CA5389: Do not add archive item's path to the target file system path

Article
04/22/2023

Property	Value
Rule ID	CA5389
Title	Do not add archive item's path to the target file system path
Category	Security
Fix is breaking or non-breaking	Non-breaking
Enabled by default in .NET 9	No

Cause

A non-sanitized source file path is used as the target file path in one of these parameters:

parameter destinationFileName of method ZipFileExtensions.ExtractToFile
parameter path of method File.Open
parameter path of method File.OpenWrite
parameter path of method File.Create
parameter path of constructor for FileStream
parameter fileName of constructor for FileInfo

By default, this rule analyzes the entire codebase, but this is configurable.

Rule description

File path can be relative and can lead to file system access outside of the expected file system target path, leading to malicious config changes and remote code execution via lay-and-wait technique.

How to fix violations

Do not use the source file path to construct the target file path, or make sure that the last character on the extraction path is the directory separator character.

When to suppress warnings

You can suppress this warning if the source path always comes from a trusted source.

Suppress a warning

If you just want to suppress a single violation, add preprocessor directives to your source file to disable and then re-enable the rule.

#pragma warning disable CA5389
// The code that's violating the rule is on this line.
#pragma warning restore CA5389

To disable the rule for a file, folder, or project, set its severity to none in the configuration file.

[*.{cs,vb}]
dotnet_diagnostic.CA5389.severity = none

For more information, see How to suppress code analysis warnings.

Configure code to analyze

Use the following options to configure which parts of your codebase to run this rule on.

Exclude specific symbols
Exclude specific types and their derived types

You can configure these options for just this rule, for all rules it applies to, or for all rules in this category (Security) that it applies to. For more information, see Code quality rule configuration options.

Exclude specific symbols

You can exclude specific symbols, such as types and methods, from analysis. For example, to specify that the rule should not run on any code within types named MyType, add the following key-value pair to an .editorconfig file in your project:

dotnet_code_quality.CAXXXX.excluded_symbol_names = MyType

Allowed symbol name formats in the option value (separated by |):

Symbol name only (includes all symbols with the name, regardless of the containing type or namespace).
Fully qualified names in the symbol's documentation ID format. Each symbol name requires a symbol-kind prefix, such as M: for methods, T: for types, and N: for namespaces.
.ctor for constructors and .cctor for static constructors.

Examples:

Option Value	Summary
`dotnet_code_quality.CAXXXX.excluded_symbol_names = MyType`	Matches all symbols named `MyType`.
`dotnet_code_quality.CAXXXX.excluded_symbol_names = MyType1\|MyType2`	Matches all symbols named either `MyType1` or `MyType2`.
`dotnet_code_quality.CAXXXX.excluded_symbol_names = M:NS.MyType.MyMethod(ParamType)`	Matches specific method `MyMethod` with the specified fully qualified signature.
`dotnet_code_quality.CAXXXX.excluded_symbol_names = M:NS1.MyType1.MyMethod1(ParamType)\|M:NS2.MyType2.MyMethod2(ParamType)`	Matches specific methods `MyMethod1` and `MyMethod2` with the respective fully qualified signatures.

Exclude specific types and their derived types

You can exclude specific types and their derived types from analysis. For example, to specify that the rule should not run on any methods within types named MyType and their derived types, add the following key-value pair to an .editorconfig file in your project:

dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = MyType

Allowed symbol name formats in the option value (separated by |):

Type name only (includes all types with the name, regardless of the containing type or namespace).
Fully qualified names in the symbol's documentation ID format, with an optional T: prefix.

Examples:

Option Value	Summary
`dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = MyType`	Matches all types named `MyType` and all of their derived types.
`dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = MyType1\|MyType2`	Matches all types named either `MyType1` or `MyType2` and all of their derived types.
`dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = M:NS.MyType`	Matches specific type `MyType` with given fully qualified name and all of its derived types.
`dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = M:NS1.MyType1\|M:NS2.MyType2`	Matches specific types `MyType1` and `MyType2` with the respective fully qualified names, and all of their derived types.

Example

The following code snippet illustrates the pattern detected by this rule.

Violation:

using System.IO.Compression;

class TestClass
{
    public void TestMethod(ZipArchiveEntry zipArchiveEntry)
    {
        zipArchiveEntry.ExtractToFile(zipArchiveEntry.FullName);
    }
}

Solution:

using System;
using System.IO;
using System.IO.Compression;

class Program
{
    static void Main(string[] args)
    {
        string zipPath = @".\result.zip";

        Console.WriteLine("Provide path where to extract the zip file:");
        string extractPath = Console.ReadLine();

        // Normalizes the path.
        extractPath = Path.GetFullPath(extractPath);

        // Ensures that the last character on the extraction path
        // is the directory separator char.
        // Without this, a malicious zip file could try to traverse outside of the expected
        // extraction path.
        if (!extractPath.EndsWith(Path.DirectorySeparatorChar.ToString(), StringComparison.Ordinal))
            extractPath += Path.DirectorySeparatorChar;

        using (ZipArchive archive = ZipFile.OpenRead(zipPath))
        {
            foreach (ZipArchiveEntry entry in archive.Entries)
            {
                if (entry.FullName.EndsWith(".txt", StringComparison.OrdinalIgnoreCase))
                {
                    // Gets the full path to ensure that relative segments are removed.
                    string destinationPath = Path.GetFullPath(Path.Combine(extractPath, entry.FullName));

                    // Ordinal match is safest, case-sensitive volumes can be mounted within volumes that
                    // are case-insensitive.
                    if (destinationPath.StartsWith(extractPath, StringComparison.Ordinal))
                        entry.ExtractToFile(destinationPath);
                }
            }
        }
    }
}

Share via