa56c1eef91"><ac:plain-text-body><![CDATA[
[[Viega 2003
Function" | |
Section 2.7, "Restricting Access Permissions for New Files on UNIX" |
]]></ac:plain-text-body></ac:structured-macro>
...