Download · Glitcher University

File: reading_list.txt

CS201 Reading List
- Introduction to Algorithms
- The Pragmatic Programmer

Resolved on server to: /app/studentfiles/reading_list.txt

Objective Read a file that lives OUTSIDE the student documents folder.

💡 Show hint

The file parameter is joined onto a folder path. Climb out with ../ — e.g. file=../../tmp/secret/secret.txt, or file=../../etc/passwd.

FlawThe filename is used without sanitisation (path traversal). FixResolve the real path and confirm it stays inside the allowed folder; use os.path.basename + an allow-list.