Secure filename handling in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

Why should you never trust user-uploaded filenames directly in Flask?

User-uploaded filenames can contain unsafe characters or paths that may lead to security risks like directory traversal attacks. Always sanitize filenames before saving.

beginner

What Flask utility helps to secure filenames before saving them?

Flask provides the werkzeug.utils.secure_filename() function to clean filenames by removing unsafe characters and ensuring a safe, simple filename.

beginner

What does secure_filename('my file.txt') return?

It returns my_file.txt, replacing spaces with underscores and removing unsafe characters.

intermediate

How does secure_filename() protect against directory traversal?

It strips out path separators like / or \, preventing attackers from navigating outside the intended upload folder.

intermediate

What is a good practice besides using secure_filename() when handling file uploads?

Always store uploaded files in a dedicated folder with restricted permissions and validate file types to avoid malicious content.

Which function in Flask helps sanitize filenames for safe saving?

A secure_filename()

B sanitize_path()

C clean_filename()

D safe_path()

The correct function is secure_filename() from werkzeug.utils.

What does secure_filename('..\secret.txt') return to prevent directory traversal?

A secret.txt

B .._secret.txt

C ..\secret.txt

D secret

secure_filename removes path parts and returns just 'secret.txt' to avoid directory traversal.

Why is it unsafe to save uploaded files using their original filenames directly?

A They might overwrite system files

B They might contain unsafe characters or paths

C They might be too long

D They might be in uppercase

Original filenames can contain unsafe characters or paths that cause security issues.

Which of these is NOT a recommended practice for secure file uploads in Flask?

A Using secure_filename()

B Validating file types

C Saving files in a public folder without restrictions

D Restricting upload folder permissions

Saving files in a public folder without restrictions is unsafe.

What does secure_filename() do with spaces in filenames?

A Removes them

B Replaces them with dashes

C Leaves them as is

D Replaces them with underscores

secure_filename replaces spaces with underscores for safety.

Explain why and how you should use secure_filename() in Flask when handling file uploads.

Think about what could happen if you save files with user-given names directly.

Describe additional security steps besides using secure_filename() to safely handle uploaded files in Flask.

Consider how to protect your server and users from malicious files.

Practice

1. What is the main purpose of using secure_filename in Flask when handling file uploads?

easy

A. To clean the filename and remove unsafe characters

B. To compress the uploaded file

C. To encrypt the file contents

D. To rename the file to a random string

Solution

1. Step 1: Understand the role of secure_filename

   This function cleans the filename by removing or replacing unsafe characters that could cause security issues.

2. Step 2: Differentiate from other file handling tasks

   It does not compress, encrypt, or randomly rename files; it only sanitizes the filename.

3. Final Answer:

   To clean the filename and remove unsafe characters -> Option A

4. Quick Check:

   Purpose of secure_filename = clean filename [OK]

Hint: Remember: secure_filename cleans names, not file content [OK]

Common Mistakes:

• Thinking it encrypts or compresses files
• Assuming it renames files randomly
• Confusing filename cleaning with file content processing

2. Which of the following is the correct way to import secure_filename in a Flask app?

easy

A. from flask import secure_filename

B. from werkzeug.utils import secure_filename

C. import secure_filename from flask

D. import werkzeug.secure_filename

Solution

1. Step 1: Identify the correct module for secure_filename

   The function secure_filename is provided by werkzeug.utils, not directly by Flask.

2. Step 2: Check import syntax

   The correct syntax is from werkzeug.utils import secure_filename. Other options are either incorrect syntax or wrong modules.

3. Final Answer:

   from werkzeug.utils import secure_filename -> Option B

4. Quick Check:

   Import secure_filename = werkzeug.utils [OK]

Hint: Import secure_filename from werkzeug.utils, not flask [OK]

Common Mistakes:

• Importing directly from flask
• Using incorrect import syntax
• Trying to import as a module instead of function

3. What will be the output of the following code snippet?

from werkzeug.utils import secure_filename
filename = secure_filename('../../etc/passwd')

medium

A. 'passwd'

B. '.._.._etc_passwd'

C. 'etc_passwd'

D. '../../etc/passwd'

Solution

1. Step 1: Understand how secure_filename handles path traversal

   The function removes directory traversal parts like '../' and replaces unsafe characters with underscores.

2. Step 2: Apply to '../../etc/passwd'

   The '../' parts are removed and slashes replaced by underscores, resulting in 'etc_passwd'.

3. Final Answer:

   'etc_passwd' -> Option C

4. Quick Check:

   secure_filename('../../etc/passwd') = 'etc_passwd' [OK]

Hint: secure_filename removes ../ and replaces slashes with underscores [OK]

Common Mistakes:

• Expecting original path to remain
• Thinking it returns only the basename
• Assuming it keeps dots or slashes

4. Identify the error in this Flask file upload snippet:

from werkzeug.utils import secure_filename

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = secure_filename(file.filename)
    file.save('/uploads/' + filename)
    return 'File saved'

medium

A. Missing import of request from flask

B. Using insecure filename without cleaning

C. Saving file without checking if upload folder exists

D. Incorrect HTTP method for file upload

Solution

1. Step 1: Check imports

   The code uses request.files but does not import request from Flask, causing a NameError.

2. Step 2: Verify other parts

   The filename is cleaned with secure_filename, the method POST is correct, and folder existence is not checked but not an error here.

3. Final Answer:

   Missing import of request from flask -> Option A

4. Quick Check:

   request must be imported for request.files [OK]

Hint: Always import request when accessing request.files [OK]

Common Mistakes:

• Forgetting to import request
• Assuming folder existence is automatically handled
• Confusing HTTP methods for uploads

5. You want to save uploaded files securely in Flask, ensuring filenames are safe and files are saved inside a folder named 'uploads' inside your project. Which code snippet correctly handles this, assuming file is from request.files?

from werkzeug.utils import secure_filename
import os

UPLOAD_FOLDER = os.path.join(os.getcwd(), 'uploads')

# Which snippet below is correct?

A) filename = secure_filename(file.filename)
   file.save(os.path.join(UPLOAD_FOLDER, filename))

B) filename = file.filename
   file.save(os.path.join(UPLOAD_FOLDER, filename))

C) filename = secure_filename(file.filename)
   file.save('/uploads/' + filename)

D) filename = secure_filename(file.filename)
   file.save(os.path.join('/uploads', filename))

hard

A. Use secure_filename but join with absolute string '/uploads' ignoring project path

B. Use raw filename without cleaning and os.path.join with absolute path

C. Use secure_filename but save with hardcoded relative path string

D. Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path

Solution

1. Step 1: Check filename safety

   Snippets using secure_filename correctly clean the filename (eliminate the snippet using raw file.filename).

2. Step 2: Check file save path correctness

   The correct snippet uses os.path.join(UPLOAD_FOLDER, filename) with the defined UPLOAD_FOLDER that points inside the project 'uploads' folder. The remaining snippets use hardcoded paths like '/uploads/' + filename or os.path.join('/uploads', filename), which may not save inside the project folder.

3. Final Answer:

   Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path -> Option D

4. Quick Check:

   Safe filename + correct absolute path = Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path [OK]

Hint: Always combine secure_filename with os.path.join and absolute folder path [OK]

Common Mistakes:

• Saving files with unsafe raw filenames
• Using hardcoded paths that may not exist
• Ignoring project directory structure