From 6eeb6e89b4a8b961ae42e2842abd8e33fec26070 Mon Sep 17 00:00:00 2001
From: anvesha s <anvesha@medios.digiscrypt.com>
Date: Fri, 23 Oct 2026 16:26:32 +0530
Subject: [PATCH] Extract the native library with owner-only permissions

---
 .../java/org/xerial/snappy/SnappyLoader.java  | 10 ++++++++++
 .../org/xerial/snappy/SnappyLoaderTest.java   | 20 +++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/src/main/java/org/xerial/snappy/SnappyLoader.java b/src/main/java/org/xerial/snappy/SnappyLoader.java
index f1d555cc..35c0c460 100644
--- a/src/main/java/org/xerial/snappy/SnappyLoader.java
+++ b/src/main/java/org/xerial/snappy/SnappyLoader.java
@@ -28,6 +28,9 @@
 import java.net.JarURLConnection;
 import java.net.URL;
 import java.net.URLConnection;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.util.Enumeration;
 import java.util.Properties;
 import java.util.UUID;
@@ -239,6 +242,13 @@ private static File extractLibraryFile(String libFolderForCurrentOS, String libr
             try {
                 reader = getResourceAsInputStream(nativeLibraryFilePath);
                 try {
+                    // Create the file accessible only by the owner, since the temp folder is usually shared with
+                    // other users and the default umask may leave the library writable by them
+                    Path extractedLibPath = extractedLibFile.toPath();
+                    if (extractedLibPath.getFileSystem().supportedFileAttributeViews().contains("posix")) {
+                        Files.createFile(extractedLibPath,
+                                PosixFilePermissions.asFileAttribute(PosixFilePermissions.fromString("rwx------")));
+                    }
                     writer = new FileOutputStream(extractedLibFile);
 
                     byte[] buffer = new byte[8192];
diff --git a/src/test/java/org/xerial/snappy/SnappyLoaderTest.java b/src/test/java/org/xerial/snappy/SnappyLoaderTest.java
index 8321e9e0..1a276102 100755
--- a/src/test/java/org/xerial/snappy/SnappyLoaderTest.java
+++ b/src/test/java/org/xerial/snappy/SnappyLoaderTest.java
@@ -26,6 +26,7 @@
 
 import org.codehaus.plexus.classworlds.ClassWorld;
 import org.codehaus.plexus.classworlds.realm.ClassRealm;
+import org.junit.Assume;
 import org.junit.Test;
 import java.util.logging.Logger;
 
@@ -33,8 +34,12 @@
 import java.lang.reflect.Method;
 import java.net.URL;
 import java.net.URLClassLoader;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermissions;
 
 import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.fail;
 
 public class SnappyLoaderTest
@@ -120,6 +125,21 @@ public void load()
         _logger.fine(String.valueOf(Snappy.maxCompressedLength(1024)));
     }
 
+    @Test
+    public void extractedLibraryIsOnlyAccessibleByOwner()
+            throws Exception
+    {
+        File lib = SnappyLoader.findNativeLibrary();
+        try {
+            Path libPath = lib.toPath();
+            Assume.assumeTrue(libPath.getFileSystem().supportedFileAttributeViews().contains("posix"));
+            assertEquals("rwx------", PosixFilePermissions.toString(Files.getPosixFilePermissions(libPath)));
+        }
+        finally {
+            lib.delete();
+        }
+    }
+
     @Test
     public void autoLoad()
             throws Exception