C#: How to determine whether an relative path points outside an given path.

Question

I have the following scenario (C#, WinForms). I have some kind of project file which is saved in some directory. The project file contains a reference to another file. This reference is relative from the place where the project file is saved.

Sample: The project file is saved under c:\projects\project.xyz. The other file is referenced as "\someotherdir\file.abc".

This works fine, but there may be the case someone tried to manipulate that relative path to something like "..\Windows\System32\file.abc". So there's a need to check whether the relative path points outside the path where the project is saved (it's a defined requirement, that all referenced files are inside the project path).

How to detect this scenario?

Thanks, Michael

Answer 1

Not very pretty but I think it should work.

if (System.IO.Path.GetFullPath(path).IndexOf(projectPath, StringComparison.CurrentCultureIgnoreCase) == -1)
{
  // naughty
}

Edited to be a good global citizen.

Answer 2

You could try using the following extension method:

public static bool IsChildOf(this string path, string parentPath)
{
    return Path.GetFullPath(path).StartsWith(Path.GetFullPath(parentPath),
           StringComparison.InvariantCultureIgnoreCase);
}

Answer 3

Windows has posix symlinks: ln -s c:\windows\system32\mshtml.dll c:\projects\project.xyz\innocent.txt. When your program opens c:\projects\project.xyz\innocent.txt you get c:\windows\system32\mshtml.dll. Does System.IO.Path.GetFullPath() work here?

POSIX also supports hardlinks. A file can have zero (when deleted), one, two, ten, one hundred filenames. And all are "The Filename", none more correct or less correct than any other.

Windows supports mounting folders into folders. Again, all names are correct.

You can solve this with filesystem permissions: Create a new user for your application. Give that user permissions to your project path. Do not give that user (or Everyone, or any groups the user is a member of) privileges to anything else in any filesystem. Let Microsoft's kernel team solve your problem for you.