note 66416 deleted from function.preg-match by bjori

Note Submitter: ---- I seem to have made two critical mistakes in my previous entry, to correct the problem I'm re-pasting my entry (I hope an admin can delete the other entry?): I want to make an important notice to everyone using preg_match to validate a file used for inclusion. If you use preg_match like so (like I have in the past): <?php if (preg_match("/(.*)\.txt$/", $_GET['file'])) { include($_GET['file']); } ?> Be sure to know that you can get around that security by using a null string terminator, like so: page.php?file=/etc/passwd%00.txt Quick explanation: strings end in a null string terminator which is what seperates strings (%00 is hex for the null string terminator character). What this does is effectively rule out everything after %00 and validate this string (if I understand correctly by the way preg_match handles this) leading in the inclusion of the servers' /etc/passwd file. One way to go around it is by doing something like this: <?php if (preg_match("/^[a-zA-Z0-9\/\-\_]+\.txt$/", $_GET['file'])) { include($_GET['file']); } ?> Which will check if (from the start) it consists of alphanumberic characters and can possibly contain a slash (subdirectories), underscore and a dash (used by some in filenames) and ends at the end of the string in ".txt".