Serving uploaded files in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this Flask route when serving an uploaded file?

Consider this Flask route that serves a file from the 'uploads' folder. What will the browser receive when accessing '/files/example.txt'?

Flask

from flask import Flask, send_from_directory
app = Flask(__name__)

@app.route('/files/<filename>')
def serve_file(filename):
    return send_from_directory('uploads', filename)

# Assume 'uploads/example.txt' exists with content 'Hello Flask!'

A A 500 Internal Server Error due to missing 'filename' parameter

B A 404 Not Found error because 'send_from_directory' cannot find the file

C The browser downloads or displays the content of 'example.txt' with text 'Hello Flask!'

D The browser receives a JSON response with file metadata

💡 Hint

Remember that send_from_directory serves files from a folder relative to the app root.

send_from_directory serves the requested file if it exists in the specified folder. Since 'example.txt' exists in 'uploads', the file content is sent to the browser.

📝 Syntax

intermediate

Which option correctly serves an uploaded image file in Flask?

You want to serve an image file named 'photo.png' stored in the 'uploads' folder. Which Flask route code is correct?

A

@app.route('/image/<filename>')
def image(filename):
    return send_from_directory('uploads', filename, mimetype='image/png')

B

@app.route('/image/<filename>')
def image(filename):
    return send_from_directory('uploads', filename)

C

@app.route('/image/<filename>')
def image(filename):
    return send_file('uploads/' + filename)

D

@app.route('/image/<filename>')
def image(filename):
    return open('uploads/' + filename).read()

💡 Hint

Use Flask's built-in functions to serve files safely.

send_from_directory safely serves files from a folder. send_file needs a full path and is less safe here. Reading file content directly returns raw bytes without headers.

🔧 Debug

advanced

Why does this Flask route raise a FileNotFoundError when serving uploaded files?

Examine the code below. Why does accessing '/uploads/myfile.txt' cause a FileNotFoundError even though the file exists?

Flask

from flask import Flask, send_from_directory
app = Flask(__name__)

@app.route('/uploads/<path:filename>')
def uploaded_file(filename):
    return send_from_directory('uploads', filename)

# The 'uploads' folder is inside the project directory, not at root '/'

A Because '/uploads' is an absolute path pointing to root, but the folder is relative to the project directory

B Because 'send_from_directory' cannot serve files with 'path' converter in route

C Because the filename parameter is missing in the route

D Because Flask requires files to be served only from 'static' folder

💡 Hint

Check the folder path passed to send_from_directory carefully.

Using '/uploads' as an absolute path points to the root directory, which likely does not contain the uploads folder. The correct path should be relative or absolute to the project folder.

❓ state_output

advanced

What is the response status code when serving a non-existent uploaded file?

Given this Flask route, what status code will the client receive if the requested file does not exist?

Flask

from flask import Flask, send_from_directory
app = Flask(__name__)

@app.route('/files/<filename>')
def serve_file(filename):
    return send_from_directory('uploads', filename)

# 'uploads/missing.txt' does not exist

A 403 Forbidden

B 500 Internal Server Error

C 200 OK with empty content

D 404 Not Found

💡 Hint

Think about what Flask does when a file is missing in send_from_directory.

send_from_directory raises a NotFound exception if the file is missing, which Flask converts to a 404 response.

🧠 Conceptual

expert

Which approach best prevents directory traversal attacks when serving uploaded files in Flask?

You want to serve user-uploaded files safely. Which method best prevents users from accessing files outside the 'uploads' folder?

A Use send_from_directory with a fixed folder path and a filename parameter without any path separators

B Use open() with the filename directly concatenated to the uploads folder path

C Use send_file with a full path constructed by joining uploads folder and filename without validation

D Use os.system to call 'cat' on the filename inside uploads folder

💡 Hint

Consider how Flask's send_from_directory handles path traversal attempts.

send_from_directory safely resolves the filename inside the folder and prevents directory traversal. Directly opening or concatenating paths without checks can allow attackers to access files outside the folder.