Avoid temporary hardcoded files

Documentos > Datadog Security > Code Security > Static Code Analysis (SAST) > Reglas de SAST > Avoid temporary hardcoded files

Esta página aún no está disponible en español. Estamos trabajando en su traducción.
Si tienes alguna pregunta o comentario sobre nuestro actual proyecto de traducción, no dudes en ponerte en contacto con nosotros.

Metadata

ID: csharp-security/no-hardcoded-tempfile

Language: C#

Severity: Warning

Category: Security

CWE: 377

Description

Never create a temporary file with a hardcoded path. Hardcoded paths may have write permissions for all users, enabling multiple types of attacks (for example, another application can also modify the temporary file and its content and potentially write executable code).

Always make sure temporary files are non deterministic and created programmatically.

Learn More

CWE-379: Creation of Temporary File in Directory with Insecure Permissions

Non-Compliant Code Examples

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        using (var streamWriter = new StreamWriter("%USERPROFILE%\AppData\Local\Temp\f"))
        {
            streamWriter.WriteLine("foobar");
        }
    }
}

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        using (var streamWriter = new StreamWriter("/var/tmp/f"))
        {
            streamWriter.WriteLine("foobar");
        }
    }
}

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        using (var streamWriter = new StreamWriter("/tmp/f"))
        {
            streamWriter.WriteLine("foobar");
        }
    }
}

Compliant Code Examples

class MyClass {
    public static void payloadDecode()
    {
        // Create the temporary file stream by getting programmatically a temporary path and filename
        var temporaryPath = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());

        // make sure you can create the file with write access
        using var temporaryFileStream = new FileStream(randomPath, FileMode.CreateNew, FileAccess.Write, FileShare.None, 4096, FileOptions.DeleteOnClose);

        using (var streamWriter = new StreamWriter(temporaryFileStream))
        {
            streamWriter.WriteLine("foobar");
        }
    }
}