|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2006-12-18 08:46 UTC] djcapelis at gmail dot com
Description:
------------
file_exists() silently truncates anything after a null byte in a string. This produces unexpected results in some circumstances and possibly would result in security problems for limited amounts of poorly written code.
include_once() for instance, provides the following:
"ALERT - Include filename truncated by a \0 after '/etc/passwd' (attacker 'REMOTE_ADDR not set', file '/home/djc/test.php', line 13)"
This seems like a sane way to handle it if truncating has to be done... though frankly since truncation will *always* produce the wrong result it might be nice to throw an error and stop processing.
Reproduce code:
---------------
<?php
$filename = "/etc/passwd^@" . ".someextension";
if (file_exists($filename))
{
echo "The file " . $filename . "exists";
}
else
{
echo "The file " . $filename . "does not exist";
}
?>
Expected result:
----------------
Expected:
$ php -n test.php
The file /etc/passwd.\0someextension does not exist
Actual result:
--------------
Actual:
$ php -n test.php
The file /etc/passwd.someextension exists
Patchesbug39863.phpt (last revision 2010-05-12 11:23 UTC by vanderaj at owasp dot org)Pull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Sat Nov 23 05:01:32 2024 UTC |
I've tested this on CentOS 5.0 with a hand built 5.2.11 and Apple's build of PHP 5.3.1 on MacOS X 10.6.3, and both have this issue. If you don't want to run a phpt, here's some a more readable version of the previous test: <?php $filename = "/etc/passwd" . chr(0). ".ridiculous"; if (file_exists($filename)) { echo "FAIL: The file [" . $filename . "] exists, but clearly shouldn't.\n"; } else { echo "PASS: The file [" . $filename . "] does not exist.\n"; } ?> I've included a PHP test script. It's my first phpt, so please be gentle.