The C99 tandard function
fopen() is typically used to open an existing file or create a new one [[ISO/IEC 9899:1999]]. However,
fopen() does not indicate if an existing file has been opened for writing or a new file has been created. This may lead to a program overwriting or accessing an unintended file.
For examples on how to just check for the existence of a file without actually opening it, please see FIO10-A. Take care when using the rename() function.
Non-Compliant Code Example:
In this example, an attempt is made to check whether a file exists before opening it for writing by trying to open the file for reading.
However, this code suffers from a Time of Check, Time of Use (or TOCTOU) vulnerability (see [[Seacord 05]] Section 7.2). On a shared multitasking system there is a window of opportunity between the first call of
fopen() and the second call for a malicious attacker to, for example, create a link with the given file name to an existing file so that the existing file is overwritten by the second call of
fopen() and the subsequent writing to the file.
Non-Compliant Code Example:
fopen_s() (ISO/IEC TR 24731-1)
fopen_s() function defined in ISO/IEC TR 24731-1:2007 is designed to improve the security of the
fopen() function. However, like
fopen_s() provides no mechanism to determine if an existing file has been opened for writing or a new file has been created. The code below contains the same TOCTOU race condition as the first non-compliant code example using
open() function as defined in the Open Group Base Specifications Issue 6 [[Open Group 04]] is available on many platforms and provides the control that
fopen() does not provide. If the
O_EXCL flags are used together, the
open() function fails when the file specified by
file_name already exists.
Care should be observed when using
O_EXCL with remote file systems as it does not work with NFS version 2. NFS version 3 added support for
O_EXCL mode in
open(); see IETF RFC 1813, in particular the
EXCLUSIVE value to the
mode argument of
CREATE [[Callaghan 95]].
Section 12.3 of the GNU C Library says: [[Loosemore 07]]
The GNU C library defines one additional character for use in
opentype: the character `
x' insists on creating a new fileâ”if a file
fopenfails rather than opening it. If you use `
x' you are guaranteed that you will not clobber an existing file. This is equivalent to the
O_EXCLoption to the
Use of this non portable extension can allow for easy remediation of legacy code.
For code that operates on
FILE pointers and not file descriptors, the POSIX
fdopen() function [[Open Group 04]] can be used to associate an open stream with the file descriptor returned by
open(), as shown in this compliant solution.
The ability to determine if an existing file has been opened or a new file has been created provides greater assurance that the intended file is accessed, or perhaps more importantly, a file other than the intended file is not acted upon.
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
[[ISO/IEC 9899:1999]] Section 7.19.3, "Files," and Section 7.19.4, "Operations on Files"
[[ISO/IEC TR 24731-1:2007]] Section 184.108.40.206, "The fopen_s function"
[[Loosemore 07]] Section 12.3, "Opening Streams"
[[Open Group 04]]
[[Seacord 05]] Chapter 7, "File I/O"