Path class for files and streams

If you use a file to work, you may need to use the file path and directory path. The path information is saved with a common string, which can cause some column problems, such as headaches and small troubles, serious security vulnerabilities, and so on.

The system. Io. Path class can be used here. It provides several static auxiliary methods for executing common path processing tasks. For example, the path. Combine () method can use a complete directory path with any file name in that directory, as shown below:

Directoryinfo dirinfo =   New Directoryinfo ( @" C: \ upload \ Documents ents " );
String File =   " Test.txt " ;
String Path = Path. Combine (dirinfo. fullname, file );

 

To prevent security risks such as standardization errors, you can use the path class. Normalization error is a special type of application.ProgramError, it will be in yourCodeIt is assumed that the value provided by the user always complies with the standard format. A low-level technology when a standardization error occurs, but it is very serious once it occurs. They usually cause users to execute an action that should have been limited.

When a famous normalization error occurs, SQL Injection fool your application to execute the modified SQL command by submitting an incorrect format value. Other normalization errors may occur in the path and URL.

For example, consider the following method, which returns file data from a fixed document directory:

Fileinfo File =   New Fileinfo (server. mappath ( " Documents \\ "   + Txtbox. Text ));
// (Read the file and display it in another control ).

 

This code looks simple. It connects the file name provided by the user with the path document to allow the user to obtain the data of any file in the directory. The problem is that the file name may appear in multiple formats. In addition to submitting a valid file name, attackers can provide a valid file name, such as .. \ filename. The connected path webapp \ Documents \ .. \ filename will get the file from the parent directory of the document (webapp. Similarly, you can specify any file name of the drive where the web application is located. Because Web services are restricted only by ASP. NET working processes, users may be allowed to download sensitive server files.

Code repair is actually very simple. Use the path class again. This time, use the getfilename () method to obtain the final file name of the string:

String Filename = Path. getfilename (filename );
Fileinfo File =   New Fileinfo (server. mappath (path. Combine ( " Documents " , Txtbox. Text )));

 

This ensures that the user can only access the correct directory. If you want to process the URL, you can use the system. url type to achieve a unified magic operation. For example, the following code demonstrates how to remove a query string parameter from a URL to determine that it points to a given server and virtual directory:

String Uristring =   " Http://www.wrongsite.com/page.aspx? Cmd = run " ;
Uri URI =   New Uri (uristring );
String Page = Path. getfilename (URI. absolutepath );
// Page is now just "Page. aspx"
Uri baseuri =   New Uri ( " Http://www.rightsite.com " );
Uri =   New Uri (baseuri, page );
// Uri now stores the path Http://www.rightsite.com/page.aspx.

 

Although the path class has a method to extend down from the directory structure (add sub-directories to the path), it does not provide any returned method (remove sub-directories from the path ). However, you can use the relative path in the combine () method to break this restriction. The relative path indicates "the directory moves up a layer ". In addition, you can call getfullpath () to return the returned results in the normal format.

The following is an example:

String Path =   @" C: \ temp \ subdir " ;
Path = Path. Combine (path, " .. " );
// PATH now contains the string "C: \ temp \ subdir \.."
Path = Path. getfullpath (PATH );
// PATH now contains the string "C: \ Temp"