title: HP Fortify Validation Rules on Path Manipulation
body: <p>I am running code through Hp Fortify and have some path manipulation findings.  I understand the context of it and trying to resolve.</p>
  
  <p>Instead of going through all the places where SOME path values are queried from a database to store output files (logs, export data, whatever), I tried to centralize it.  So, instead of having File.WriteAllText() with some path + file name, content, I wanted to wrap into</p>
  
  <p>FortifyFileWriteAllText().  Then, in this function I do path validation check once up front, and if valid, only then allow the write to continue such as...</p>
  
  <pre><code>public static bool FortifyFileWriteAllText( string fileToWrite, string content)
  {
     if( ! MyPathValidationRoutine( fileToWrite ))
        return false;
  
     File.WriteAllText( fileToWrite, content );
     return true;
  }
  </code></pre>
  
  <p>So, I know this is very abbreviated of actual validation and preventing bad writes, but I call Path.GetFullPath() to prevent any such <code>..\..\..</code> path references.  Then look at the final path an explicitly PREVENT things like root C:, C:\Windows and some others, but also have a "CLEAN" list of paths.</p>
  
  <p>So, how would I go about applying a rule that says anything going to this routine is Ok and has explicitly been checked and ok.</p>