Avoid unsafe temporary file creation

Metadata

ID: csharp-security/unsafe-temp-file

Language: C#

Severity: Notice

Category: Security

Description

The function GetTempFileName is known to have security issues and may lead to attacks. Temporary files should not be predictable and safe to use. Avoid the function GetTempFileName.

Learn More

Non-Compliant Code Examples

class MyClass {
    public static void payloadDecode()
    {
        var temporaryPath = Path.GetTempFileName();
    }
}

Compliant Code Examples

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        var temporaryPath = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());
    }
}