Practice/Microsoft/Design a path validation system

Design a path validation system

Object Oriented DesignMust

Problem

Design and implement a secure path validation system that can verify whether file system paths or URL paths meet specific security and format requirements. Your system should protect against common security vulnerabilities like path traversal attacks while enforcing configurable rules about path depth, file extensions, and other criteria.

The validator should accept a path string and a set of validation rules, then return whether the path is considered valid according to those rules.

Requirements

1. Implement a function that validates paths based on configurable rules
2. Support validation of both file system paths and URL paths
3. Detect and block path traversal attempts (e.g., .. sequences) when enabled
4. Enforce maximum path depth limits (number of directory levels)
5. Validate file extensions against an allowed list when specified
6. Handle edge cases like empty paths, malformed URLs, and special characters
7. Return a boolean indicating whether the path passes all validation checks

Constraints

• Path length: 1 ≤ length ≤ 1000 characters
• Maximum depth: 1 ≤ max_depth ≤ 100
• Allowed extensions list: 0 ≤ size ≤ 20
• Rules dictionary will always contain the keys: max_depth, allowed_extensions, and block_traversal
• Time complexity should be O(n) where n is the path length
• Space complexity should be O(n) for parsing the path

Examples

Example 1:

Input: path = "/home/user/documents/report.pdf" rules = \{"max_depth": 5, "allowed_extensions": [".pdf", ".docx"], "block_traversal": true\} Output: true Explanation: The path has 4 levels (home, user, documents, report.pdf), which is within the limit of 5. The extension .pdf is in the allowed list, and there are no traversal patterns.

Example 2:

Input: path = "/var/www/../../../etc/shadow" rules = \{"max_depth": 10, "allowed_extensions": [], "block_traversal": true\} Output: false Explanation: The path contains ".." sequences indicating a path traversal attempt. Since block_traversal is true, this path is invalid.

Example 3:

Input: path = "https://api.example.com/v1/users" rules = \{"max_depth": 3, "allowed_extensions": [], "block_traversal": false\} Output: false Explanation: The URL path has 4 segments (v1/users plus the domain and protocol), exceeding the max_depth of 3.

Example 4:

Input: path = "/data/output.csv" rules = \{"max_depth": 5, "allowed_extensions": [".txt", ".json"], "block_traversal": true\} Output: false Explanation: The file extension .csv is not in the allowed extensions list.