What is the best way to combine a path and a filename in C#/.NET?

Question

What is the best way to combine a path with a filename?

That is, given c:\foo and bar.txt, I want c:\foo\bar.txt.

Given c:\foo and ..\bar.txt, I want either an error or c:\foo\bar.txt (so I cannot use Path.Combine() directly). Similarly for c:\foo and bar/baz.txt, I want an error or c:\foo\baz.txt (not c:\foo\bar\baz.txt).

I realize, I could check that the filename does not contain '\' or '/', but is that enough? If not, what is the correct check?

Solution 1

If you want "bad" filenames to generate an error:

if (Path.GetFileName(fileName) != fileName)
{
    throw new Exception("'fileName' is invalid!");
}
string combined = Path.Combine(dir, fileName);

Or, if you just want to silently correct "bad" filenames without throwing an exception:

string combined = Path.Combine(dir, Path.GetFileName(fileName));

Solution 2

You could use:

Path.Combine(folder, Path.GetFileName(fileName))

or, to skip out the \ (not tested, maybe the Path.GetFileName handles this automatically)

Path.Combine(folder, Path.GetFileName(fileName.Replace("/","\\")))

Solution 3

Be aware that when you use Path.Combine(arg1, arg2) - if your user inputs a fully-qualified file path for arg2 it will disregard arg1, and use arg2 as the path.

In my opinion, Microsoft screwed up there! This can leave you wide open with the user hacking your entire filesystem. Be warned, read the fine print! If you're combining paths use: var newPath = path1 + @"\" + path2; simpler and no unexpected results...

Comments

[Rasmus Faber]

Thanks! Just FYI: the Replace is not necessary.

[Robert Gowland]

For those less familiar with the framework, you need a using System.IO; call in your file to get access to Path.

[Aaron Blenkush]

Note that Path.Combine will throw an ArgumentNullException if either of its arguments are null. You can pass an empty string to either argument

[ConditionRacer]

Note: Path.Combine will normally add a separator between each path if needed. However, Path.Combine("C:", "file.txt"), returns "C:file.txt", which is not a valid path.

[Raquel]

A full path on the right side being returned as the result of combining relative paths is a correct and valid result.

[Cyassin]

Regardless on if its a correct and valid result, too many devs are missing the fact that if in their code arg1 is a folder path and arg2 is user input, an absolute path inputed arg2 will be the resulting output. Makes it too easy to open up to in my opinion the worst of web app hacks..code/shell injection...Check your input guys.

[jinzai]

In my opinion, any developer that thinks it is okay to allow a user to type paths in with no checking whatsoever -- deserves to be hacked. This is Day One stuff and Path.Combine is not designed to work the way you think it should -- it is a decent and robust way to avoid having to check for the terminal backslash, which is actually intended for internal use by your code, not as a front end to secure your files. The documentation for it is quite complete -- just read it.

[Florian Winter]

Note that this will still allow fileName to be .. and result in something like C:\path\to\... Tested here: dotnetfiddle.net/DoeH8K. Depending on use case, you may also want to validate that fileName is a valid filename (and not a "special filename" like .. and maybe nul, con, ...).