Avoid temporary hardcoded files
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
ID: csharp-security/no-hardcoded-tempfile
Language: C#
Severity: Warning
Category: Security
CWE: 377
Never create a temporary file with a hardcoded path. Hardcoded paths may have write permissions for all users, enabling multiple types of attacks (for example, another application can also modify the temporary file and its content and potentially write executable code).
Always make sure temporary files are non deterministic and created programmatically.
using System.Xml;
class MyClass {
public static void payloadDecode()
{
using (var streamWriter = new StreamWriter("%USERPROFILE%\AppData\Local\Temp\f"))
{
streamWriter.WriteLine("foobar");
}
}
}
using System.Xml;
class MyClass {
public static void payloadDecode()
{
using (var streamWriter = new StreamWriter("/var/tmp/f"))
{
streamWriter.WriteLine("foobar");
}
}
}
using System.Xml;
class MyClass {
public static void payloadDecode()
{
using (var streamWriter = new StreamWriter("/tmp/f"))
{
streamWriter.WriteLine("foobar");
}
}
}
class MyClass {
public static void payloadDecode()
{
// Create the temporary file stream by getting programmatically a temporary path and filename
var temporaryPath = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());
// make sure you can create the file with write access
using var temporaryFileStream = new FileStream(randomPath, FileMode.CreateNew, FileAccess.Write, FileShare.None, 4096, FileOptions.DeleteOnClose);
using (var streamWriter = new StreamWriter(temporaryFileStream))
{
streamWriter.WriteLine("foobar");
}
}
}
