Secure filename handling in Flask - Mini Project: Build & Apply

Secure filename handling in Flask

📖 Scenario: You are building a simple Flask web app that allows users to upload files. To keep the app safe, you need to make sure the filenames are handled securely so no harmful files or paths can cause problems.

🎯 Goal: Create a Flask app that accepts a file upload and saves the file using a secure filename.

📋 What You'll Learn

Create a Flask app instance named app

Create a route /upload that accepts POST requests

Use werkzeug.utils.secure_filename to sanitize the uploaded file's name

Save the uploaded file to a folder named uploads using the secure filename

💡 Why This Matters

🌍 Real World

Web apps often let users upload files. Handling filenames securely prevents attackers from overwriting important files or uploading dangerous files.

💼 Career

Knowing how to safely handle file uploads is important for backend web developers to protect applications from security risks.

1

Set up Flask app and upload folder

Create a Flask app instance called app and set the configuration variable UPLOAD_FOLDER to the string 'uploads'.

Flask

# Create the Flask app instance and set UPLOAD_FOLDER
# Your code here

Hint

Use Flask(__name__) to create the app. Set app.config['UPLOAD_FOLDER'] to 'uploads'.

2

Import secure_filename and create upload route

Import secure_filename from werkzeug.utils. Create a route /upload that accepts POST requests and defines a function upload_file.

Flask

from flask import Flask

app = Flask(__name__)
app.config['UPLOAD_FOLDER'] = 'uploads'

# Import secure_filename and create /upload route with POST method
# Your code here

Hint

Import secure_filename. Use @app.route('/upload', methods=['POST']) to create the route.

3

Get file from request and secure filename

Inside the upload_file function, get the file from request.files['file']. Use secure_filename on the file's filename and save it to a variable called filename.

Flask

from flask import Flask, request
from werkzeug.utils import secure_filename

app = Flask(__name__)
app.config['UPLOAD_FOLDER'] = 'uploads'

@app.route('/upload', methods=['POST'])
def upload_file():
    # Get the uploaded file and secure its filename
    # Your code here

Hint

Use file = request.files['file'] to get the file. Then use filename = secure_filename(file.filename).

4

Save the file using secure filename

Save the uploaded file to the folder app.config['UPLOAD_FOLDER'] joined with filename using file.save(). Use os.path.join to combine the folder and filename. Import os at the top.

Flask

from flask import Flask, request
from werkzeug.utils import secure_filename
import os

app = Flask(__name__)
app.config['UPLOAD_FOLDER'] = 'uploads'

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    filename = secure_filename(file.filename)
    # Save the file securely
    # Your code here

Hint

Import os. Use file.save(os.path.join(app.config['UPLOAD_FOLDER'], filename)) to save the file.

Practice

1. What is the main purpose of using secure_filename in Flask when handling file uploads?

easy

A. To clean the filename and remove unsafe characters

B. To compress the uploaded file

C. To encrypt the file contents

D. To rename the file to a random string

Solution

1. Step 1: Understand the role of secure_filename

   This function cleans the filename by removing or replacing unsafe characters that could cause security issues.

2. Step 2: Differentiate from other file handling tasks

   It does not compress, encrypt, or randomly rename files; it only sanitizes the filename.

3. Final Answer:

   To clean the filename and remove unsafe characters -> Option A

4. Quick Check:

   Purpose of secure_filename = clean filename [OK]

Hint: Remember: secure_filename cleans names, not file content [OK]

Common Mistakes:

• Thinking it encrypts or compresses files
• Assuming it renames files randomly
• Confusing filename cleaning with file content processing

2. Which of the following is the correct way to import secure_filename in a Flask app?

easy

A. from flask import secure_filename

B. from werkzeug.utils import secure_filename

C. import secure_filename from flask

D. import werkzeug.secure_filename

Solution

1. Step 1: Identify the correct module for secure_filename

   The function secure_filename is provided by werkzeug.utils, not directly by Flask.

2. Step 2: Check import syntax

   The correct syntax is from werkzeug.utils import secure_filename. Other options are either incorrect syntax or wrong modules.

3. Final Answer:

   from werkzeug.utils import secure_filename -> Option B

4. Quick Check:

   Import secure_filename = werkzeug.utils [OK]

Hint: Import secure_filename from werkzeug.utils, not flask [OK]

Common Mistakes:

• Importing directly from flask
• Using incorrect import syntax
• Trying to import as a module instead of function

3. What will be the output of the following code snippet?

from werkzeug.utils import secure_filename
filename = secure_filename('../../etc/passwd')

medium

A. 'passwd'

B. '.._.._etc_passwd'

C. 'etc_passwd'

D. '../../etc/passwd'

Solution

1. Step 1: Understand how secure_filename handles path traversal

   The function removes directory traversal parts like '../' and replaces unsafe characters with underscores.

2. Step 2: Apply to '../../etc/passwd'

   The '../' parts are removed and slashes replaced by underscores, resulting in 'etc_passwd'.

3. Final Answer:

   'etc_passwd' -> Option C

4. Quick Check:

   secure_filename('../../etc/passwd') = 'etc_passwd' [OK]

Hint: secure_filename removes ../ and replaces slashes with underscores [OK]

Common Mistakes:

• Expecting original path to remain
• Thinking it returns only the basename
• Assuming it keeps dots or slashes

4. Identify the error in this Flask file upload snippet:

from werkzeug.utils import secure_filename

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = secure_filename(file.filename)
    file.save('/uploads/' + filename)
    return 'File saved'

medium

A. Missing import of request from flask

B. Using insecure filename without cleaning

C. Saving file without checking if upload folder exists

D. Incorrect HTTP method for file upload

Solution

1. Step 1: Check imports

   The code uses request.files but does not import request from Flask, causing a NameError.

2. Step 2: Verify other parts

   The filename is cleaned with secure_filename, the method POST is correct, and folder existence is not checked but not an error here.

3. Final Answer:

   Missing import of request from flask -> Option A

4. Quick Check:

   request must be imported for request.files [OK]

Hint: Always import request when accessing request.files [OK]

Common Mistakes:

• Forgetting to import request
• Assuming folder existence is automatically handled
• Confusing HTTP methods for uploads

5. You want to save uploaded files securely in Flask, ensuring filenames are safe and files are saved inside a folder named 'uploads' inside your project. Which code snippet correctly handles this, assuming file is from request.files?

from werkzeug.utils import secure_filename
import os

UPLOAD_FOLDER = os.path.join(os.getcwd(), 'uploads')

# Which snippet below is correct?

A) filename = secure_filename(file.filename)
   file.save(os.path.join(UPLOAD_FOLDER, filename))

B) filename = file.filename
   file.save(os.path.join(UPLOAD_FOLDER, filename))

C) filename = secure_filename(file.filename)
   file.save('/uploads/' + filename)

D) filename = secure_filename(file.filename)
   file.save(os.path.join('/uploads', filename))

hard

A. Use secure_filename but join with absolute string '/uploads' ignoring project path

B. Use raw filename without cleaning and os.path.join with absolute path

C. Use secure_filename but save with hardcoded relative path string

D. Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path

Solution

1. Step 1: Check filename safety

   Snippets using secure_filename correctly clean the filename (eliminate the snippet using raw file.filename).

2. Step 2: Check file save path correctness

   The correct snippet uses os.path.join(UPLOAD_FOLDER, filename) with the defined UPLOAD_FOLDER that points inside the project 'uploads' folder. The remaining snippets use hardcoded paths like '/uploads/' + filename or os.path.join('/uploads', filename), which may not save inside the project folder.

3. Final Answer:

   Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path -> Option D

4. Quick Check:

   Safe filename + correct absolute path = Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path [OK]

Hint: Always combine secure_filename with os.path.join and absolute folder path [OK]

Common Mistakes:

• Saving files with unsafe raw filenames
• Using hardcoded paths that may not exist
• Ignoring project directory structure