Question

Hi
We have some php code using the file_get_contents() function, and I understand this is vulnerable to direcoty traversel attacks. Given the following code:

$mydata=$_GET['thefile'];
$data = file_get_contents ('/var/html'.$file);
echo $data

How can I do some simple input filtering so I can block the posibility that someone might do directory traversel by playing around with my input?

/MR

Answer 1

You want basename:

$mydata = basename(realpath($_GET['thefile']));

---

Appended to (slight modifications of) your example:

$file=$_GET['thefile']; 
$mypath='/var/www/';
$location= basename(realpath($mypath.$file));
$data = file_get_contents($location);
echo $data;

Note… although this does some level of error checking, it does no error handling. I’ll leave that up to you.