How do I fix SCS0018?

Question

Security Scan SCS0018 Warnings in Visual Studio are shown during the build. Currently, I am working on these warnings to get removed. I tried several MSDN sites but no luck. I have also read OWSAP but they are not clearly related to C#. Please find the image of Path Traversal warning.

Code:

   public void Move(string sourceFileName, string destinationFileName)
    {
        
        try
        {
            System.IO.File.Move(sourceFileName,destinationFileName);
        }
        catch (System.Exception e)
        {
        }
   }

Answer 1

First of all, give a try to the version 5.0.0 that has better untrusted input tracking and may not give you a warning in this case.

If it still gives you the warning, you need to properly validate or sanitize the untrusted parameter. However SCS is not smart enough to recognize custom validation function so you need to add it into a configuration file like:

Sanitizers:
  - Type: NamespaceAndClassName
    TaintTypes:
      - SCS0018
    Methods:
      - Name: SanitizePath

See the built-in configuration for more sanitizer examples.

If instead you prefer to not have a dedicated function, but validate it inline, the other option is to suppress the warning.