note 66359 added to function.preg-match

I want to make an important notice to everyone using preg_match to validate a file used for inclusion. If you use preg_match like so (like I have in the past): <?php if (preg_match("/(.*).txt$/", $_GET['file'])) { include($_GET['file']); } ?> Be sure to know that you can get around that security by using a null string terminator, like so: page.php?file=/etc/passwd%00.txt Quick explanation: strings end in a null string terminator which is what seperates strings (%00 is hex for the null string terminator character). What this does is effectively rule out everything after %00 and validate this string (if I understand correctly by the way preg_match handles this) leading in the inclusion of the servers' /etc/passwd file. One way to go around it is by doing something like this: <?php if (preg_match("/^[a-zA-Z0-9\/\-\_]+.txt$/", $file)) { include($_GET['file']); } ?> Which will check if (from the start) it consists of alphanumberic characters and can possibly contain a slash (subdirectories), underscore and a dash (used by some in filenames) and ends at the end of the string in ".txt". ---- Server IP: 194.109.193.119 Probable Submitter: 24.132.90.49 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.preg-match.php Edit -- http://master.php.net/note/edit/66359 Del: integrated -- http://master.php.net/note/delete/66359/integrated Del: useless -- http://master.php.net/note/delete/66359/useless Del: bad code -- http://master.php.net/note/delete/66359/bad+code Del: spam -- http://master.php.net/note/delete/66359/spam Del: non-english -- http://master.php.net/note/delete/66359/non-english Del: in docs -- http://master.php.net/note/delete/66359/in+docs Del: other reasons-- http://master.php.net/note/delete/66359 Reject -- http://master.php.net/note/reject/66359 Search -- http://master.php.net/manage/user-notes.php