Avoid unsafe temporary file creation

Docs > コード分析 > Static Analysis Rules > Avoid unsafe temporary file creation

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Metadata

ID: csharp-security/unsafe-temp-file

Language: C#

Severity: Notice

Category: Security

CWE: 377

Description

The function GetTempFileName is known to have security issues and may lead to attacks. Temporary files should not be predictable and safe to use. Avoid the function GetTempFileName.

Learn More

Stackoverflow thread on creating temporary directory atomically

Non-Compliant Code Examples

class MyClass {
    public static void payloadDecode()
    {
        var temporaryPath = Path.GetTempFileName();
    }
}

Compliant Code Examples

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        var temporaryPath = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());
    }
}