Metadata

ID: csharp-security/unsafe-temp-file

Language: C#

Severity: Notice

Category: Security

CWE: 377

Description

The function GetTempFileName is known to have security issues and may lead to attacks. Temporary files should not be predictable and safe to use. Avoid the function GetTempFileName.

Learn More

• Stackoverflow thread on creating temporary directory atomically

Non-Compliant Code Examples

class MyClass {
    public static void payloadDecode()
    {
        var temporaryPath = Path.GetTempFileName();
    }
}

Compliant Code Examples

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        var temporaryPath = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());
    }
}