A value from the query string is text until you make it something else, and it can be any text at all. This set checks that you know why a blocklist loses to an allowlist, and that you can write the check that keeps a value inside the shape you meant.
Each one is marked as you go, and the explanation arrives straight after, which is
the part worth reading.
4 questions, marked as you go.
Tasks
These need your own device. Run the command in Termux, then paste what it printed.
The marking looks at what the output means, so spacing, version numbers and
ordering do not matter. If you have not installed anything yet, the
lesson covers the setup.
Let an allowlist refuse the hostile filenames
This feeds five filenames through a single allowlist: the first character must be a letter or a digit, and the rest may be letters, digits, dots, dashes or underscores. Run it and paste the filenames that survive.
Run this in Termux
On your own device. Nothing on this page executes it. The command runs in
your terminal, and this box only reads what you paste back.
Two filenames should come back, and neither of them is a traversal attempt.
a plain filename passes
a second plain filename passes
the traversal attempts were refused
the command actually ran
What a good answer looks like
Two lines, report.pdf and notes.txt. Everything else was refused. The plain ../secret and the bare .. were dropped, and so was the encoded a%2e%2e. The pattern allows dots after the first character, but it insists the first character is a letter or a digit, so a name that begins with a dot cannot pass. That single detail is what stops .. walking through an allowlist that looked reasonable at a glance.
Marking your own work
Both halves of this are checked in your browser, with no server involved, so nothing
stops you from pasting output you did not run. The tasks are written so that the
easiest way to pass one is to actually do it and read the result, which is the whole
intention.