Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid Path.GetTempFileName() due to CWE 377 in TarArchive.cs. #543

Closed
tdhintz opened this issue Nov 23, 2020 · 1 comment · Fixed by #622
Closed

Avoid Path.GetTempFileName() due to CWE 377 in TarArchive.cs. #543

tdhintz opened this issue Nov 23, 2020 · 1 comment · Fixed by #622
Labels
security tar Related to TAR file format

Comments

@tdhintz
Copy link

tdhintz commented Nov 23, 2020

Steps to reproduce

  1. Static code security scan line 827 TarArchive.cs. Example:
    if (asciiTranslate && !entry.IsDirectory)
    {
    if (!IsBinary(entryFilename))
    {
    tempFileName = Path.GetTempFileName();
    using (StreamReader inStream = File.OpenText(entryFilename))
    {
    using (Stream outStream = File.Create(tempFileName))

Expected behavior

Use sufficiently random names for temporary files to prevent attacks which can predict the name of the file. For example, a Guid or crypto generated random number.

Actual behavior

Security scan failure. #537

Version of SharpZipLib

1.3.1

Obtained from (only keep the relevant lines)

  • Package installed using NuGet
@piksel
Copy link
Member

piksel commented Nov 26, 2020

Yeah, not sure how I didn't catch that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security tar Related to TAR file format
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants