Hp Fortify: Path Manipulation erroe

Question

I am getting the hp fortify warning for the following code:

        FileStream fs = null;
        StreamWriter writer = null;

        try
        {
            fs = new FileStream(sFileName, FileMode.Open, FileAccess.Write);// Path Manipulation error
            writer = new StreamWriter(fs);

I am not deleting the file in my code, So if user provide the path of some config its safe from my code, So I am not sure why this is giving warning?

Can anyone please suggest me any alternative?

Answer 1

Fortify doesn't know what the file is, where it is, or anything else. Write the code in a way that Fortify can see that the application is protected from malicious users.

Validate the path so that I can't pass a file named ../../../../cmdshell.aspx , don't rely on filesystem permissions. I'm assuming that at some later time you want to read that file, do the same kind of validation there.

I would also validate MIME type, file size, and check for weird characters.