Securely enforcing user-inputted file paths within subdirectories

Question

I know the solid security recommendation of avoiding accepting user input that you then use to choose a path to read/write a file. However, assuming you have a base directory you want to keep within (such as the root of an ftp folder), how do you best ensure that a given user input keeps us within that folder?

For instance,

Path.Combine(_myRootFolder, _myUserInput)

could still take us outside of _myRootFolder. And this could also be dodgy

newPath = Path.Combine(_myRootFolder, _myUserInput) if (newPath.StartsWith(_myRootFolder)) ...

given something like "/back/to/myrootfolder/../../and/out/again" from the user. What are the strategies for this? Am I missing a blindingly obvious .NET method I can use?

Thanks!

Answer 1

You can parse input string and cut ../ with regex.

Answer 2

Well, in your example of an FTP server, you should set the users home-directory, and permissions appropriately, such that they can't navigate out of the folder. Any reason you can't do that?

Answer 3

Within ASP.NET applications you can use Server.MapPath(filename) which will throw an exception if the path generated goes outside of your application root.

If all you want is a safe file name and you just want all files in there it becomes simpler;

    FileInfo file = new FileInfo(
        Server.MapPath(
            Path.Combine(@"c:\example\mydir", filename)));

If you're outside of ASP.NET like you indicate then you could use Path.GetFullPath.

string potentalPath = Path.Combine(@"c:\myroot\", fileName);
if (Path.GetFullPath(potentialPath) ! = potentialPath)
    // Potential path transversal

Or you call Path.GetFullPath and then check the start of it matches the directory you want locked to.

Answer 4

I believe Path.FullPath will do what you need (I didn't test this though):

string newPath = Path.Combine(_myRootFolder, _myUserInput);
string newPath = Path.FullPath(newPath);
if (newPath.StartsWith(_myRootFolder)) ...