Fix java/local-temp-file-or-directory-information-disclosure CodeQL alerts by using NIO temp file APIs

opendj-embedded/src/main/java/org/openidentityplatform/opendj/embedded/EmbeddedOpenDJ.java

@@ -11,7 +11,7 @@
  * Header, with the fields enclosed by brackets [] replaced by your own identifying
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
- * Copyright 2024 3A Systems LLC.
+ * Copyright 2024-2026 3A Systems LLC.
  */
 
 package org.openidentityplatform.opendj.embedded;
@@ -69,12 +69,13 @@ public EmbeddedOpenDJ(Config config) {
         logger.info("Create embedded OpenDJ instance: {}", config);
 
         this.config = config;
-        File tempDirectory = new File(System.getProperty("java.io.tmpdir"));
-        File rootDirectory = new File(tempDirectory, "opendj");
         try {
-            if(rootDirectory.exists()) {
-                FileUtils.deleteDirectory(rootDirectory);
-            }
+            // Create a fresh per-instance parent directory, only accessible by the
+            // current user, instead of the fixed shared {java.io.tmpdir}/opendj
+            // directory. The server root inside it must be named "opendj" because
+            // setup from an archive requires the server root directory to match the
+            // root directory contained in the archive.
+            File rootDirectory = new File(Files.createTempDirectory("opendj").toFile(), "opendj");
             rootDirectory.mkdir();
 
             File configDirectory = new File(rootDirectory, "config");

opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/ControlPanelLauncher.java

@@ -13,6 +13,7 @@
  *
  * Copyright 2008-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
  */
 package org.opends.guitools.controlpanel;
 
@@ -23,6 +24,7 @@
 
 import java.io.File;
 import java.io.PrintStream;
+import java.nio.file.Files;
 
 import javax.swing.SwingUtilities;
 
@@ -64,7 +66,7 @@ public static void main(String[] args)
   {
     try {
       ControlPanelLog.initLogFileHandler(
-          File.createTempFile(LOG_FILE_PREFIX, LOG_FILE_SUFFIX));
+          Files.createTempFile(LOG_FILE_PREFIX, LOG_FILE_SUFFIX).toFile());
     } catch (Throwable t) {
       System.err.println("Unable to initialize log");
       t.printStackTrace();

opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/ui/NewBaseDNPanel.java

@@ -13,6 +13,7 @@
  *
  * Copyright 2008-2009 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
  */
 package org.opends.guitools.controlpanel.ui;
 
@@ -28,6 +29,7 @@
 import java.awt.event.ItemListener;
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -1239,7 +1241,7 @@ private String generateLdifFile(final File templateFile)
       final TemplateFile generator = new TemplateFile(resourceDir.getAbsolutePath(), new Random(0));
       generator.parse(templateFile.getAbsolutePath(), Collections.<LocalizableMessage>emptyList());
 
-      final File tempFile = File.createTempFile("opendj-control-panel", ".ldif");
+      final File tempFile = Files.createTempFile("opendj-control-panel", ".ldif").toFile();
       tempFile.deleteOnExit();
       final String generatedLdifFilePath = tempFile.getAbsolutePath();
 

opendj-server-legacy/src/main/java/org/opends/quicksetup/TempLogFile.java

@@ -13,12 +13,14 @@
  *
  * Copyright 2008-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
  */
 package org.opends.quicksetup;
 
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Date;
 import java.text.DateFormat;
 
@@ -51,7 +53,7 @@
   {
     try
     {
-      return new TempLogFile(File.createTempFile(prefix, ".log"));
+      return new TempLogFile(Files.createTempFile(prefix, ".log").toFile());
     }
     catch (final IOException e)
     {
@@ -85,7 +87,7 @@
     ErrorLogger.getInstance().addLogPublisher(startupErrorLogPublisher);
     DebugLogPublisher startupDebugLogPublisher = DebugLogger.getInstance().addPublisherIfRequired(writer);
 
     localizedLogger.info(LocalizableMessage.raw("QuickSetup application launched " + DateFormat.getDateTimeInstance(DateFormat.LONG, DateFormat.LONG).format(new Date()), null));
   }
 
   /**

opendj-server-legacy/src/main/java/org/opends/quicksetup/installer/InstallerHelper.java

@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
  */
 package org.opends.quicksetup.installer;
 
@@ -33,6 +34,7 @@
 import java.io.FileWriter;
 import java.io.IOException;
 import java.io.InputStreamReader;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashSet;
@@ -272,7 +274,7 @@ public File createBaseEntryTempFile(String baseDn)
     File ldifFile;
     try
     {
-      ldifFile = File.createTempFile("opendj-base-entry", ".ldif");
+      ldifFile = Files.createTempFile("opendj-base-entry", ".ldif").toFile();
       ldifFile.deleteOnExit();
     } catch (IOException ioe)
     {

opendj-server-legacy/src/main/java/org/opends/server/admin/doc/ConfigGuideGeneration.java

@@ -19,6 +19,7 @@
 
 import java.io.File;
 import java.io.PrintWriter;
+import java.nio.file.Files;
 import java.util.Collection;
 import java.util.Date;
 import java.util.Iterator;
@@ -112,14 +113,14 @@
   public static void main(String[] args) {
     Properties properties = System.getProperties();
     generationDir = properties.getProperty("GenerationDir");
-    if (generationDir == null) {
-      // Default dir is prefixed by the system-dependent default temporary dir
-      generationDir = System.getProperty("java.io.tmpdir") + File.separator +
-        CONFIG_GUIDE_DIR;
-    }
-    // Create new dir if necessary
     try {
-      new File(generationDir).mkdir();
+      if (generationDir == null) {
+        // Default dir is a fresh temporary dir, only accessible by the current user
+        generationDir = Files.createTempDirectory(CONFIG_GUIDE_DIR).toString();
+      } else {
+        // Create new dir if necessary
+        new File(generationDir).mkdir();
+      }
     } catch (Exception e) {
       e.printStackTrace();
       System.exit(1);

opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/OnDiskMergeImporter.java

@@ -38,6 +38,7 @@
 import java.nio.MappedByteBuffer;
 import java.nio.channels.FileChannel;
 import java.nio.channels.FileChannel.MapMode;
+import java.nio.file.Files;
 import java.util.AbstractList;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -425,7 +426,7 @@ private static boolean isUnderAnyOf(DN dn, List<DN> branches)
 
     private File exportBranches(List<DN> includeBranches, List<DN> excludeBranches) throws Exception
     {
-      final File migrationFile = File.createTempFile("import-migration-", ".ldif");
+      final File migrationFile = Files.createTempFile("import-migration-", ".ldif").toFile();
       final LDIFExportConfig exportConfig =
           new LDIFExportConfig(migrationFile.getAbsolutePath(), ExistingFileBehavior.OVERWRITE);
       exportConfig.setIncludeBranches(includeBranches);

opendj-server-legacy/src/main/java/org/opends/server/schema/SchemaFilesWriter.java

@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
  */
 package org.opends.server.schema;
 
@@ -725,7 +726,7 @@ private File writeTempSchemaFile(Schema schema, Collection<Attribute> extraAttri
     }
 
     // Create a temporary file to which we can write the schema entry.
-    File tempFile = File.createTempFile(schemaFile, "temp");
+    File tempFile = Files.createTempFile(schemaFile, "temp").toFile();
     LDIFExportConfig exportConfig =
          new LDIFExportConfig(tempFile.getAbsolutePath(),
                               ExistingFileBehavior.OVERWRITE);

opendj-server-legacy/src/main/java/org/opends/server/tools/LDAPAuthenticationHandler.java

@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2009 Sun Microsystems, Inc.
  * Portions Copyright 2012-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
  */
 package org.opends.server.tools;
 
@@ -28,6 +29,7 @@
 import java.io.FileWriter;
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
+import java.nio.file.Files;
 import java.security.MessageDigest;
 import java.security.PrivilegedExceptionAction;
 import java.security.SecureRandom;
@@ -1892,7 +1894,7 @@ else if (lowerName.equals(SASL_PROPERTY_REALM))
     String configFileName;
     try
     {
-      File tempFile = File.createTempFile("login", "conf");
+      File tempFile = Files.createTempFile("login", "conf").toFile();
       configFileName = tempFile.getAbsolutePath();
       tempFile.deleteOnExit();
       try (BufferedWriter w = new BufferedWriter(new FileWriter(tempFile, false))) {

opendj-server-legacy/src/main/java/org/opends/server/tools/dsreplication/ReplicationCliMain.java

@@ -14,6 +14,7 @@
  * Copyright 2007-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
  * Portions Copyright 2012 profiq s.r.o.
+ * Portions Copyrighted 2026 3A Systems, LLC.
  */
 package org.opends.server.tools.dsreplication;
 
@@ -46,6 +47,7 @@
 import java.io.IOException;
 import java.io.OutputStream;
 import java.io.PrintStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -364,7 +366,7 @@ public static int mainCLI(String[] args, boolean initializeServer,
     try
     {
       ControlPanelLog.initLogFileHandler(
-          File.createTempFile(LOG_FILE_PREFIX, LOG_FILE_SUFFIX));
+          Files.createTempFile(LOG_FILE_PREFIX, LOG_FILE_SUFFIX).toFile());
     } catch (Throwable t) {
       System.err.println("Unable to initialize log");
       t.printStackTrace();

opendj-server-legacy/src/main/java/org/opends/server/tools/status/StatusCli.java

@@ -33,6 +33,7 @@
 import java.io.IOException;
 import java.io.OutputStream;
 import java.io.PrintStream;
+import java.nio.file.Files;
 import java.security.GeneralSecurityException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
@@ -166,7 +167,7 @@ public static int mainCLI(String[] args, OutputStream outStream, OutputStream er
 
     try {
       ControlPanelLog.initLogFileHandler(
-              File.createTempFile(LOG_FILE_PREFIX, LOG_FILE_SUFFIX));
+              Files.createTempFile(LOG_FILE_PREFIX, LOG_FILE_SUFFIX).toFile());
       ControlPanelLog.initPackage("org.opends.server.tools.status");
     } catch (Throwable t) {
       System.err.println("Unable to initialize log");

opendj-server-legacy/src/main/java/org/opends/server/util/SetupUtils.java

@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
  */
 package org.opends.server.util;
 
@@ -23,6 +24,7 @@
 import java.io.FileReader;
 import java.io.FileWriter;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.net.InetSocketAddress;
 import java.net.ServerSocket;
 import java.net.Socket;
@@ -149,7 +151,7 @@ public static File createTemplateFile(Set<String> baseDNs,
       int numEntries)
          throws IOException
   {
-    File templateFile = File.createTempFile("opendj-install", ".template");
+    File templateFile = Files.createTempFile("opendj-install", ".template").toFile();
     templateFile.deleteOnExit();
 
     LinkedList<String> lines = new LinkedList<>();