search

junit-team / junit4

A programmer-oriented testing framework for Java.
https://junit.org/junit4
Eclipse Public License 1.0
8.53k stars 3.29k forks source link

Option to create TemporaryFolder that doesn't limit access to created files #1679

Closed bradyoo closed 4 years ago

bradyoo commented 4 years ago

After the fix for https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp, the test I have had that creates temp files with multiple users need access broke.

I am wondering if there can be an option to create a TemporaryFolder without the limited access if I'm not worried about the information disclosure vulnerability.

marcphilipp commented 4 years ago

I don't think we should do that. You could manually change the permissions of the temporary folder or stay on 4.13.

@kcooney WDYT?

panchenko commented 4 years ago

I would recommend explicitly setting the desired permissions, as this is quite a special case. Long term that would simplify migrating to JUnit 5.

kcooney commented 4 years ago

I agree with Marc. If you need this functionality you could create your own rule that extends ExternalResource