Restrict temp directory permissions and drop a pointless temp file

Author: ujibang

commons/src/main/java/org/restheart/utils/ResourcesExtractor.java

@@ -32,6 +32,8 @@
 import java.nio.file.SimpleFileVisitor;
 import java.nio.file.StandardCopyOption;
 import java.nio.file.attribute.BasicFileAttributes;
+import java.nio.file.attribute.FileAttribute;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.regex.Pattern;
@@ -180,7 +182,7 @@ public static File extract(Class clazz, String resourcePath) throws IOException,
 
             try {
                 // used when run as a JAR file
-                Path destinationDir = Files.createTempDirectory("restheart-");
+                Path destinationDir = Files.createTempDirectory("restheart-", ownerOnly());
 
                 ret = destinationDir.toFile();
 
@@ -325,7 +327,7 @@ private static java.net.URL findResource(Class clazz, String resourcePath) {
      */
     @SuppressWarnings("rawtypes")
     private static File extractNativeImageResource(Class clazz, String resourcePath) throws IOException {
-        Path destinationDir = Files.createTempDirectory("restheart-");
+        Path destinationDir = Files.createTempDirectory("restheart-", ownerOnly());
 
         var index = getNativeImageDirectoryIndex();
         var filesCsv = index.get(resourcePath);
@@ -348,4 +350,21 @@ private static File extractNativeImageResource(Class clazz, String resourcePath)
 
         return destinationDir.toFile();
     }
+
+    /**
+     * Owner-only permissions for a temporary directory.
+     *
+     * <p>{@code createTempDirectory} without attributes falls back to the
+     * filesystem default, which in a shared temp directory means anything the
+     * umask allows. Extracted resources are readable by whoever can reach them,
+     * so the permissions are stated rather than inherited.
+     *
+     * <p>Empty on filesystems with no POSIX view — Windows — where asking for
+     * POSIX permissions would throw rather than protect anything.
+     */
+    private static FileAttribute<?>[] ownerOnly() {
+        return FileSystems.getDefault().supportedFileAttributeViews().contains("posix")
+            ? new FileAttribute<?>[] { PosixFilePermissions.asFileAttribute(PosixFilePermissions.fromString("rwx------")) }
+            : new FileAttribute<?>[0];
+    }
 }

core/src/main/java/org/restheart/graal/ResourcesScannerFeature.java

@@ -21,6 +21,7 @@
 
 import java.io.IOException;
 import java.net.URI;
+import java.nio.charset.StandardCharsets;
 import java.nio.file.FileSystem;
 import java.nio.file.FileSystems;
 import java.nio.file.FileVisitResult;
@@ -62,20 +63,17 @@ public void beforeAnalysis(BeforeAnalysisAccess access) {
             }
         });
 
-        // Write the directory index as a resource
+        // Write the directory index as a resource.
+        //
+        // This used to round-trip through a temp file — write the string, read it
+        // straight back as bytes, delete it. The file bought nothing, and on the
+        // exception path it was never deleted; handing the bytes over directly is
+        // both simpler and one less file in a shared temp directory.
         if (!directoryIndex.isEmpty()) {
-            try {
-                var tmpFile = Files.createTempFile("restheart-resources-", ".properties");
-                var sb = new StringBuilder();
-                directoryIndex.forEach((dir, files) -> {
-                    sb.append(dir).append("=").append(files).append("\n");
-                });
-                Files.writeString(tmpFile, sb.toString());
-                RuntimeResourceAccess.addResource(ResourcesScannerFeature.class.getModule(), INDEX_RESOURCE, Files.readAllBytes(tmpFile));
-                Files.delete(tmpFile);
-            } catch (IOException e) {
-                System.err.println("[ResourcesScannerFeature] Failed to write directory index: " + e.getMessage());
-            }
+            var sb = new StringBuilder();
+            directoryIndex.forEach((dir, files) -> sb.append(dir).append("=").append(files).append("\n"));
+            RuntimeResourceAccess.addResource(ResourcesScannerFeature.class.getModule(), INDEX_RESOURCE,
+                    sb.toString().getBytes(StandardCharsets.UTF_8));
         }
     }