Skip to content

Resolving a download path

Security · Difficulty 2/5 · Python · 19 linesOrigin: Fictional

Task

What the AI was asked to do

Write a helper for our file download endpoint: take the file name from the request and return its full path inside the uploads folder, or None if the name is empty or points outside that folder.

Handoff note

What the AI wrote when it handed over the code:

“Path traversal is blocked: the path is resolved with realpath and checked against the uploads root, so ../ tricks, symlinks and absolute paths are rejected.”

The code the AI wrote

Python19 lines

Mark the lines you think are wrong; give each mark a severity and a one-sentence reason.

Click or tap a line. With a keyboard, move to the line and press Enter.

0 of 5 marks
How to pick a severity
  • CriticalData loss, a security hole or lost money
  • MajorThe user gets a wrong result in a case the task asks for
  • MinorA rare edge case outside the task, or readability

In the Testing topic, severity is set by the effect of the broken implementation the test doesn't catch.

Your reason isn't graded; you'll compare it with a sample answer.

import os
2
UPLOAD_ROOT = os.path.realpath("uploads")
4
5
def resolve_upload(name: str, root: str = UPLOAD_ROOT) -> str | None:
    """Return the absolute path for a requested upload.
8
    Returns None when the name is empty or points outside the upload root.
    """
    if not name or "\x00" in name:
        return None
13
    root = os.path.realpath(root)
    candidate = os.path.realpath(os.path.join(root, name))
    if not candidate.startswith(root):
        return None
18
    return candidate

The test that proves it

The right option is the test that fails on this code, which means it exposes the bug.

Test options
Mark at least one line to submit.

Submitting sends seven pieces of information to a counter; your reason text stays on your device. Data