Question

在这篇文章Preventing Directory Traversal in PHP but allowing paths的指导下，我试图阻止目录遍历，但我遇到了一些奇怪的事情，在第一个实例中，realpath返回一条好路径

        $fPath = $path.$parent.'/'.$name;
//$name (the user input) in this sample is "fff", $parent is an empty string        

        //make sure user didn't try to traverse backwards on the basepath           
        $basepath = $path;
        $realBase = realpath($basepath);
echo $realBase."<br/>";
//gives: /Users/me/Documents/www/gallery/php_sample/uploadedImages

        $userpath = $fPath;
echo $userpath."<br/>";
//gives: /Users/me/Documents/www/gallery/php_sample/uploadedImages/fff

        $realUserPath = realpath($userpath);
echo $realUserPath."<br/>";
//gives blank (an empty string).

为什么会有什么问题？

Answer 1

就像AbraCadaver在评论中所说的那样，“这只适用于目录存在。要验证/消毒用户提供的目录，你需要一些规则并清理或拒绝它。”

php realpath（）返回一个空字符串

1 个答案: