Input Output (FIO)

Rules

• FIO00-J. Do not operate on files in shared directories
• FIO01-J. Create files with appropriate access permissions
• FIO02-J. Detect and handle file-related errors
• FIO03-J. Remove temporary files before termination
• FIO04-J. Release resources when they are no longer needed
• FIO05-J. Do not expose buffers or their backing arrays methods to untrusted code
• FIO06-J. Do not create multiple buffered wrappers on a single byte or character stream
• FIO07-J. Do not let external processes block on IO buffers
• FIO08-J. Distinguish between characters or bytes read from a stream and -1
• FIO09-J. Do not rely on the write() method to output integers outside the range 0 to 255
• FIO10-J. Ensure the array is filled when using read() to fill an array
• FIO11-J. Do not convert between strings and bytes without specifying a valid character encoding
• FIO12-J. Provide methods to read and write little-endian data
• FIO13-J. Do not log sensitive information outside a trust boundary
• FIO14-J. Perform proper cleanup at program termination
• FIO15-J. Do not reset a servlet's output stream after committing it
• FIO16-J. Canonicalize path names before validating them

Risk Assessment Summary

Recommendations