Question

I’m using this code on top of my PHP file for loading cached files and I’m worried whether it’s secure enough:

//quick! load from cache if exists!
if (is_file('cache/'.($cachefile=basename('/',$_GET['f']))))
{
    header('content-type: text/css');
    require('cache/'.$cachefile);
    die(); //ALL OK, loaded from cache
}

EDIT: I would also like to know if it isn’t, how is it exploitable and how to rewrite it in safe manner.

EDIT 2: I edited code, from previous code, I don’t know how I could thought that is_file will filter bad paths >.<

EDIT 3: Changed it again, so it uses basename() instead of end(explode()) and also changed inclusion from repeating the code into assigning the value into variable during first comparison (or file check).

I never just include($_GET), but today, I somehow thought is_file will filter out paths, that may harm my system. I don’t know how.

Thank you

Answer 1

I could send $_GET['f'] = '../../database_passwords.xml' …

Use basename to eliminate anything but the last segment of the passed path. Alternatively, construct the path, then compute the absolute path that corresponds and check if it’s still within cache/.