fix: fixed Sonar vulnerability

pagopa · Nov 22, 2024 · 5522095 · 5522095
1 parent 7460859
commit 5522095
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 11 deletions.
diff --git a/...functions/src/main/java/it/pagopa/selfcare/onboarding/service/ContractServiceDefault.java b/...functions/src/main/java/it/pagopa/selfcare/onboarding/service/ContractServiceDefault.java
@@ -284,21 +284,28 @@ private File createPdfFileContract(
 
   private File createPdfFileAttachment(String attachmentTemplatePath, Onboarding onboarding)
       throws IOException {
-    final String builder =
-        LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyyMMddHHmmss"))
-            + "_"
-            + UUID.randomUUID()
-            + "_allegato_interoperabilita.";
+    String timestamp = LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyyMMddHHmmss"));
+    String uniqueId = UUID.randomUUID().toString();
+    String filePrefix = "allegato_interoperabilita_" + timestamp + "_" + uniqueId;
 
-    // Read the content of the contract template file.
+    // Usa una directory temporanea dedicata
+    Path tempDir = Files.createTempDirectory("secureTempDir");
+
+    // Crea il file temporaneo nella directory sicura
+    Path attachmentPdfFile = Files.createTempFile(tempDir, filePrefix, ".pdf");
+
+    // Leggi il contenuto del template del contratto
     String attachmentTemplateText = azureBlobClient.getFileAsText(attachmentTemplatePath);
-    // Create a temporary PDF file to store the contract.
-    Path attachmentPdfFile = Files.createTempFile(builder, ".pdf");
-    // Prepare common data for the contract document.
+
+    // Prepara i dati comuni per il documento PDF
     Map<String, Object> data = setUpAttachmentData(onboarding);
 
     log.debug("data Map for PDF: {}", data);
+
+    // Scrivi i dati nel file PDF
     fillPDFAsFile(attachmentPdfFile, attachmentTemplateText, data);
+
+    // Restituisci il file temporaneo
     return attachmentPdfFile.toFile();
   }
 

diff --git a/...ding-functions/src/main/java/it/pagopa/selfcare/onboarding/service/OnboardingService.java b/...ding-functions/src/main/java/it/pagopa/selfcare/onboarding/service/OnboardingService.java
@@ -121,7 +121,8 @@ public void createAttachments(OnboardingWorkflow onboardingWorkflow) {
     createAttachments(attachments, onboarding, product);
   }
 
-  private void createAttachments(List<AttachmentTemplate> attachments, Onboarding onboarding, Product product) {
+  private void createAttachments(
+      List<AttachmentTemplate> attachments, Onboarding onboarding, Product product) {
     Optional.ofNullable(attachments)
         .filter(list -> !list.isEmpty())
         .orElseThrow(
@@ -137,7 +138,7 @@ private void createAttachments(List<AttachmentTemplate> attachments, Onboarding
             attachment ->
                 contractService.createAttachmentPDF(
                     attachment.getTemplatePath(),
-                        onboarding,
+                    onboarding,
                     product.getTitle(),
                     attachment.getName()));
   }