File Path Built From Request Data

Why it matters

"../../etc/passwd" is a valid file name to os.path.join, and it happily walks up out of your uploads folder. Stripping the directory part with secure_filename and checking the resolved path stays inside the base folder is a two-line fix that keeps the feature intact.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

@app.route('/download')
def download():
    return send_file(os.path.join(UPLOAD_DIR, request.args.get('name')))

The smallest fix

from pathlib import Path
from werkzeug.utils import secure_filename
base = Path(UPLOAD_DIR).resolve()
target = (base / secure_filename(name)).resolve()
if not target.is_relative_to(base):
    abort(400)
return send_file(target)

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

# Flask: send_from_directory(UPLOAD_DIR, name) does the containment
# check for you. Better still, store files under ids you generate, look
# the id up in the database and never accept a file name from the client.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Request the endpoint with a name containing "../" and confirm a 400.
2. Request a real file name and confirm it is served.

Further reading

• https://cwe.mitre.org/data/definitions/22.html