Skip to content

Avoid Path.GetTempFileName() due to CWE 377 in TarArchive.cs. #543

@tdhintz

Description

@tdhintz

Steps to reproduce

  1. Static code security scan line 827 TarArchive.cs. Example:
    if (asciiTranslate && !entry.IsDirectory)
    {
    if (!IsBinary(entryFilename))
    {
    tempFileName = Path.GetTempFileName();
    using (StreamReader inStream = File.OpenText(entryFilename))
    {
    using (Stream outStream = File.Create(tempFileName))

Expected behavior

Use sufficiently random names for temporary files to prevent attacks which can predict the name of the file. For example, a Guid or crypto generated random number.

Actual behavior

Security scan failure. #537

Version of SharpZipLib

1.3.1

Obtained from (only keep the relevant lines)

  • Package installed using NuGet

Metadata

Metadata

Assignees

No one assigned

    Labels

    securitytarRelated to TAR file format

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions