Path Equivalence: 'filename.' (Trailing Dot)

Many operating systems, particularly Windows, treat a trailing dot in a path as functionally equivalent to the same path without the dot. For example, 'secret.txt.' might resolve to 'secret.txt'. This happens because the file system APIs often normalize the path by stripping the trailing dot before processing it. However, security checks—like those verifying file extensions or path permissions—might be performed before this normalization, or might treat 'file.txt' and 'file.txt.' as different strings. This creates a mismatch where the security logic sees one path, but the underlying system accesses another. As a developer, you can prevent this by consistently normalizing and canonicalizing all file paths before using them in any security-critical operations. Always use the same system APIs for both validation and the final file access. Never rely on simple string comparison for path validation. Implement strict allow-lists for permitted file extensions and directories, and ensure your validation logic accounts for all possible operating system path equivalencies.