REGEX to stop directory traversal

Question

I am trying to create a Regular Expression for validation to stop directory traversal attacks. I want the user to be able to specify anything within the C:\temp directory. So the below is fine

c:\temp\hello\world.txt

but obviously, the directory below would be unacceptable.

c:\temp\..\Windows\world.txt

My issue is that I am unsure how I can allow one period (.) but not two in a row. I need one obviously for extensions i.e. (world.txt) but can not have two. This is what I have so far:

^([c]:\\)\\?(temp)([^(\.\.)]){0,200}$

So I am trying to say not two periods [^\.\.] and the \\? part is because it accepts escaped directories as well. Thanks in advance.

I am not too sure how else to go about validating a directory. It is an aspx application with C# codebehind. I am open to a better way if there is one. — meowcat, Nov 08 '17 at 02:44
https://stackoverflow.com/questions/401304/how-does-one-extract-each-folder-name-from-a-path — Jonathon Reinhart, Nov 08 '17 at 02:45
This is not a new problem. It is highly likely that there is existing code that has been written, tested and debugged that solves your problem for you. Find that code. — Andy Lester, Nov 08 '17 at 03:17

score 4 · Accepted Answer · answered Nov 08 '17 at 05:10

4

You may try with this:

^(c:\\)\\?(temp)(?!.*\.\.).{0,200}$

Here I have modified your regex a bit to ensure that there is no consecutive dots.

(?!.*\.\.) This negative look ahead starts scanning right after c:\temp part is found. Itd will scan till the end of string and if it returns true (which means no consecutive dots) then the following part takes action.
.{0,200} the dot here matches any character from 0 to 200 times

Regex Demo

answered Nov 08 '17 at 05:10

Mustofa Rizwan

10,215
2
28
43

1

Thanks, to all who replied, I am looking at alternative methods, but have marked Rizwan's answer as correct... as it was the only actual answer and the regular expression works :). – meowcat Nov 09 '17 at 02:23

REGEX to stop directory traversal

1 Answers1