Skip to content

Avoid Path.GetTempFileName() due to CWE 377 in TarArchive.cs. #543

@tdhintz

Description

@tdhintz

Steps to reproduce

  1. Static code security scan line 827 TarArchive.cs. Example:
    if (asciiTranslate && !entry.IsDirectory)
    {
    if (!IsBinary(entryFilename))
    {
    tempFileName = Path.GetTempFileName();
    using (StreamReader inStream = File.OpenText(entryFilename))
    {
    using (Stream outStream = File.Create(tempFileName))

Expected behavior

Use sufficiently random names for temporary files to prevent attacks which can predict the name of the file. For example, a Guid or crypto generated random number.

Actual behavior

Security scan failure. #537

Version of SharpZipLib

1.3.1

Obtained from (only keep the relevant lines)

  • Package installed using NuGet

Metadata

Metadata

Assignees

No one assigned

    Labels

    securitytarRelated to TAR file format

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions