path-boundary-comparison

name	path-boundary-comparison
description	How to perform root-path containment checks without weakening security on case-sensitive filesystems
domain	security
confidence	medium
source	earned

Context

Use this when code must verify that a computed file path stays inside a trusted root directory. This commonly appears in cache stores, download helpers, extraction code, and any path traversal defense.

Patterns

• Normalize both the candidate path and the root with Path.GetFullPath(...) before comparing.
• Preserve the root directory boundary explicitly by trimming trailing separators from the root and then adding exactly one Path.DirectorySeparatorChar for child-path checks.
• Compare security boundaries with StringComparison.Ordinal, not ignore-case comparisons. Case folding can make a sibling path appear to be under the trusted root on case-sensitive filesystems.
• Allow the exact root path as a special case in addition to child paths.
• Add a regression test for a sibling path that differs only by casing (for example root vs ROOT) so the security fix stays pinned if someone later reintroduces ignore-case comparisons.

Examples

var fullPath = Path.GetFullPath(path);
var fullRoot = Path.GetFullPath(root);
var rootWithoutSeparator = Path.TrimEndingDirectorySeparator(fullRoot);
var rootedPrefix = rootWithoutSeparator + Path.DirectorySeparatorChar;

if (!fullPath.StartsWith(rootedPrefix, StringComparison.Ordinal) &&
    !string.Equals(fullPath, rootWithoutSeparator, StringComparison.Ordinal))
{
    throw new ArgumentException("Resolved path escapes the trusted root.");
}

Anti-Patterns

• Using StartsWith(..., StringComparison.OrdinalIgnoreCase) for a security boundary check.
• Comparing against a root string without enforcing a separator boundary, which can make /tmp/root2 look like it is inside /tmp/root.
• Comparing raw user input paths before canonicalizing them with Path.GetFullPath(...).