Skip to content
SudoSecurity

Sections

securitymedium

Path Traversal Guard

175 points · 0 solved

File download endpoints get owned by ../../etc/passwd. Line 1 is a base directory (absolute, may end with /). Line 2 is T; each next line is a user-supplied relative path. Resolve it under the base: split on /, skip empty segments and ., and let .. remove the previous segment.

Print REJECT if the path is empty, starts with /, contains \, ever climbs above the base, or resolves to the base itself. Otherwise print the base (without a trailing /), then /, then the resolved segments joined by /.

Example 1 input

/srv/files
3
reports/q3.pdf
../../root/.ssh/id_rsa
x/../y.txt

Expected output

/srv/files/reports/q3.pdf
REJECT
/srv/files/y.txt
Learn the technique/learn/secure-coding-in-practice

main.py