File access from user input
Why it matters
Sequences such as ../ let a request escape the intended folder and read configuration files, keys or source code.
readfile('/var/files/' . $_GET['file']);$base = realpath('/var/files');
$path = realpath($base . '/' . basename($_GET['file'] ?? ''));
if ($path === false || !str_starts_with($path, $base . '/')) {
http_response_code(404);
exit;
}
readfile($path);How to fix
Use basename() and a fixed directory, then confirm with realpath() that the file stays inside it.
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.