Patched code sample

import os
from pathlib import Path

def read_file(filename):
    # SECURE: Validate file paths and restrict access
    
    # Define allowed directory
    ALLOWED_DIR = "/var/app/files"
    
    try:
        # Resolve paths to prevent traversal
        allowed_path = Path(ALLOWED_DIR).resolve()
        requested_path = Path(os.path.join(ALLOWED_DIR, filename)).resolve()
        
        # Ensure the requested path is within allowed directory
        if not str(requested_path).startswith(str(allowed_path)):
            raise ValueError("Path traversal attempt detected")
        
        # Additional security checks
        if not requested_path.exists():
            raise FileNotFoundError("File not found")
        
        if not requested_path.is_file():
            raise ValueError("Not a regular file")
        
        # Check file permissions
        if not os.access(requested_path, os.R_OK):
            raise PermissionError("File not readable")
        
        with open(requested_path, 'r', encoding='utf-8') as f:
            return f.read()
            
    except (ValueError, FileNotFoundError, PermissionError) as e:
        return f"Error: {str(e)}"

# Example of secure usage:
# content = read_file("document.txt")  # Safe file access
# content = read_file("data/report.txt")  # Within allowed directory