Skip to content

fix(wrapper): replace mktemp with POSIX-compliant temp dir creation in only-mvnw #418

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
armorbreak001 wants to merge 1 commit into
base: master
Choose a base branch
from
+4 −2
Open

fix(wrapper): replace mktemp with POSIX-compliant temp dir creation in only-mvnw #418

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions maven-wrapper-distribution/src/resources/only-mvnw
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,8 +160,10 @@ case "${distributionUrl-}" in
*) die "distributionUrl is not valid, must match *-bin.zip or maven-mvnd-*.zip, but found '${distributionUrl-}'" ;;
esac

# prepare tmp dir
if TMP_DOWNLOAD_DIR="$(mktemp -d)" && [ -d "$TMP_DOWNLOAD_DIR" ]; then
# prepare tmp dir (POSIX-compatible: avoid mktemp which is not available in all shells)
_tmp_base="${TMPDIR:-/tmp}"
TMP_DOWNLOAD_DIR="$_tmp_base/maven_wrapper.$$_$(date +%s)"
if mkdir -p -- "$TMP_DOWNLOAD_DIR" && [ -d "$TMP_DOWNLOAD_DIR" ]; then
Comment on lines +164 to +166
Copy link

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

date +%s is not specified by POSIX and is missing on some platforms (incl. AIX), so this temp dir name generation can fail or produce non-unique names. Use a POSIX format (e.g., date '+%Y%m%d%H%M%S') and/or a small looped suffix counter to guarantee uniqueness without relying on %s.

Copilot uses AI. Check for mistakes.
clean() { rm -rf -- "$TMP_DOWNLOAD_DIR"; }
Comment on lines +163 to 167
Copy link

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The temp directory path is predictable and mkdir -p will succeed if it already exists, which can lead to reusing a pre-existing directory (DoS) and enables TOCTOU/symlink attacks on files created inside it (e.g., Downloader.java, the downloaded archive). Prefer creating a new directory with mkdir (no -p) in a loop until it succeeds, set a restrictive umask/mode, and consider using mktemp -d when available with a POSIX fallback when it isn’t.

Copilot uses AI. Check for mistakes.
trap clean HUP INT TERM EXIT
else
Expand Down