Hardcoded Absolute Path

ID

python.hardcoded_absolute_path

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Python

Tags

portability, reliability

Description

Reports string literals that look like a hardcoded absolute filesystem path — Unix paths starting with /etc, /var, /home, /opt, /tmp, …​ or Windows paths starting with C:\Users, C:\Program Files, C:\Windows. Such literals tie the program to a single environment and break portability between developer machines, CI, and production.

config_path = "/etc/myapp/config.yml"      # FLAW
cache_dir = "C:\\Users\\Admin\\cache"      # FLAW

config_path = os.environ["MYAPP_CONFIG"]   # OK
cache_dir = Path.home() / ".cache" / "myapp"  # OK

Rationale

Absolute paths in source are silent assumptions about the deployment environment. They survive code review because the line that contains them looks fine in isolation; the problem only surfaces when the code runs somewhere with a different layout.

Remediation

Use a configuration value, an environment variable, or a platform-aware helper:

import os
from pathlib import Path

config_path = Path(os.environ["MYAPP_CONFIG"])
cache_dir = Path.home() / ".cache" / "myapp"
tmp_dir = Path(tempfile.gettempdir()) / "myapp"

References