Class RelativeUploadPath

Sanitizes the client-supplied folder-relative path that accompanies folder uploads (the relativePath form field / X-Upload-Relative-Path header / chunk-complete body property). The value is attacker-controlled text: it is never used to address storage directly — uploads are stored by GUID — but it is persisted and later handed to application code that may combine it into destination paths, so every traversal vector is removed here, once, before the value enters the system.

Inheritance

object

RelativeUploadPath

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Namespace: CoreUpload.Security

Assembly: CoreUpload.dll

Syntax

public static class RelativeUploadPath

Fields

MaxLength

Maximum accepted raw length. Longer values are rejected outright.

Declaration

public const int MaxLength = 1024

Field Value

Type	Description
int

MaxSegments

Maximum number of path segments (folder depth + file name).

Declaration

public const int MaxSegments = 32

Field Value

Type	Description
int

Methods

Sanitize(string?)

Returns the sanitized relative path ('photos/2026/a.jpg'), or null when the input is missing, oversized, or carries no real folder structure after cleaning. Rules: separators normalized to '/', empty / '.' / '..' segments dropped, invalid file-name characters (plus ':') replaced with '_', and a result of fewer than two segments is treated as "no structure" — a bare file name adds nothing.

Declaration

public static string? Sanitize(string? raw)

Parameters

Type	Name	Description
string	raw

Returns

Type	Description
string