Editing Canonicalization (section)

=== Filenames ===
Files in [[file system]]s may in most cases be accessed through multiple [[filename]]s.  For instance in [[Unix]]-like systems, the string "<code>/./</code>" can be replaced by "<code>/</code>".  In the [[C standard library]], the function <code>realpath()</code> performs this task.  Other operations performed by this function to canonicalize filenames are the handling of <code>/..</code> components referring to parent directories, simplification of sequences of multiple slashes, removal of trailing slashes, and the resolution of [[symbolic link]]s.

Canonicalization of filenames is important for computer security. For example, a web server may have a restriction that only files under the cgi directory <code>C:\inetpub\wwwroot\cgi-bin</code> may be executed. This rule is enforced by checking that the path starts with <code>C:\inetpub\wwwroot\cgi-bin\</code> and only then executing it.  While the file <code>C:\inetpub\wwwroot\cgi-bin\..\..\..\Windows\System32\cmd.exe</code> initially appears to be in the cgi directory, it exploits the <code>..</code> path specifier to traverse back up the directory hierarchy in an attempt to execute a file outside of <code>cgi-bin</code>. Permitting <code>cmd.exe</code> to execute would be an error caused by a failure to canonicalize the filename to the simplest representation, <code>C:\Windows\System32\cmd.exe</code>, and is called a [[directory traversal]] vulnerability.  With the path canonicalized, it is clear the file should not be executed.