Secure filename handling in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the function that helps secure filenames in Flask.

Flask

from werkzeug.utils import [1]

Drag options to blanks, or click blank then click option'

Asafe_filename

Bclean_filename

Csanitize_filename

Dsecure_filename

Attempts:

3 left

💡 Hint

Common Mistakes

Using a wrong function name like 'safe_filename' or 'sanitize_filename'.

Not importing from 'werkzeug.utils'.

The secure_filename function from werkzeug.utils is used to safely handle filenames in Flask.

2fill in blank

medium

Complete the code to secure the uploaded file's name before saving.

Flask

filename = [1](uploaded_file.filename)

Drag options to blanks, or click blank then click option'

Asecure_filename

Bclean_filename

Csafe_filename

Dsanitize_filename

Attempts:

3 left

💡 Hint

Common Mistakes

Using the raw filename without securing it.

Using a non-existent function.

Use secure_filename to clean the uploaded file's name before saving it.

3fill in blank

hard

Fix the error in the code to correctly save the uploaded file with a secure filename.

Flask

uploaded_file.save(os.path.join(app.config['UPLOAD_FOLDER'], [1]))

Drag options to blanks, or click blank then click option'

Afilename

Bsecure_filename(uploaded_file.filename)

Cuploaded_file.name

Duploaded_file.filename

Attempts:

3 left

💡 Hint

Common Mistakes

Saving the file with the raw filename.

Using an undefined variable like 'filename' without securing it.

The filename must be secured using secure_filename before saving to avoid unsafe file paths.

4fill in blank

hard

Fill both blanks to create a dictionary comprehension that maps original filenames to their secure versions.

Flask

secured_files = {file: [1](file) for file in files if file.endswith([2])}

Drag options to blanks, or click blank then click option'

Asecure_filename

Bsanitize_filename

C'.txt'

D'.exe'

Attempts:

3 left

💡 Hint

Common Mistakes

Using a wrong function name.

Filtering with the wrong file extension.

This comprehension creates a dictionary where keys are original filenames and values are their secured versions, filtering only '.txt' files.

5fill in blank

hard

Fill all three blanks to create a Flask route that saves an uploaded file securely.

Flask

from flask import Flask, request
import os
from werkzeug.utils import [1]

app = Flask(__name__)
app.config['UPLOAD_FOLDER'] = '/uploads'

@app.route('/upload', methods=['POST'])
def upload_file():
    uploaded_file = request.files.get('[2]')
    if uploaded_file:
        filename = [3](uploaded_file.filename)
        uploaded_file.save(os.path.join(app.config['UPLOAD_FOLDER'], filename))
        return 'File saved successfully'
    return 'No file uploaded'

Drag options to blanks, or click blank then click option'

Asecure_filename

Bfile

Cuploaded_file

Dfilename

Attempts:

3 left

💡 Hint

Common Mistakes

Not securing the filename before saving.

Using the wrong file input name.

Not importing the correct function.

The secure_filename function is imported and used to secure the filename. The file input field name is 'file'.

Practice

1. What is the main purpose of using secure_filename in Flask when handling file uploads?

easy

A. To clean the filename and remove unsafe characters

B. To compress the uploaded file

C. To encrypt the file contents

D. To rename the file to a random string

Solution

1. Step 1: Understand the role of secure_filename

   This function cleans the filename by removing or replacing unsafe characters that could cause security issues.

2. Step 2: Differentiate from other file handling tasks

   It does not compress, encrypt, or randomly rename files; it only sanitizes the filename.

3. Final Answer:

   To clean the filename and remove unsafe characters -> Option A

4. Quick Check:

   Purpose of secure_filename = clean filename [OK]

Hint: Remember: secure_filename cleans names, not file content [OK]

Common Mistakes:

• Thinking it encrypts or compresses files
• Assuming it renames files randomly
• Confusing filename cleaning with file content processing

2. Which of the following is the correct way to import secure_filename in a Flask app?

easy

A. from flask import secure_filename

B. from werkzeug.utils import secure_filename

C. import secure_filename from flask

D. import werkzeug.secure_filename

Solution

1. Step 1: Identify the correct module for secure_filename

   The function secure_filename is provided by werkzeug.utils, not directly by Flask.

2. Step 2: Check import syntax

   The correct syntax is from werkzeug.utils import secure_filename. Other options are either incorrect syntax or wrong modules.

3. Final Answer:

   from werkzeug.utils import secure_filename -> Option B

4. Quick Check:

   Import secure_filename = werkzeug.utils [OK]

Hint: Import secure_filename from werkzeug.utils, not flask [OK]

Common Mistakes:

• Importing directly from flask
• Using incorrect import syntax
• Trying to import as a module instead of function

3. What will be the output of the following code snippet?

from werkzeug.utils import secure_filename
filename = secure_filename('../../etc/passwd')

medium

A. 'passwd'

B. '.._.._etc_passwd'

C. 'etc_passwd'

D. '../../etc/passwd'

Solution

1. Step 1: Understand how secure_filename handles path traversal

   The function removes directory traversal parts like '../' and replaces unsafe characters with underscores.

2. Step 2: Apply to '../../etc/passwd'

   The '../' parts are removed and slashes replaced by underscores, resulting in 'etc_passwd'.

3. Final Answer:

   'etc_passwd' -> Option C

4. Quick Check:

   secure_filename('../../etc/passwd') = 'etc_passwd' [OK]

Hint: secure_filename removes ../ and replaces slashes with underscores [OK]

Common Mistakes:

• Expecting original path to remain
• Thinking it returns only the basename
• Assuming it keeps dots or slashes

4. Identify the error in this Flask file upload snippet:

from werkzeug.utils import secure_filename

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = secure_filename(file.filename)
    file.save('/uploads/' + filename)
    return 'File saved'

medium

A. Missing import of request from flask

B. Using insecure filename without cleaning

C. Saving file without checking if upload folder exists

D. Incorrect HTTP method for file upload

Solution

1. Step 1: Check imports

   The code uses request.files but does not import request from Flask, causing a NameError.

2. Step 2: Verify other parts

   The filename is cleaned with secure_filename, the method POST is correct, and folder existence is not checked but not an error here.

3. Final Answer:

   Missing import of request from flask -> Option A

4. Quick Check:

   request must be imported for request.files [OK]

Hint: Always import request when accessing request.files [OK]

Common Mistakes:

• Forgetting to import request
• Assuming folder existence is automatically handled
• Confusing HTTP methods for uploads

5. You want to save uploaded files securely in Flask, ensuring filenames are safe and files are saved inside a folder named 'uploads' inside your project. Which code snippet correctly handles this, assuming file is from request.files?

from werkzeug.utils import secure_filename
import os

UPLOAD_FOLDER = os.path.join(os.getcwd(), 'uploads')

# Which snippet below is correct?

A) filename = secure_filename(file.filename)
   file.save(os.path.join(UPLOAD_FOLDER, filename))

B) filename = file.filename
   file.save(os.path.join(UPLOAD_FOLDER, filename))

C) filename = secure_filename(file.filename)
   file.save('/uploads/' + filename)

D) filename = secure_filename(file.filename)
   file.save(os.path.join('/uploads', filename))

hard

A. Use secure_filename but join with absolute string '/uploads' ignoring project path

B. Use raw filename without cleaning and os.path.join with absolute path

C. Use secure_filename but save with hardcoded relative path string

D. Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path

Solution

1. Step 1: Check filename safety

   Snippets using secure_filename correctly clean the filename (eliminate the snippet using raw file.filename).

2. Step 2: Check file save path correctness

   The correct snippet uses os.path.join(UPLOAD_FOLDER, filename) with the defined UPLOAD_FOLDER that points inside the project 'uploads' folder. The remaining snippets use hardcoded paths like '/uploads/' + filename or os.path.join('/uploads', filename), which may not save inside the project folder.

3. Final Answer:

   Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path -> Option D

4. Quick Check:

   Safe filename + correct absolute path = Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path [OK]

Hint: Always combine secure_filename with os.path.join and absolute folder path [OK]

Common Mistakes:

• Saving files with unsafe raw filenames
• Using hardcoded paths that may not exist
• Ignoring project directory structure