Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Content by Label
showLabelsfalse
maxResults99
label+fio,+rule,-void
showSpacefalse
sorttitle
spacecom.atlassian.confluence.content.render.xhtml.model.resource.identifiers.SpaceResourceIdentifier@3bbaf8c
cqllabel = "fio" and label = "rule" and label != "void" and space = currentSpace()

Info

Information for Editors
To have a new guideline automatically listed above be sure to label it fio and rule.

Risk Assessment Summary

Rule

Severity

Likelihood

Detectable

Repairable

Priority

Level

FIO30-CHighLikelyYesNo

P18

L1

FIO32-CMediumUnlikelyNoNo

P2

L3

FIO34-CHighProbableYesYes

P18

L1

FIO37-CHighProbableYesYes

P18

L1

FIO38-CLowProbableYesNo

P4

L3

FIO39-CLowLikelyYesNo

P6

L2

FIO40-CLowProbableYesYes

P6

L2

FIO41-CLowUnlikelyYesYes

P3

L3

FIO42-CMediumUnlikelyNoNo

P2

L3

FIO44-CMediumUnlikelyNoNo

P2

L3

FIO45-CHighProbableNoNo

P6

L2

FIO46-CMediumUnlikelyNoNo

P2

L3

FIO47-CHighUnlikelyYesNo

P6

L2

Related Rules and Recommendations

Navigation Map
fio
fio
cellWidth700
wrapAfter1
cellHeight15

...

Image Added Image Added Image Added

C programs often rely on file to load or store data needed during program execution. File functions, such as open, read, write, and close are built into the C programming language itself to simplify how C programs interact with files and file data. By definition, the underlying operating system is responsible for managing access to files. This creates irregularities and inconsistencies between C programs and the underlying file system. Many of these descrepencies can lead to security vulnerabilities.

The following rules and recommendations are designed to reduce the common errors associated with file operations in C. These guidelines are designed to by system independent. However, files and file management is inherently tied to the underlying operating system. Cases where security issues or recomendations are specific to an architecture are clearly marked as pertaining to that architecture.

Recommendations

FIO001 Use file descriptors instead of filenames

FIO002 Translate filenames into canonical form

FIO003 Create temporary files in restricted directories

Rules

FIO30 Check file properties in a secure manor

FIO31 Detect and handle file operation errors

FIO032 Do not create temporary files with predictable names

FIO033 Verify path and filename parameters

FIO034 Do not make assumptions about the directory structure