Fix security warnings about local information disclosure in temporary directories

Kitodo-API/src/main/java/org/kitodo/config/KitodoConfig.java

@@ -16,6 +16,7 @@
 import java.nio.file.Paths;
 import java.util.NoSuchElementException;
 import java.util.Optional;
+import java.util.function.Supplier;
 
 import org.apache.commons.configuration2.PropertiesConfiguration;
 import org.apache.commons.configuration2.ex.ConversionException;
@@ -114,6 +115,30 @@ public static String getParameter(ParameterInterface key, String defaultValue) {
         }
     }
 
+    /**
+     * Returns the selected parameter from the configuration file. If no such
+     * parameter exists, returns the default value provided by a supplier function.
+     *
+     * @param key
+     *            as ParameterInterface enum implementation whose value is to be
+     *            returned
+     * @param supplier
+     *            the supplier function that is called in case the parameter taken from 
+     *            the config file does not exist or an exception occurred
+     * @return value for the requested key, or the supplied default value if not found
+     */
+    public static String getParameter(ParameterInterface key, Supplier<String> supplier) {
+        try {
+            return getConfig().getString(key.getName());
+        } catch (ConversionException e) {
+            String defaultValue = supplier.get();
+            logConversionException(key.getName(), CONFIG_FILE, String.class, e, defaultValue);
+            return defaultValue;
+        } catch (NoSuchElementException e) {
+            return supplier.get();
+        }
+    }
+
     /**
      * Returns the selected parameter from the configuration file. If no such
      * parameter exists, returns the given default value.

Kitodo-Docket/src/main/java/org/kitodo/docket/Docket.java

@@ -15,6 +15,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.net.URI;
+import java.nio.file.Files;
 import java.util.Collection;
 
 import org.kitodo.api.docket.DocketData;
@@ -24,7 +25,7 @@ public class Docket implements DocketInterface {
 
     @Override
     public File generateDocket(DocketData docketData, URI xslFileUri) throws IOException {
-        File file = File.createTempFile("docket.pdf", ".tmp");
+        File file = Files.createTempFile("docket.pdf", ".tmp").toFile();
 
         try (FileOutputStream fileOutputStream = new FileOutputStream(file)) {
             new ExportDocket(new File(xslFileUri)).startExport(docketData, fileOutputStream);
@@ -35,7 +36,7 @@ public File generateDocket(DocketData docketData, URI xslFileUri) throws IOExcep
 
     @Override
     public File generateMultipleDockets(Collection<DocketData> docketData, URI xslFileUri) throws IOException {
-        File file = File.createTempFile("docket_multipage.pdf", ".tmp");
+        File file = Files.createTempFile("docket_multipage.pdf", ".tmp").toFile();
 
         try (FileOutputStream fileOutputStream = new FileOutputStream(file)) {
             new ExportDocket(new File(xslFileUri)).startExport(docketData, fileOutputStream);

Kitodo-ImageManagement/src/main/java/org/kitodo/imagemanagement/ImageManagement.java

@@ -46,7 +46,14 @@ public class ImageManagement implements ImageManagementInterface {
      * Temporary directory location.
      */
     private static final File TMPDIR = new File(
-            KitodoConfig.getParameter(ParameterImageManagement.DIR_TMP, System.getProperty("java.io.tmpdir")));
+            KitodoConfig.getParameter(ParameterImageManagement.DIR_TMP, () -> {
+                try {
+                    return Files.createTempDirectory(ParameterImageManagement.DIR_TMP.getName()).toString();
+                } catch (IOException e) {
+                    logger.error("could not create temporary directory for image management", e);
+                    return null;
+                }
+            }));
 
     /**
      * Image format used internally to create web images, optimized for small
@@ -138,7 +145,7 @@ public Image getSizedWebImage(URI sourceUri, int width) throws IOException {
     private static Image summarize(String prefix, String suffix, URI sourceUri, Function<FutureDerivative, ?> lambda,
             String message, Object pTwo) throws IOException {
 
-        File tempFile = File.createTempFile(prefix, suffix, TMPDIR);
+        File tempFile = Files.createTempFile(TMPDIR.toPath(), prefix, suffix).toFile();
         try {
             tempFile.deleteOnExit();
             ImageConverter imageConverter = new ImageConverter(sourceUri);

Kitodo/src/test/java/org/kitodo/selenium/MassImportST.java

@@ -19,6 +19,7 @@
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Arrays;
 import java.util.List;
 import java.util.concurrent.TimeUnit;
@@ -166,7 +167,7 @@ public void changeMetadataValue() throws InterruptedException {
     }
 
     private static File createCsvFile() throws IOException {
-        File csvFile = File.createTempFile(CSV_UPLOAD_FILENAME, CSV_UPLOAD_FILE_EXTENSION);
+        File csvFile = Files.createTempFile(CSV_UPLOAD_FILENAME, CSV_UPLOAD_FILE_EXTENSION).toFile();
         try (FileWriter writer = new FileWriter(csvFile)) {
             writer.write(String.join(StringConstants.COMMA_DELIMITER, METADATA_KEYS) + "\n");
             writer.write("123, Band 1, Hamburg\n");