TABLE OF CONTENTS Prototype: static extern int GetTempPathA ( int nBufferLength, string lpBuffer)
Summary: This function gets the path for the directory where temporary files are stored.
Description: The function attempts to retrieve the path to where temporary files are stored. It has two input variables: the length of the t-char string used to store the path and the actual pointer to the string. The function returns the number of characters copied to the buffer. The path will also include a trailing slash (for easy concatenation of the file name). In the event of an error, the function will return a 0.
Risk: System path information is constantly sought after by attackers or malicious users profiling a target application or system. Path information alone can potentially identify the underlying operating system, installed applications, configurations, and in some cases user and security information. Ensure that non-alphanumeric characters are removed from the string before it is processed and that the information is only processed internally by the application. Limit the end user's ability to ascertain or traverse path information.
Note: At time of publication, this function was designed for Windows compatibility.
Additional Resources: www.webtropy.com/articles/art9-1.asp?f=GetTempPath
Impact: Low
Cross References: GetTempFileName, GetTempPath, GetTempPathW
Prototype: BOOL ImpersonateDdeClientWindow( HWND hWndClient, HWND hWndServer )
Summary: This function allows a DDE server application to impersonate a DDE client's context.
Description: The function attempts to impersonate a DDE client application's context. The function has two input arguments. The first is the handle of the client to impersonate.
