Wiki Markup fopen()}} function is used to open an existing file or create a new one \[ [ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\]. However, in C99, {{fopen()}} does not indicate if an existing file has been opened for writing or a new file has been created. This may lead to a program overwriting or accessing an unintended file.
Noncompliant Code Example (fopen())
...
Noncompliant Code Example (fopen_s(), ISO/IEC TR 24731-1)
...
The ISO/IEC TR 24731-1 {{fopen_s()}} function is designed to improve the security of the {{fopen()}} function \[ [ISO/IEC TR 24731-1:2007|AA. Bibliography#SO/IEC TR 24731-1-2007]\]. However, like {{fopen()}}, {{fopen_s()}} provides no mechanism to determine if an existing file has been opened for writing or a new file has been created.
| Code Block | ||||
|---|---|---|---|---|
| ||||
char *file_name;
FILE *fp;
/* initialize file_name */
errno_t res = fopen_s(&fp, file_name, "w");
if (res != 0) {
/* Handle error */
}
|
...
Opening a file with exclusive mode ('x' as the last character in the mode argument) fails if the file already exists or cannot be created. Otherwise, the file is created with exclusive (also known as non-shared) access to the extent that the underlying system supports exclusive access.
Wiki Markup
This compliant solution uses the x mode character to instruct fopen() to fail rather than open an existing functions.
...
Compliant Solution (open(), POSIX)
...
The {{open()}} function, as defined in the Open Group Base Specifications Issue 6 \ [[Open Group 2004|AA. Bibliography#Open Group 04]\], is available on many platforms and provides finer control than {{fopen()}}. In particular, {{open()}} accepts the {{O_CREAT}} and {{O_EXCL}} flags. When used together, these flags instruct the {{open()}} function to fail if the file specified by {{file_name}} already exists.
| Code Block | ||||
|---|---|---|---|---|
| ||||
char *file_name;
int new_file_mode;
/* initialize file_name and new_file_mode */
int fd = open(file_name, O_CREAT | O_EXCL | O_WRONLY, new_file_mode);
if (fd == -1) {
/* Handle error */
}
|
...
Care should be taken when using {{O_EXCL}} with remote file systems because it does not work with NFS version 2. NFS version 3 added support for {{O_EXCL}} mode in {{open()}}. IETF RFC 1813 defines the {{EXCLUSIVE}} value to the {{mode}} argument of {{CREATE}} \ [[Callaghan 1995|AA. Bibliography#Callaghan 95]\].
EXCLUSIVEspecifies that the server is to follow exclusive creation semantics, using the verifier to ensure exclusive creation of the target. No attributes may be provided in this case, since the server may use the target file metadata to store the createverf3 verifier.
...
Compliant Solution (fdopen(), POSIX)
Wiki Markup FILE}} pointers and not file descriptors, the POSIX {{fdopen()}} function can be used to associate an open stream with the file descriptor returned by {{open()}}, as shown in this compliant solution \ [[Open Group 2004|AA. Bibliography#Open Group 04]\].
| Code Block | ||||
|---|---|---|---|---|
| ||||
char *file_name;
int new_file_mode;
FILE *fp;
int fd;
/* initialize file_name and new_file_mode */
fd = open(file_name, O_CREAT | O_EXCL | O_WRONLY, new_file_mode);
if (fd == -1) {
/* Handle error */
}
fp = fdopen(fd, "w");
if (fp == NULL) {
/* Handle error */
}
|
...
ISO/IEC TR 24731-1:2007 Section 6.5.2.1, "The fopen_s function"
Bibliography
Wiki Markup
[Open Group 2004]
[Seacord 2005a] Chapter 7, "File I/O"
...
FIO02-C. Canonicalize path names originating from untrusted sources 09. Input Output (FIO) FIO04-C. Detect and handle input and output errors