Avoid temporary hardcoded files

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Metadata

ID: csharp-security/no-hardcoded-tempfile

Language: C#

Severity: Warning

Category: Security

CWE: 377

Description

Never create a temporary file with a hardcoded path. Hardcoded paths may have write permissions for all users, enabling multiple types of attacks (for example, another application can also modify the temporary file and its content and potentially write executable code).

Always make sure temporary files are non deterministic and created programmatically.

Learn More

Non-Compliant Code Examples

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        using (var streamWriter = new StreamWriter("%USERPROFILE%\AppData\Local\Temp\f"))
        {
            streamWriter.WriteLine("foobar");
        }
    }
}

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        using (var streamWriter = new StreamWriter("/var/tmp/f"))
        {
            streamWriter.WriteLine("foobar");
        }
    }
}

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        using (var streamWriter = new StreamWriter("/tmp/f"))
        {
            streamWriter.WriteLine("foobar");
        }
    }
}

Compliant Code Examples

class MyClass {
    public static void payloadDecode()
    {
        // Create the temporary file stream by getting programmatically a temporary path and filename
        var temporaryPath = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());

        // make sure you can create the file with write access
        using var temporaryFileStream = new FileStream(randomPath, FileMode.CreateNew, FileAccess.Write, FileShare.None, 4096, FileOptions.DeleteOnClose);

        using (var streamWriter = new StreamWriter(temporaryFileStream))
        {
            streamWriter.WriteLine("foobar");
        }
    }
}