uploadPathContainsParentSegment function

bool uploadPathContainsParentSegment(String? path)

Returns true when path contains a .. path segment after normalising \ to /.

Used before http.MultipartFile.fromPath so partially trusted paths (for example from API JSON bound into FileUploadAction inputs) cannot traverse out of an intended directory when reading bytes from disk.

Implementation

bool uploadPathContainsParentSegment(String? path) {
  if (path == null || path.isEmpty) return false;
  final unified = path.replaceAll(r'\', '/');
  for (final segment in unified.split('/')) {
    if (segment == '..') return true;
  }
  return false;
}