Sanitize file path in PHP

Question

Greetings, I'm hoping to make my tiny program secure so that potential malicious users cannot view sensitive files on the server.

 $path = "/home/gsmcms/public_html/central/app/webroot/{$_GET['file']}";


 if(file_exists($path)) {
  echo file_get_contents($path);
 } else {
  header('HTTP/1.1 404 Not Found');
 }

Off the top of my head I know that input such as '../../../../../../etc/passwd' would be trouble, but wondering what other malcious inputs I should expect and how to prevent them.

Answer 1

Use basename rather than trying to anticipate all the insecure paths a user could provide.

Answer 2

realpath() will let you convert any path that may contain relative information into an absolute path...you can then ensure that path is under a certain subdirectory that you want to allow downloads from.

Answer 3

If you can, use a whitelist like an array of allowed files and check the input against that: if the file asked by the user isn't present in that list, deny the request.

Answer 4

There is an additional and significant security risk here. This script will inject the source of a file into the output stream without any server-side processing. This means that all your source code of any accessible files will be leaked to the internet.