SecureMidSecurityAuto-graded

Keep user paths from escaping the base directory

Reveals whether file access is genuinely confined to one folder, or merely filtered for the tricks someone thought of.safe_path.py is the helper behind serving a user-requested file out of one fixed directory — an uploads folder, a static root, a per-tenant data directory. The base is trusted, from your config; the user path is attacker-controlled. safe_join is supposed to combine them and return a path only if the result stays inside the base. Instead it concatenates strings and checks for a literal substring, which several standard tricks walk straight past.

25 min

python

Start lab

You're done when

An absolute user path is rejected rather than replacing the base entirely.
Traversal attempts that escape the base are rejected.

What it measures

Application securityUnderstanding how path traversal actually works, including the absolute-path and sibling-prefix variants that beat a substring check.

Security and privacy designValidating containment after resolution rather than pattern-matching on the input string.

Fixing without breakingKeeping every legitimate path working while closing the escape, across more than one base directory.

Your environment

Terminal + editorA full shell in the browser

Claude CodePre-authenticated, no key setup

Isolated microVMYours alone, wiped afterwards

Start this lab

25 min

Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.

AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo