Handle Files and Paths Safely in Python with pathlib

A practical approach

Step 1

Build paths from a known base, such as Path(__file__).parent for files next to your code or a configured data directory, rather than relying on the current working directory.

Step 2

Join with the / operator: base / "reports" / f"{date}.md".

Step 3

Always pass an encoding when reading or writing text, usually encoding="utf-8".

Step 4

Create directories with mkdir(parents=True, exist_ok=True) before writing into them.

Step 5

When a path comes from user input, resolve it and check it stays inside the allowed directory before opening it.

Worked example

A report script works when run from its own folder but fails with FileNotFoundError when scheduled from a different directory, because it opens 'templates/report.md' relative to the working directory. Changing it to Path(__file__).parent / "templates" / "report.md" makes the script work from anywhere, and the same change fixes Windows path separators for a teammate.

A mistake to avoid

Do not build file paths by concatenating user input, for example base + '/' + filename. A value such as '../../etc/passwd' can escape the intended folder. Resolve the final path and confirm it is relative to your base directory.

Try it yourself

Convert one script that uses os.path and string paths to pathlib. Run it from a different working directory and on another operating system if you can, and confirm it still finds its files.

Your implementation checklist

• Paths are built from a known base directory
• Paths are joined with Path objects, not strings
• Text files are read and written with an explicit encoding
• Output directories are created before writing
• User-supplied paths are confined to an allowed folder