C#

CSHARP.HARDCODED.FNAME : Hardcoded Filename (C#)

Summary

A file name is provided as a hardcoded string.

This checker identifies problems with the use of the external resources of the application. These are resource files, scripts or XML configuration files.

Properties

Class Name Hardcoded Filename (C#)
Significance reliability
Mnemonic CSHARP.HARDCODED.FNAME
Categories
CWE CWE:547 Use of Hard-coded, Security-relevant Constants
Availability Available for C# only.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += discard class="Hardcoded Filename (C#)"

Example 

using System.IO;

namespace DocumentationExamples
{
    public class Resources
    {
        public static void Main(string[] args)
        {
            File.Create("hello.txt");                                       // "Hardcoded Filename (C#)" warning issued here
            new FileStream("C:\\myfile.txt", FileMode.OpenOrCreate);        // "Hardcoded Filename (C#)" warning issued here
            new FileStream("/home/user/myfile.bmp", FileMode.OpenOrCreate); // "Hardcoded Filename (C#)" warning issued here
            if (args.Length " 0)
                File.Create(args[0]);
        }
    }
}

In this example, the programmer should move the file names into configuration files, so that they can be modified and swapped for distinct operating systems.

Note also that two of the hardcoded file names are OS-dependent, so the program will not work consistently across distinct operating systems. The programmer could address this by using Path.DirectorySeparatorChar() to split path components in a OS-independent way.

Resolution

Verify if the problem is real and the resource is actually used in an incorrect way. Avoid hardcoded file names: move them to a configuration file. Avoid OS-dependent resources and resource names.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.