Never create a temporary file with a hardcoded path. Hardcoded paths may have write permissions for all users, enabling multiple types of attacks (for example, another application can also modify the temporary file and its content and potentially write executable code).
Always make sure temporary files are non deterministic and created programmatically.
classMyClass{publicstaticvoidpayloadDecode(){// Create the temporary file stream by getting programmatically a temporary path and filenamevartemporaryPath=Path.Combine(Path.GetTempPath(),Path.GetRandomFileName());// make sure you can create the file with write accessusingvartemporaryFileStream=newFileStream(randomPath,FileMode.CreateNew,FileAccess.Write,FileShare.None,4096,FileOptions.DeleteOnClose);using(varstreamWriter=newStreamWriter(temporaryFileStream)){streamWriter.WriteLine("foobar");}}}
シームレスな統合。 Datadog Code Security をお試しください
Datadog Code Security
このルールを試し、Datadog Code Security でコードを解析する
このルールの使用方法
1
2
rulesets:- csharp-security # Rules to enforce C# security.