note 84799 deleted from function.preg-replace by cmb
| From: | cmb@php.net | Date: | Sun, 29 Sep 2019 07:26:43 +0000 |
| Subject: | note 84799 deleted from function.preg-replace by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-212394@lists.php.net to get a copy of this message | ||
Note Submitter: Anonymous
----
People using functions like scandir with user input and protecting against "../" by using
preg_replace make sure you run ir recursivly untill preg_match no-long finds it, because if you
don't the following can happen.
If a user gives the path:
"./....//....//....//....//....//....//....//"
then your script detects every "../" and removes them leaving:
"./../../../../../../../"
Which is proberly going back enough times to show root.
I just found this vunrability in an old script of mine, which was written several years ago.
Always do:
<?php
while( preg_match( [expression], $input ) )
{
$input = preg_replace( [expression], "", $input );
}
?>