1Z0-829 Java I/O API and Securing Applications Practice Question
A web application allows users to specify filenames for uploaded documents. The application saves files to a directory using the provided name. Which secure programming practice should be applied to prevent path traversal attacks?
⚠ Common exam trap
Candidates often choose Option C (string replacement) because it seems straightforward, but they overlook that simple blacklisting of `..` and `/` is trivially bypassed by double-encoding, nested patterns, or Unicode normalization, whereas canonical path resolution is the only robust defense against path traversal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use File.getCanonicalPath() to resolve the path and check it starts with the intended directory.
`File.getCanonicalPath()` resolves all symbolic links, `.` and `..` sequences, and platform-specific path conventions to produce an absolute, unique path. By then verifying that this canonical path starts with the intended base directory (e.g., `/var/uploads/`), the application can definitively reject any path that escapes outside the allowed directory, even if the user-supplied filename contains encoded or obfuscated traversal sequences.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Validate that the filename contains only alphanumeric characters.
Why it's wrong here
Too restrictive; legitimate filenames may contain other characters.
- ✗
Generate a random UUID for each file, ignoring the user-provided filename.
Why it's wrong here
While generating a random UUID is safe, it does not validate the user's input path; the question asks about validating the provided name.
- ✗
Replace all occurrences of ".." and "/" with an empty string.
Why it's wrong here
Blacklisting is easily bypassed (e.g., using "....//").
- ✓
Use File.getCanonicalPath() to resolve the path and check it starts with the intended directory.
Why this is correct
By resolving the canonical path, the application can verify that the file lies within the allowed directory.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 1Z0-829 question from scratch — 513 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 1Z0-829 practice question is part of Courseiva's free Oracle certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 1Z0-829 exam.