Programming PHP

HTTP or FTP URL as a filename, and the document identified by the URL will be
opened. Here’s some exploitable code:
If $username is set to "http://www.example.com/myfile", a remote file is opened, not a
local one.
The situation is even more dire if you let the user tell you which file to include( ):
If the user passes a theme parameter of "http://www.example.com/badcode.inc" and
your variables_order includes GET or POST, your PHP script will happily load and
run the remote code. Never use parameters as filenames like this.
There are several solutions to the problem of checking filenames.You can disable
remote file access, check filenames with realpath( ) and basename( ), and use the
open_basedir option to restrict filesystem access.
Check for Relative Paths
When you need to allow the user to specify a filename in your application, you can
use a combination of the realpath( ) and basename( ) functions to ensure that the
filename is what it ought to be.The realpath( ) function resolves special markers
such as “.” and “..”. After a call to realpath( ), the resulting path is a full path on
which you can then use basename( ).The basename( ) function returns just the filename
portion of the path.
Going back to our welcome message scenario, here’s an example of realpath( ) and
basename( ) in action:
$filename = $_POST['username'];
$vetted = basename(realpath($filename));
if ($filename !== $vetted) {
die("$filename is not a good username");
}
In this case, we’ve resolved $filename to its full path and then extracted just the filename.If
this value doesn’t match the original value of $filename, we’ve got a bad filename
that we don’t want to use.
Once you have the completely bare filename, you can reconstruct what the file path
ought to be, based on where legal files should go, and add a file extension based on
the actual contents of the file:
include("/usr/local/lib/greetings/$filename");
288 | Chapter 12: Security
This is the Title of the Book, eMatter Edition
Copyright © 2002 O’Reilly & Associates, Inc. All rights reserved.