Practice · 2 of 4
Confine the Path
FileLoader.Read(baseDir, userPath) serves files by combining
baseDir with whatever the request carries — ../../secrets.txt escapes the
sandbox. Write Solution.SafeResolve(string baseDir, string userPath)
returning the fully-resolved path **or null when it escapes baseDir**:
``csharp
public static class Solution
{
public static string SafeResolve(string baseDir, string userPath);
}
`
Rules:
- resolve with Path.GetFullPath(Path.Combine(...)), then require the result
to stay under the resolved base directory (GetFullPath(baseDir) +
separator),
- plain names and nested subpaths ("reports/2026.csv", "a/../b.txt" as
long as the result stays inside) are allowed and returned fully resolved,
- any escape — leading /, drive root, .. past the top — returns null,
- userPath that resolves exactly to baseDir itself is null` (only files
under it are served).
Back to lesson: Practice: Security Practice: Barriers at the Boundary