Re: NSString, stringByAppendingPathComponent, and Canonicalization
Re: NSString, stringByAppendingPathComponent, and Canonicalization
- Subject: Re: NSString, stringByAppendingPathComponent, and Canonicalization
- From: "Stephen J. Butler" <email@hidden>
- Date: Mon, 04 Apr 2011 22:19:07 -0500
On Mon, Apr 4, 2011 at 10:08 PM, Jeffrey Walton <email@hidden> wrote:
> I need to accept a filename from the user. Given the user supplied
> filename, I form a fully qualified name:
>
> NSString* pathName = [NSHomeDirectory(),
> stringByAppendingPathComponent:@"Documents"];
> NSString* fullPathName = [pathName  stringByAppendingPathComponent:filename];
First, you should be getting the path to the documents folder via
NSSearchPathForDirectoriesInDomains():
<http://developer.apple.com/library/ios/documentation/Cocoa/Conceptual/LowLevelFileMgmt/Articles/StandardDirectories.html#//apple_ref/doc/uid/20001279-SW5>
> How do I canonicalize the the resulting fullPathName to verify there
> was no directory traversal goodness in the filename? In case its
> relevant, the platform is iOS.
I can't remember if there's a Cocoa version, but the standard Unix way
to do this is realpath (man realpath). Make sure to use -[NSString
fileSystemRepresentation] to get the char* version.
But I'm not sure directory traversals are a huge concern in iOS.
Everything is so sandboxed anyway...
_______________________________________________
Cocoa-dev mailing list (email@hidden)
Please do not post admin requests or moderator comments to the list.
Contact the moderators at cocoa-dev-admins(at)lists.apple.com
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden