cybersecurity · intermediate · ~15 min

Allowlist a safe argument

Allowlist instead of blocklist for command arguments.

Challenge

Accept a filename-like command argument only if every character is on a known-good list — allowlisting fails closed where blocklisting misses new tricks.

Task

Implement int is_safe_arg(const char *s) that returns 1 if s is non-empty and made up only of allowed characters, else 0.

Allowed characters: letters, digits, ., -, _, /.

Input

  • s: a NUL-terminated candidate argument the grader passes.

Output

Returns int: 1 if s is non-empty and every character is allowed, else 0.

Example

is_safe_arg("/var/log/app.log")   ->   1
is_safe_arg("")                    ->   0   (empty)
is_safe_arg("a;b")                 ->   0   (metacharacter)

Edge cases

  • The empty string is rejected.
  • Any character outside the allowed set rejects the whole argument.

Input format

A NUL-terminated candidate argument s.

Output format

An int: 1 if s is non-empty and only allowed characters, else 0.

Constraints

Allowed: letters, digits, ., -, _, /; empty is invalid.

Starter code

int is_safe_arg(const char *s) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.