Secure filename handling in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

Why should you never trust user-uploaded filenames directly in Flask?

User-uploaded filenames can contain unsafe characters or paths that may lead to security risks like directory traversal attacks. Always sanitize filenames before saving.

beginner

What Flask utility helps to secure filenames before saving them?

Flask provides the werkzeug.utils.secure_filename() function to clean filenames by removing unsafe characters and ensuring a safe, simple filename.

beginner

What does secure_filename('my file.txt') return?

It returns my_file.txt, replacing spaces with underscores and removing unsafe characters.

intermediate

How does secure_filename() protect against directory traversal?

It strips out path separators like / or \, preventing attackers from navigating outside the intended upload folder.

intermediate

What is a good practice besides using secure_filename() when handling file uploads?

Always store uploaded files in a dedicated folder with restricted permissions and validate file types to avoid malicious content.

Which function in Flask helps sanitize filenames for safe saving?

A secure_filename()

B sanitize_path()

C clean_filename()

D safe_path()

The correct function is secure_filename() from werkzeug.utils.

What does secure_filename('..\secret.txt') return to prevent directory traversal?

A secret.txt

B .._secret.txt

C ..\secret.txt

D secret

secure_filename removes path parts and returns just 'secret.txt' to avoid directory traversal.

Why is it unsafe to save uploaded files using their original filenames directly?

A They might overwrite system files

B They might contain unsafe characters or paths

C They might be too long

D They might be in uppercase

Original filenames can contain unsafe characters or paths that cause security issues.

Which of these is NOT a recommended practice for secure file uploads in Flask?

A Using secure_filename()

B Validating file types

C Saving files in a public folder without restrictions

D Restricting upload folder permissions

Saving files in a public folder without restrictions is unsafe.

What does secure_filename() do with spaces in filenames?

A Removes them

B Replaces them with dashes

C Leaves them as is

D Replaces them with underscores

secure_filename replaces spaces with underscores for safety.

Explain why and how you should use secure_filename() in Flask when handling file uploads.

Think about what could happen if you save files with user-given names directly.

Describe additional security steps besides using secure_filename() to safely handle uploaded files in Flask.

Consider how to protect your server and users from malicious files.