Deleting files based on input to avoid accessing parent folders

Question

I am doing a REST API in Java (although this question may apply to other languages) where I create several local files and directories, and they can be deleted based on input. I manage my files in a certain directory, then append the request subpath.

So, if user sends a request DELETE /data { path: "user23/mobile" }, then I would delete files under "/opt/my-app/user-data/user23/mobile/". However, It is easy to see that if the input was something like ".." I would start deleting files from other users, or even system files.

Is there a way to securize the path construction, and make sure the given String does not have access previous folders?

Thanks in advance.

Get the canonical path, and check if it starts with your "base path" that you don't want the user to be able to go above. geeksforgeeks.org/java/… — C3roe
– C3roe, Commented Jul 10 at 8:18
The user running the application should be restricted to only the necessary permissions for the required folders. Additionally, user inputs should be properly sanitized to prevent path traversal vulnerabilities. — seenukarthi
– seenukarthi, Commented Jul 10 at 8:45
@C3roe The getCanonicalPath() path is only useful for the old File API. For detecting path-traversal attacks in new nio file API you should use normalize() see e.g. heise.de/en/background/… — Robert
– Robert, Commented Jul 10 at 13:38

Hoang Vinh · Accepted Answer · 2025-07-11 02:58:03Z

0

You

Try following these steps and see if it fixes the problem.

Always normalize paths using Path.normalize()
Validate the resolved path stays within your base directory
Use allowlists for characters rather than blocklists
Consider using UUIDs or database IDs instead of user-provided paths
Log security violations for monitoring
Never trust user input - always validate server-side

answered Jul 11 at 2:58

Hoang Vinh

3281 gold badge3 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Deleting files based on input to avoid accessing parent folders

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related