Skip to content

Conversation

@Mwessc
Copy link

@Mwessc Mwessc commented Jun 14, 2025

This commit introduces a new Python utility function, secure_file_reader, located in src/secure_file_utils.py. This function demonstrates secure coding principles for reading files, including:

  • Robust input sanitization (stripping whitespace, checking for empty filenames).
  • Prohibition of dangerous characters and sequences (e.g., '../', absolute paths, null bytes).
  • Enforcement of allowed file extensions.
  • Path whitelisting by ensuring the resolved absolute path of a requested file is within a defined secure base directory.

The function is designed for simulation and educational purposes, showing how to build file handling logic with security in mind. It includes detailed comments explaining each security principle.

Comprehensive unit tests have been added in tests/test_secure_file_utils.py using the unittest framework. These tests cover various scenarios, including valid access, attempted exploits (path traversal, null byte injection, etc.), and handling of disallowed extensions.

A .gitignore file has also been added to exclude common Python cache files from the repository.

Description

Please provide a brief description of your addition or change.

Checklist

  • I've added the prompt in the correct section.
  • The prompt is helpful, concise, and clear.
  • I've double-checked the markdown formatting.

This commit introduces a new Python utility function, `secure_file_reader`,
located in `src/secure_file_utils.py`. This function demonstrates secure
coding principles for reading files, including:
- Robust input sanitization (stripping whitespace, checking for empty filenames).
- Prohibition of dangerous characters and sequences (e.g., '../', absolute paths, null bytes).
- Enforcement of allowed file extensions.
- Path whitelisting by ensuring the resolved absolute path of a requested file
  is within a defined secure base directory.

The function is designed for simulation and educational purposes, showing how
to build file handling logic with security in mind. It includes detailed
comments explaining each security principle.

Comprehensive unit tests have been added in `tests/test_secure_file_utils.py`
using the `unittest` framework. These tests cover various scenarios, including
valid access, attempted exploits (path traversal, null byte injection, etc.),
and handling of disallowed extensions.

A `.gitignore` file has also been added to exclude common Python cache files
from the repository.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant