05 — Defense Playbook: Input Validation & D3FEND

Primary Defense: Canonicalization

Resolve paths to their canonical form and validate:

from pathlib import Path

def safe_file_access(filename):
    base = Path('/var/www/uploads').resolve()
    target = (base / filename).resolve()

    if not str(target).startswith(str(base)):
        raise ValueError("Path traversal blocked")

    return open(target)

D3FEND Mitigations

• Restrict Input: Whitelist allowed files only
• Access Control: Run as least-privileged user
• File System: Chroot jails, containerization

Next: 06 Reasoning Walkthrough