Is using os.path.abspath to verify the reliable location of an untrusted file name?

Question

I do not think that I have something missing. Again, I'm kind of a beginner.

def GET(self, filename):
    name = urllib.unquote(filename)
    full = path.abspath(path.join(STATIC_PATH, filename))
    #Make sure request is not tricksy and tries to get out of
    #the directory, e.g. filename = "../.ssh/id_rsa". GET OUTTA HERE
    assert full[:len(STATIC_PATH)] == STATIC_PATH, "bad path"
    return open(full).read()

Edit: I understand that this will return the wrong HTTP error code if the file does not exist (at least under web.py). I will fix this.

Answer 1

os.path.abspath, , . assert , python -O, . STATIC_PATH , , - , STATIC_PATH /foo/bar, , /foo/barbie/ (, STATIC_PATH , ).

Answer 2

, - . - -, .

, , , , - , , . , ssh SSH . , su -ing.

Answer 3

Make sure that either STATIC_PATHends with the directory separator, or the character that follows it in fullis.