Secure filename handling in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What does this Flask code output when uploading a file named '../../secret.txt'?

Consider this Flask snippet that uses secure_filename from werkzeug.utils to sanitize uploaded filenames.

from flask import Flask, request
from werkzeug.utils import secure_filename

app = Flask(__name__)

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = secure_filename(file.filename)
    return filename

If a user uploads a file named ../../secret.txt, what will be the returned filename?

Flask

from flask import Flask, request
from werkzeug.utils import secure_filename

app = Flask(__name__)

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = secure_filename(file.filename)
    return filename

A secret-txt

B ../../secret.txt

C secret_txt

D secret.txt

💡 Hint

Think about how secure_filename removes directory paths and unsafe characters.

The secure_filename function strips directory components and returns only the base filename, removing dangerous path parts like ../. So '../../secret.txt' becomes 'secret.txt'.

📝 Syntax

intermediate

Which option correctly imports and uses secure_filename in Flask?

You want to safely handle uploaded filenames in Flask. Which code snippet correctly imports and uses secure_filename?

A

from werkzeug.utils import secure_filename
filename = secure_filename(uploaded_file.filename)

B

from flask.utils import secure_filename
filename = secure_filename(uploaded_file.filename)

C

from werkzeug import secure_filename
filename = secure_filename(uploaded_file.filename)

D

import werkzeug
filename = werkzeug.utils.secure_filename(uploaded_file.filename)

💡 Hint

Check the correct module path for secure_filename in modern Flask/Werkzeug.

The correct import is from werkzeug.utils. Other options either import from wrong modules or use incorrect syntax.

🔧 Debug

advanced

Why does this Flask upload code raise a FileNotFoundError when saving?

Look at this Flask route that saves an uploaded file:

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = secure_filename(file.filename)
    file.save(filename)
    return 'Saved'

Sometimes this raises FileNotFoundError. Why?

Flask

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = secure_filename(file.filename)
    file.save(filename)
    return 'Saved'

A The file object is closed before save is called.

B secure_filename returns None, causing save to fail.

C The current directory may not exist or be writable, so saving without a full path fails.

D Flask requires an absolute path for file.save, relative paths are disallowed.

💡 Hint

Think about where the file is saved and if that location exists.

Calling file.save(filename) saves to the current working directory. If that directory doesn't exist or isn't writable, a FileNotFoundError occurs. The fix is to specify a valid directory path that exists and is writable.

❓ state_output

advanced

What is the value of filename after this code runs?

Given this code snippet:

from werkzeug.utils import secure_filename

original = 'my..file...name.tar.gz'
filename = secure_filename(original)

What is the value of filename?

Flask

from werkzeug.utils import secure_filename

original = 'my..file...name.tar.gz'
filename = secure_filename(original)

A my.file.name.tar.gz

B my..file...name.tar.gz

C my-file-name.tar.gz

D my_file_name_tar_gz

💡 Hint

Consider how secure_filename handles multiple dots and special characters.

secure_filename replaces multiple dots with single dots except for the extension separator. It keeps dots in the filename but removes unsafe characters. So 'my..file...name.tar.gz' becomes 'my.file.name.tar.gz'.

🧠 Conceptual

expert

Why is using secure_filename important in Flask file uploads?

Which of the following best explains why using secure_filename is critical when handling uploaded files in Flask?

A It validates the file content type to prevent malware.

B It prevents directory traversal attacks by removing path separators and unsafe characters from filenames.

C It encrypts the filename to protect user privacy.

D It compresses the file to save storage space.

💡 Hint

Think about what risks come from unsafe filenames in uploads.

secure_filename sanitizes filenames to prevent attackers from using paths like '../../' to overwrite files or access unauthorized locations. It does not encrypt, compress, or validate file content.