Secure filename handling in Flask - Step-by-Step Execution

Concept Flow - Secure filename handling

User uploads file

↓

Extract filename

↓

Sanitize filename

↓

Save file with safe name

↓

Return success or error

This flow shows how Flask handles uploaded filenames safely by cleaning them before saving.

Execution Sample

Flask

from flask import Flask, request
from werkzeug.utils import secure_filename

filename = secure_filename(request.files['file'].filename)

This code extracts and cleans the uploaded file's name to make it safe for saving.

Execution Table

Step	Action	Input Filename	Sanitized Filename	Reason
1	Receive file upload	my photo.png		User uploads a file with spaces
2	Call secure_filename()	my photo.png	my_photo.png	Spaces replaced with underscores
3	Check for unsafe chars	my_photo.png	my_photo.png	No unsafe chars found
4	Return sanitized filename		my_photo.png	Ready to save safely
5	Save file	my_photo.png		File saved with safe name
6	End			Process complete

💡 Filename sanitized and saved safely, preventing path traversal or injection

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
filename	my photo.png	my_photo.png	my_photo.png	my_photo.png

Key Moments - 2 Insights

Why does secure_filename replace spaces with underscores?

Because spaces can cause issues in file paths or URLs, secure_filename replaces them with underscores to keep filenames safe and consistent, as shown in step 2 of the execution_table.

What happens if the filename contains '../' to try path traversal?

secure_filename removes dangerous parts like '../' to prevent saving files outside the intended folder, ensuring security as implied in step 3 where unsafe characters are checked and removed.

Visual Quiz - 3 Questions

Look at the execution_table, what is the sanitized filename after step 2?

A my-photo.png

B my photo.png

C my_photo.png

D myphoto.png

💡 Hint

Check the 'Sanitized Filename' column in row with Step 2

At which step does the function ensure no unsafe characters remain?

A Step 3

B Step 1

C Step 2

D Step 5

💡 Hint

Look at the 'Reason' column for step 3 in execution_table

If the original filename was '../../secret.txt', what would secure_filename likely return?

A secret_txt

B secret.txt

C ../../secret.txt

D secret.txt.txt

💡 Hint

secure_filename removes path traversal parts as explained in key_moments and step 3

Concept Snapshot

Use werkzeug.utils.secure_filename(filename) to clean filenames.
It replaces spaces with underscores and removes unsafe characters.
Prevents path traversal attacks by stripping dangerous parts.
Always sanitize filenames before saving uploaded files.
Ensures files save safely in your server folder.

Full Transcript

When a user uploads a file in Flask, the filename might contain spaces or unsafe characters. Using secure_filename from werkzeug.utils cleans the filename by replacing spaces with underscores and removing dangerous parts like '../'. This prevents security risks such as path traversal. The cleaned filename is then safe to use when saving the file on the server. This process ensures your app handles file uploads securely and avoids overwriting or accessing unintended files.

Practice

1. What is the main purpose of using secure_filename in Flask when handling file uploads?

easy

A. To clean the filename and remove unsafe characters

B. To compress the uploaded file

C. To encrypt the file contents

D. To rename the file to a random string

Solution

1. Step 1: Understand the role of secure_filename

   This function cleans the filename by removing or replacing unsafe characters that could cause security issues.

2. Step 2: Differentiate from other file handling tasks

   It does not compress, encrypt, or randomly rename files; it only sanitizes the filename.

3. Final Answer:

   To clean the filename and remove unsafe characters -> Option A

4. Quick Check:

   Purpose of secure_filename = clean filename [OK]

Hint: Remember: secure_filename cleans names, not file content [OK]

Common Mistakes:

• Thinking it encrypts or compresses files
• Assuming it renames files randomly
• Confusing filename cleaning with file content processing

2. Which of the following is the correct way to import secure_filename in a Flask app?

easy

A. from flask import secure_filename

B. from werkzeug.utils import secure_filename

C. import secure_filename from flask

D. import werkzeug.secure_filename

Solution

1. Step 1: Identify the correct module for secure_filename

   The function secure_filename is provided by werkzeug.utils, not directly by Flask.

2. Step 2: Check import syntax

   The correct syntax is from werkzeug.utils import secure_filename. Other options are either incorrect syntax or wrong modules.

3. Final Answer:

   from werkzeug.utils import secure_filename -> Option B

4. Quick Check:

   Import secure_filename = werkzeug.utils [OK]

Hint: Import secure_filename from werkzeug.utils, not flask [OK]

Common Mistakes:

• Importing directly from flask
• Using incorrect import syntax
• Trying to import as a module instead of function

3. What will be the output of the following code snippet?

from werkzeug.utils import secure_filename
filename = secure_filename('../../etc/passwd')

medium

A. 'passwd'

B. '.._.._etc_passwd'

C. 'etc_passwd'

D. '../../etc/passwd'

Solution

1. Step 1: Understand how secure_filename handles path traversal

   The function removes directory traversal parts like '../' and replaces unsafe characters with underscores.

2. Step 2: Apply to '../../etc/passwd'

   The '../' parts are removed and slashes replaced by underscores, resulting in 'etc_passwd'.

3. Final Answer:

   'etc_passwd' -> Option C

4. Quick Check:

   secure_filename('../../etc/passwd') = 'etc_passwd' [OK]

Hint: secure_filename removes ../ and replaces slashes with underscores [OK]

Common Mistakes:

• Expecting original path to remain
• Thinking it returns only the basename
• Assuming it keeps dots or slashes

4. Identify the error in this Flask file upload snippet:

from werkzeug.utils import secure_filename

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = secure_filename(file.filename)
    file.save('/uploads/' + filename)
    return 'File saved'

medium

A. Missing import of request from flask

B. Using insecure filename without cleaning

C. Saving file without checking if upload folder exists

D. Incorrect HTTP method for file upload

Solution

1. Step 1: Check imports

   The code uses request.files but does not import request from Flask, causing a NameError.

2. Step 2: Verify other parts

   The filename is cleaned with secure_filename, the method POST is correct, and folder existence is not checked but not an error here.

3. Final Answer:

   Missing import of request from flask -> Option A

4. Quick Check:

   request must be imported for request.files [OK]

Hint: Always import request when accessing request.files [OK]

Common Mistakes:

• Forgetting to import request
• Assuming folder existence is automatically handled
• Confusing HTTP methods for uploads

5. You want to save uploaded files securely in Flask, ensuring filenames are safe and files are saved inside a folder named 'uploads' inside your project. Which code snippet correctly handles this, assuming file is from request.files?

from werkzeug.utils import secure_filename
import os

UPLOAD_FOLDER = os.path.join(os.getcwd(), 'uploads')

# Which snippet below is correct?

A) filename = secure_filename(file.filename)
   file.save(os.path.join(UPLOAD_FOLDER, filename))

B) filename = file.filename
   file.save(os.path.join(UPLOAD_FOLDER, filename))

C) filename = secure_filename(file.filename)
   file.save('/uploads/' + filename)

D) filename = secure_filename(file.filename)
   file.save(os.path.join('/uploads', filename))

hard

A. Use secure_filename but join with absolute string '/uploads' ignoring project path

B. Use raw filename without cleaning and os.path.join with absolute path

C. Use secure_filename but save with hardcoded relative path string

D. Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path

Solution

1. Step 1: Check filename safety

   Snippets using secure_filename correctly clean the filename (eliminate the snippet using raw file.filename).

2. Step 2: Check file save path correctness

   The correct snippet uses os.path.join(UPLOAD_FOLDER, filename) with the defined UPLOAD_FOLDER that points inside the project 'uploads' folder. The remaining snippets use hardcoded paths like '/uploads/' + filename or os.path.join('/uploads', filename), which may not save inside the project folder.

3. Final Answer:

   Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path -> Option D

4. Quick Check:

   Safe filename + correct absolute path = Use secure_filename and os.path.join with absolute UPLOAD_FOLDER path [OK]

Hint: Always combine secure_filename with os.path.join and absolute folder path [OK]

Common Mistakes:

• Saving files with unsafe raw filenames
• Using hardcoded paths that may not exist
• Ignoring project directory structure