如何实现无硬编码路径的Web API文件读取服务？

I need to create a Web API where users can enter a URL like http://localhost:12345/api/filereader/data.txt to view the content of data.txt. I can implement this if I know the physical file path, but I have a requirement: the code must not specify a hardcoded physical path. Instead, users should be able to input a .txt filename via URL parameters, and the API should read the target file regardless of which computer/server it's deployed on.

Is this requirement achievable? Here's my current code with a hardcoded path:

// ReaderController.cs
[ResponseType(typeof(string))]
public IHttpActionResult Get(String FileName)
{
    try
    {
        string fileName = FileName;
        string path = "C:\\Users\\attsuap1\\Desktop\\" + fileName;
        string result = File.ReadAllText(path);
        var resultDTO = JsonConvert.DeserializeObject(result);
        return Ok(resultDTO);
    }
    catch
    {
        var result = "File does not exist";
        return Ok(new { ErrorMessage = result });
    }
}

Absolutely, this is achievable—but we need to prioritize two critical goals: flexibility across different environments and security to block malicious path abuse. Here's how to refactor your code properly:

Step 1: Store the Root Directory in Configuration #

Instead of hardcoding the path, save your target file root directory in a configuration file. This lets you update the path for any server/computer without modifying code.

• For .NET Framework (using web.config):
  Add this to the <appSettings> section:

  <add key="FileStorageRoot" value="C:\Users\attsuap1\Desktop\" />
  

• For .NET Core/.NET 5+ (using appsettings.json):
  Add this to your config:

  "FileStorageRoot": "C:\\Users\\attsuap1\\Desktop\\"
  

Step 2: Add Strict Input Validation & Security Checks #

Never trust raw user input! We need to:

• Ensure the requested file has a .txt extension.
• Block path traversal attempts (e.g., ../../../../system/secrets.txt).
• Confirm the final file path stays within our allowed root directory.

Step 3: Refactor the Controller Method #

Here's the updated, secure, and flexible version of your code:

using System.IO;
using System.Web.Configuration; // Use IConfiguration for .NET Core
using Newtonsoft.Json;

// ReaderController.cs
[ResponseType(typeof(string))]
public IHttpActionResult Get(string fileName)
{
    try
    {
        // 1. Pull root path from configuration
        string rootPath = WebConfigurationManager.AppSettings["FileStorageRoot"];
        // For .NET Core: Inject IConfiguration via constructor, then use _configuration["FileStorageRoot"]

        // 2. Validate input
        if (string.IsNullOrWhiteSpace(fileName))
        {
            return BadRequest("File name cannot be empty.");
        }
        if (!fileName.EndsWith(".txt", StringComparison.OrdinalIgnoreCase))
        {
            return BadRequest("Only .txt files are allowed.");
        }

        // 3. Build safe file path and verify it's within the root directory
        string fullPath = Path.Combine(rootPath, fileName);
        fullPath = Path.GetFullPath(fullPath); // Resolve any relative paths

        if (!fullPath.StartsWith(Path.GetFullPath(rootPath), StringComparison.OrdinalIgnoreCase))
        {
            return BadRequest("Invalid file path request.");
        }

        // 4. Read and return content
        if (!File.Exists(fullPath))
        {
            return Ok(new { ErrorMessage = "File does not exist" });
        }

        string fileContent = File.ReadAllText(fullPath);
        var resultDTO = JsonConvert.DeserializeObject(fileContent);
        return Ok(resultDTO);
    }
    catch (Exception ex)
    {
        // Log the exception internally (use tools like Serilog/NLog)
        return Ok(new { ErrorMessage = "An error occurred while reading the file." });
    }
}

Key Best Practices #

• Security is Non-Negotiable: The path validation step stops attackers from accessing files outside your intended directory (like system files).
• Environment Agnostic: Using configuration means you can set unique root paths for development, staging, and production servers.
• Robust Error Handling: I updated the catch block to avoid exposing sensitive error details to users—always log exceptions for debugging instead.
• Permissions: Make sure the application pool/user running your API has read access to the configured root directory.

内容的提问来源于stack exchange，提问作者Susha Naidu