Do I need to sanitize input in file_exists?

Question

I can not find the link. I assume that the PHP file_exists function uses system calls in Linux and that they are safe for any line that does not contain the \0 character, but I would like to be sure.

Does anyone have (preferably non-anecdotal) information about this? Is it vulnerable to injection if I don't check the lines first?

Answer 1

It depends on what you are trying to protect against.

file_exists does not write to disk, which means that the worst thing that can happen is that someone gets some information about your file system or about the existence of files that you have. In practice, however, if you do something later with the same file that you previously verified with file_exists , such as include ing, you can perform more stringent checks.

I assume that you can pass arbitrary values, possibly derived from user input, into this function.
If so, it depends on why you really need to use file_exists in the first place. In general, for any file system function with which the user can pass values ​​directly, I would try to filter the string as much as possible. It is really just pedantic and safe, and in practice it may be unnecessary.

So, for example, if you only need to check for the presence of a file in one directory, you should probably strip all of the directory separators.
From personal experience, I only ever passed user input to a file_exists call to map to a controller file, in which case I would just delete any character of a non-character letter + underscore.

UPDATE: reading recently added comments, there are no special characters, since this is not done in the shell. Even \0 should be fine, at least on newer versions of PHP (I believe that the older ones will cut the line before \0 when sent to calls to the underlying file system).

Answer 2

I think you need it, because the user can enter something like:

../../../somewhere_else/some_file and access a file to which it does not have access.

I suggest you create an absolute file path regardless of your php code and just get the file name from the user base ()

or exclude any input containing ../ , for example:

 $escaped_input = str_replace("../","",$input);