Improving Web Application Security: Threats and - CGISecurity

164 Part III: Building Secure Web ApplicationsFile I/OCanonicalization issues are a major concern for code that accesses the file system. Ifyou have the choice, do not base security decisions on input file names because of themany ways that a single file name can be represented. If your code needs to access afile using a user-supplied file name, take steps to ensure your assembly cannot beused by a malicious user to gain access to or overwrite sensitive data.The following recommendations help you improve the security of your file I/O:●●●●Avoid untrusted input for file names.Do not trust environment variables.Validate input filenames.Constrain file I/O within your application’s context.Avoid Untrusted Input for File NamesAvoid writing code that accepts file or path input from the caller and instead usefixed file names and locations when reading and writing data. This ensures your codecannot be coerced into accessing arbitrary files.Do Not Trust Environment VariablesTry to use absolute file paths where you can. Do not trust environment variables toconstruct file paths because you cannot guarantee the value of the environmentvariable.Validate Input File NamesIf you do need to receive input file names from the caller, make sure that the filenameis strictly formed so that you can determine whether it is valid. Specifically, there aretwo aspects to validating input file paths. You need to:● Check for valid file system names.● Check for a valid location, as defined by your application’s context. For example,are they within the directory hierarchy of your application?To validate the path and file name, use the System.IO.Path.GetFullPath method asshown in the following code sample. This method also canonicalizes the supplied filename.