Question

If a user was requesting a file on a service, I could normally protect them from accessing documents outside the scope of what I want by using PHP’s realpath() and ensuring it is under the root directory. Such as like this:

$path = realpath($_GET['path']);
// Protect against LFI vulnerabilities
if (substr($path, 0, strlen($root)) == $root)
{
    // safe
}

However, realpath() only works on files that already exist.
What if I want to ensure that the location the user is about to have my script write to is under the root?

I can’t use realpath(), should I just check and strip out ‘..’ references?
Or is there a better way?

Answer 1

How about checking if realpath(dirname($file)) is under the root directory?

$dir = $path;
$found = false;

while ($dir) {
    $dir = dirname($dir);
    if (!is_dir($dir)) {
        continue;
    }

    if (strpos(realpath($dir), $root) === 0) {
        $found = true;
    }

    break;
}

var_dump($found);