C and C++ Binaries

IO.TAINT.FNAME : Tainted Filename

Summary

A file operation identifies a file by name, but the name string may have been tainted.

Properties

Class Name Tainted Filename
Significance security
Mnemonic IO.TAINT.FNAME
Categories
MisraC2023 MisraC2023:D.4.14 The validity of values received from external sources shall be checked
Misra2012 Misra2012:D.4.14 The validity of values received from external sources shall be checked
AUTOSARC++14 AUTOSARC++14:A27-0-1 Inputs from independent components shall be validated.
CWE CWE:22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  CWE:73 External Control of File Name or Path
  CWE:99 Improper Control of Resource Identifiers ('Resource Injection')
  CWE:610 Externally Controlled Reference to a Resource in Another Sphere
  CWE:641 Improper Restriction of Names for Files and Other Resources
CERT-C CERT-C:FIO01-C Be careful using functions that use file names for identification
  CERT-C:FIO02-C Canonicalize path names originating from tainted sources
DISA-6r1 DISA-6r1:V-222612 The application must not be vulnerable to overflow attacks.
DISA-5r3 DISA-5r3:V-70277 The application must not be vulnerable to overflow attacks.
DISA-4r3 DISA-4r3:V-70277 The application must not be vulnerable to overflow attacks.
DISA-3r10 DISA-3r10:V-6157 The designer will ensure the application does not contain invalid URL or path references.
  DISA-3r10:V-16804 The designer will ensure the application does not rely solely on a resource name to control access to a resource.
OWASP-2017 OWASP-2017:A5 Broken access control
OWASP-2021 OWASP-2021:A1 Broken access control
Availability Available for C and C++.
Enabling Checks for this warning class are disabled by default. To enable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += allow class="Tainted Filename"

Example 

#include <string.h>
#include <stdio.h>
#include <fcntl.h>

int open_myinfo(){
    int ret;
    char filepath[256];

    ret = open("/usr/files/info.txt", O_RDONLY);
    if (ret >=0 ) return ret;

    printf("Could not find info.txt: please enter location");
    if (fgets(filepath, 128, stdin)){
         ret = open(strcat(filepath, "info.txt"), O_RDONLY);  /* 'Tainted Filename' warning issued here */
    }
    return ret;
}

Triggers

CodeSonar ships with library models that allow it to recognize a large number of functions that take a file name argument. Some examples are shown in the table below. If one of these functions is called with a potentially-tainted value in the file name parameter position, a warning will be issued.

If you have created a custom library model for some function f() in terms of one of these existing models, calls to f() will also be capable of triggering Tainted Filename warnings.

Functions that can trigger warnings include...
gcc Builtins __builtin_execl(), __builtin_execv()
libc chmod(), fopen(), stat()
Win32 PathMakeUniqueName(), _stat64(), fopen_s()

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.