title: Flask - Do I need to use secure_filename() on uploads to S3/Google Cloud?
body: <p>In the Flask documentation for <a href="https://flask.palletsprojects.com/en/1.1.x/patterns/fileuploads/" rel="nofollow noreferrer">file uploads</a>, they recommend use of <code>secure_filename()</code> to sanitize a file's name before storing it.</p>
  
  <p>Here's their example:</p>
  
  <pre><code>uploaded_file = request.files['file']
  if uploaded_file:
      filename = secure_filename(uploaded_file.filename) # &lt;&lt;&lt;&lt; note the use of secure_filename() here
      file.save(os.path.join(app.config['UPLOAD_FOLDER'], filename))
      return redirect(url_for('display_file',
                              filename=filename))
  </code></pre>
  
  <p>The documentation says:</p>
  
  <blockquote>
    <p>Now the problem is that there is that principle called <strong>“never trust user
    input”</strong>. This is also true for the filename of an uploaded file. All
    submitted form data can be forged, and filenames can be dangerous. For
    the moment just remember: <strong>always use that function to secure a
    filename before storing it directly on the filesystem.</strong></p>
  </blockquote>
  
  <p>With offsite storage (S3 or Google Cloud), I will not be using Flask to store the file on the web server. Instead, I'll rename the upload file (with my own UUID), and then upload it elsewhere.</p>
  
  <p>Example:</p>
  
  <pre><code>blob = bucket.blob('prompts/{filename}'.format(filename=uuid.uui4()))
  blob.upload_from_string(uploaded_file.read(), content_type=uploaded_file.content_type)
  </code></pre>
  
  <p>Under this scenario, am I right that you do you <strong><em>not</em></strong> need to invoke <code>secure_filename()</code> first?</p>
  
  <p>It would seem that because I (a) read the contents of the file into a string and then (b) use my own filename, that my use case is not vulnerable to directory traversal or rogue command-type attacks (e.g. <code>"../../../../home/username/.bashrc"</code>) but I'm not 100% sure.</p>