Secure filename handling in Flask

Introduction

When users upload files, their filenames might contain unsafe characters or paths. Secure filename handling makes sure these names are safe to use on your server.

When accepting file uploads from users on a website.

When saving files to your server to avoid overwriting or security risks.

When you want to prevent directory traversal attacks through filenames.

When you need to ensure filenames are valid and safe for your operating system.

Syntax

Flask

from werkzeug.utils import secure_filename

filename = secure_filename(user_uploaded_filename)

secure_filename cleans the filename by removing unsafe characters and paths.

It returns a safe version of the filename you can use to save files securely.

Examples

This converts spaces to underscores and keeps the extension safe.

Flask

from werkzeug.utils import secure_filename

filename = secure_filename('my photo.png')
print(filename)

This removes dangerous path parts to prevent security issues.

Flask

from werkzeug.utils import secure_filename

filename = secure_filename('../../../etc/passwd')
print(filename)

This removes special characters that are not safe in filenames.

Flask

from werkzeug.utils import secure_filename

filename = secure_filename('my*file?.txt')
print(filename)

Sample Program

This Flask app accepts a file upload, secures the filename, and saves it safely to a folder.

It prevents unsafe filenames from causing problems on the server.

Flask

from flask import Flask, request
from werkzeug.utils import secure_filename
import os

app = Flask(__name__)

UPLOAD_FOLDER = '/tmp/uploads'
app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER

@app.route('/upload', methods=['POST'])
def upload_file():
    if 'file' not in request.files:
        return 'No file part', 400
    file = request.files['file']
    if file.filename == '':
        return 'No selected file', 400
    filename = secure_filename(file.filename)
    save_path = os.path.join(app.config['UPLOAD_FOLDER'], filename)
    file.save(save_path)
    return f'File saved as {filename}'

# To run this app, use: flask run
# Then send a POST request with a file to /upload

Important Notes

Always use secure_filename before saving user-uploaded files.

Make sure the upload folder exists and has proper permissions.

Secure filenames help prevent overwriting important files and directory traversal attacks.

Summary

Use secure_filename to clean user-uploaded filenames.

This protects your server from unsafe file paths and characters.

It is a simple but important step in handling file uploads securely.

Practice

1. What is the main purpose of using secure_filename in Flask when handling file uploads?

easy

A. To clean the filename and remove unsafe characters

B. To compress the uploaded file

C. To encrypt the file contents

D. To rename the file to a random string

Solution

1. Step 1: Understand the role of secure_filename

   This function cleans the filename by removing or replacing unsafe characters that could cause security issues.

2. Step 2: Differentiate from other file handling tasks

   It does not compress, encrypt, or randomly rename files; it only sanitizes the filename.

3. Final Answer:

   To clean the filename and remove unsafe characters -> Option A

4. Quick Check:

   Purpose of secure_filename = clean filename [OK]

Hint: Remember: secure_filename cleans names, not file content [OK]

Common Mistakes:

• Thinking it encrypts or compresses files
• Assuming it renames files randomly
• Confusing filename cleaning with file content processing

2. Which of the following is the correct way to import secure_filename in a Flask app?

easy

A. from flask import secure_filename

B. from werkzeug.utils import secure_filename

C. import secure_filename from flask

D. import werkzeug.secure_filename

Solution

1. Step 1: Identify the correct module for secure_filename

   The function secure_filename is provided by werkzeug.utils, not directly by Flask.

2. Step 2: Check import syntax

   The correct syntax is from werkzeug.utils import secure_filename. Other options are either incorrect syntax or wrong modules.

3. Final Answer:

   from werkzeug.utils import secure_filename -> Option B

4. Quick Check:

   Import secure_filename = werkzeug.utils [OK]

Hint: Import secure_filename from werkzeug.utils, not flask [OK]

Common Mistakes:

• Importing directly from flask
• Using incorrect import syntax
• Trying to import as a module instead of function

3. What will be the output of the following code snippet?

from werkzeug.utils import secure_filename
filename = secure_filename('../../etc/passwd')

medium

A. 'passwd'

B. '.._.._etc_passwd'

C. 'etc_passwd'

D. '../../etc/passwd'

Solution

1. Step 1: Understand how secure_filename handles path traversal

   The function removes directory traversal parts like '../' and replaces unsafe characters with underscores.

2. Step 2: Apply to '../../etc/passwd'

   The '../' parts are removed and slashes replaced by underscores, resulting in 'etc_passwd'.

3. Final Answer:

   'etc_passwd' -> Option C

4. Quick Check:

   secure_filename('../../etc/passwd') = 'etc_passwd' [OK]

Hint: secure_filename removes ../ and replaces slashes with underscores [OK]

Common Mistakes:

• Expecting original path to remain
• Thinking it returns only the basename
• Assuming it keeps dots or slashes

4. Identify the error in this Flask file upload snippet:

from werkzeug.utils import secure_filename

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = secure_filename(file.filename)
    file.save('/uploads/' + filename)
    return 'File saved'

medium

A. Missing import of request from flask

B. Using insecure filename without cleaning

C. Saving file without checking if upload folder exists

D. Incorrect HTTP method for file upload

Solution

1. Step 1: Check imports

   The code uses request.files but does not import request from Flask, causing a NameError.

2. Step 2: Verify other parts

   The filename is cleaned with secure_filename, the method POST is correct, and folder existence is not checked but not an error here.

3. Final Answer:

   Missing import of request from flask -> Option A

4. Quick Check:

   request must be imported for request.files [OK]

Hint: Always import request when accessing request.files [OK]

Common Mistakes:

• Forgetting to import request
• Assuming folder existence is automatically handled
• Confusing HTTP methods for uploads

5. You want to save uploaded files securely in Flask, ensuring filenames are safe and files are saved inside a folder named 'uploads' inside your project. Which code snippet correctly handles this, assuming file is from request.files?

from werkzeug.utils import secure_filename
import os

UPLOAD_FOLDER = os.path.join(os.getcwd(), 'uploads')

# Which snippet below is correct?

A) filename = secure_filename(file.filename)
   file.save(os.path.join(UPLOAD_FOLDER, filename))

B) filename = file.filename
   file.save(os.path.join(UPLOAD_FOLDER, filename))

C) filename = secure_filename(file.filename)
   file.save('/uploads/' + filename)

D) filename = secure_filename(file.filename)
   file.save(os.path.join('/uploads', filename))

hard

A. Use secure_filename but join with absolute string '/uploads' ignoring project path

B. Use raw filename without cleaning and os.path.join with absolute path

C. Use secure_filename but save with hardcoded relative path string

D. Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path

Solution

1. Step 1: Check filename safety

   Snippets using secure_filename correctly clean the filename (eliminate the snippet using raw file.filename).

2. Step 2: Check file save path correctness

   The correct snippet uses os.path.join(UPLOAD_FOLDER, filename) with the defined UPLOAD_FOLDER that points inside the project 'uploads' folder. The remaining snippets use hardcoded paths like '/uploads/' + filename or os.path.join('/uploads', filename), which may not save inside the project folder.

3. Final Answer:

   Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path -> Option D

4. Quick Check:

   Safe filename + correct absolute path = Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path [OK]

Hint: Always combine secure_filename with os.path.join and absolute folder path [OK]

Common Mistakes:

• Saving files with unsafe raw filenames
• Using hardcoded paths that may not exist
• Ignoring project directory structure