Rule Definition
Using "new Guid()" makes an "empty" all-0 guid (00000000-0000-0000-0000-000000000000 is not very useful), whereas
Guid.NewGuid() makes an actual guid with a unique value, which is useful.
Remediation
Use one of the official constructor.
Official constructor for Guid are the following:
- Guid(Byte[]) : Initializes a new instance of the Guid structure by using the specified array of bytes.
- Guid(ReadOnlySpan) : Initializes a new instance of the Guid structure by using the value represented by the specified read-only span of bytes.
- Guid(String) : Initializes a new instance of the Guid structure by using the value represented by the specified string.
- Guid(Int32, Int16, Int16, Byte[]) : Initializes a new instance of the Guid structure by using the specified integers and byte array.
- Guid(Int32, Int16, Int16, Byte, Byte, Byte, Byte, Byte, Byte, Byte, Byte) : Initializes a new instance of the Guid structure by using the specified integers and bytes.
- Guid(UInt32, UInt16, UInt16, Byte, Byte, Byte, Byte, Byte, Byte, Byte, Byte) : Initializes a new instance of the Guid structure by using the specified unsigned integers and bytes.
Violation Code Sample
var guid = new Guid();
Console.WriteLine(guid);
Fixed Code Sample
var guid = Guid.Empty;
Console.WriteLine(guid);
var guid = Guid.NewGuid();
Console.WriteLine(guid);
var guid = new Guid(bytes);
Console.WriteLine(guid);
Reference
https://docs.microsoft.com/en-ca/dotnet/api/system.guid.newguid?view=netcore-3.1
https://docs.microsoft.com/en-ca/dotnet/api/system.guid.-ctor?view=netcore-3.1
Related Technologies
Technical Criterion
CWE-287 - Improper Authentication [Class]
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.