title: Does my code prevent directory traversal?
body: <p>Is the following code snippet from a Python WSGI app safe from directory traversal? It reads a file name passed as parameter and returns the named file.</p>
  
  <pre><code>file_name = request.path_params["file"]
  file = open(file_name, "rb")
  mime_type = mimetypes.guess_type(file_name)[0]
  start_response(status.OK, [('Content-Type', mime_type)])
  return file
  </code></pre>
  
  <p>I mounted the app under <code>http://localhost:8000/file/{file}</code> and sent requests with the URLs <code>http://localhost:8000/file/../alarm.gif</code> and <code>http://localhost:8000/file/%2e%2e%2falarm.gif</code>. But none of my attempts delivered the (existing) file. So is my code already safe from directory traversal?</p>
  
  <p><strong>New approach</strong></p>
  
  <p>It seems like the following code prevents directory traversal:</p>
  
  <pre><code>file_name = request.path_params["file"]
  absolute_path = os.path.join(self.base_directory, file_name)
  normalized_path = os.path.normpath(absolute_path)
  
  # security check to prevent directory traversal
  if not normalized_path.startswith(self.base_directory):
      raise IOError()
  
  file = open(normalized_path, "rb")
  mime_type = mimetypes.guess_type(normalized_path)[0]
  start_response(status.OK, [('Content-Type', mime_type)])
  return file
  </code></pre>