{"@ID": "743", "@Name": "CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO)", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).", "Relationships": {"Has_Member": [{"@CWE_ID": "119", "@View_ID": "734"}, {"@CWE_ID": "134", "@View_ID": "734"}, {"@CWE_ID": "22", "@View_ID": "734"}, {"@CWE_ID": "241", "@View_ID": "734"}, {"@CWE_ID": "276", "@View_ID": "734"}, {"@CWE_ID": "279", "@View_ID": "734"}, {"@CWE_ID": "362", "@View_ID": "734"}, {"@CWE_ID": "367", "@View_ID": "734"}, {"@CWE_ID": "37", "@View_ID": "734"}, {"@CWE_ID": "379", "@View_ID": "734"}, {"@CWE_ID": "38", "@View_ID": "734"}, {"@CWE_ID": "39", "@View_ID": "734"}, {"@CWE_ID": "391", "@View_ID": "734"}, {"@CWE_ID": "403", "@View_ID": "734"}, {"@CWE_ID": "404", "@View_ID": "734"}, {"@CWE_ID": "41", "@View_ID": "734"}, {"@CWE_ID": "552", "@View_ID": "734"}, {"@CWE_ID": "59", "@View_ID": "734"}, {"@CWE_ID": "62", "@View_ID": "734"}, {"@CWE_ID": "64", "@View_ID": "734"}, {"@CWE_ID": "65", "@View_ID": "734"}, {"@CWE_ID": "67", "@View_ID": "734"}, {"@CWE_ID": "675", "@View_ID": "734"}, {"@CWE_ID": "676", "@View_ID": "734"}, {"@CWE_ID": "686", "@View_ID": "734"}, {"@CWE_ID": "732", "@View_ID": "734"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-597"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Notes": {"Note": {"@Type": "Relationship", "xhtml:p": "In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:", "xhtml:ul": {"xhtml:li": ["CWE-22 FIO02-C Canonicalize path names originating from untrusted sources", "CWE-37 FIO05-C Identify files using multiple file attributes", "CWE-38 FIO05-C Identify files using multiple file attributes", "CWE-39 FIO05-C Identify files using multiple file attributes", "CWE-41 FIO02-C Canonicalize path names originating from untrusted sources", "CWE-59 FIO02-C Canonicalize path names originating from untrusted sources", "CWE-62 FIO05-C Identify files using multiple file attributes", "CWE-64 FIO05-C Identify files using multiple file attributes", "CWE-65 FIO05-C Identify files using multiple file attributes", "CWE-67 FIO32-C Do not perform operations on devices that are only appropriate for files", "CWE-119 FIO37-C Do not assume character data has been read", "CWE-134 FIO30-C Exclude user input from format strings", "CWE-134 FIO30-C Exclude user input from format strings", "CWE-241 FIO37-C Do not assume character data has been read", "CWE-276 FIO06-C Create files with appropriate access permissions", "CWE-279 FIO06-C Create files with appropriate access permissions", "CWE-362 FIO31-C Do not simultaneously open the same file multiple times", "CWE-367 FIO01-C Be careful using functions that use file names for identification", "CWE-379 FIO15-C Ensure that file operations are performed in a secure directory", "CWE-379 FIO43-C Do not create temporary files in shared directories", "CWE-391 FIO04-C Detect and handle input and output errors", "CWE-391 FIO33-C Detect and handle input output errors resulting in undefined behavior", "CWE-403 FIO42-C Ensure files are properly closed when they are no longer needed", "CWE-404 FIO42-C Ensure files are properly closed when they are no longer needed", "CWE-552 FIO15-C Ensure that file operations are performed in a secure directory", "CWE-675 FIO31-C Do not simultaneously open the same file multiple times", "CWE-676 FIO01-C Be careful using functions that use file names for identification", "CWE-686 FIO00-C Take care when creating format strings", "CWE-732 FIO06-C Create files with appropriate access permissions"]}, "#text_blocks": ["In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:", "CWE-22 FIO02-C Canonicalize path names originating from untrusted sources", "CWE-37 FIO05-C Identify files using multiple file attributes", "CWE-38 FIO05-C Identify files using multiple file attributes", "CWE-39 FIO05-C Identify files using multiple file attributes", "CWE-41 FIO02-C Canonicalize path names originating from untrusted sources", "CWE-59 FIO02-C Canonicalize path names originating from untrusted sources", "CWE-62 FIO05-C Identify files using multiple file attributes", "CWE-64 FIO05-C Identify files using multiple file attributes", "CWE-65 FIO05-C Identify files using multiple file attributes", "CWE-67 FIO32-C Do not perform operations on devices that are only appropriate for files", "CWE-119 FIO37-C Do not assume character data has been read", "CWE-134 FIO30-C Exclude user input from format strings", "CWE-134 FIO30-C Exclude user input from format strings", "CWE-241 FIO37-C Do not assume character data has been read", "CWE-276 FIO06-C Create files with appropriate access permissions", "CWE-279 FIO06-C Create files with appropriate access permissions", "CWE-362 FIO31-C Do not simultaneously open the same file multiple times", "CWE-367 FIO01-C Be careful using functions that use file names for identification", "CWE-379 FIO15-C Ensure that file operations are performed in a secure directory", "CWE-379 FIO43-C Do not create temporary files in shared directories", "CWE-391 FIO04-C Detect and handle input and output errors", "CWE-391 FIO33-C Detect and handle input output errors resulting in undefined behavior", "CWE-403 FIO42-C Ensure files are properly closed when they are no longer needed", "CWE-404 FIO42-C Ensure files are properly closed when they are no longer needed", "CWE-552 FIO15-C Ensure that file operations are performed in a secure directory", "CWE-675 FIO31-C Do not simultaneously open the same file multiple times", "CWE-676 FIO01-C Be careful using functions that use file names for identification", "CWE-686 FIO00-C Take care when creating format strings", "CWE-732 FIO06-C Create files with appropriate access permissions"]}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2008-11-24", "Submission_Version": "1.1", "Submission_ReleaseDate": "2008-11-24"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-09-13", "Modification_Version": "2.1", "Modification_ReleaseDate": "2011-09-13", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Description, Name, Relationship_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-01-03", "Modification_Version": "3.2", "Modification_ReleaseDate": "2019-01-03", "Modification_Comment": "updated Description, Name, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}], "Previous_Entry_Name": [{"@Date": "2017-11-08", "#text": "CERT C Secure Coding Section 09 - Input Output (FIO)"}, {"@Date": "2019-01-03", "#text": "CERT C Secure Coding (2008 Version) Section 09 - Input Output (FIO)"}]}, "entry_type": "Grouping"}