Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:108663
MIME-Version: 1.0
References: <CAFv4g+Ecztuzf_WZXzJ=PNK2R8nSND2mB9eWrR4Z7+5OaVb+hg@mail.gmail.com>
In-Reply-To: <CAFv4g+Ecztuzf_WZXzJ=PNK2R8nSND2mB9eWrR4Z7+5OaVb+hg@mail.gmail.com>
Reply-To: bishop@php.net
Date: Wed, 19 Feb 2020 00:22:50 -0500
Message-ID: <CAEYWF=74Atwth0yX5dxR3ZJypVaG1xeYZHz6eV6LoS7gBLkeVg@mail.gmail.com>
To: Craig Francis <craig@craigfrancis.co.uk>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000e75d9a059ee6fc86"
Subject: Re: [PHP-DEV] $_FILES['name'] check
From: bishop@php.net (Bishop Bettini)

--000000000000e75d9a059ee6fc86
Content-Type: text/plain; charset="UTF-8"

On Sun, Feb 16, 2020 at 6:24 PM Craig Francis <craig@craigfrancis.co.uk>
wrote:

> Just to check, at the moment, if I was an evil hacker, and was to run:
>
> curl -F 'file=@example.jpg;filename=../../../example.php'
> https://example.com/upload/
>
> The $_FILES['file']['name'] would be set to "example.php", where PHP has
> removed the leading "../../../" (good to see).
>
> Does that happen simply because of this IE fix, where it uses _basename()
> in the PHP source:
>
>
> https://github.com/php/php-src/blob/0b4778c377a5753a0deb9cfc697d4f62acf93a29/main/rfc1867.c#L1144


Mostly, it seems. _basename will either be php_ap_basename[1] or
php_mb_rfc1867_basename[2], and both of those handle the base name
functionality regardless of platform.

The comment's a little misleading, though. The original implementation[3]
had a magic quotes check when compiled under WIN32, and that's what the
comment's talking about. The comment's not saying that the basename call
itself is for Windows only.

[1]:
https://github.com/php/php-src/blob/0b4778c377a5753a0deb9cfc697d4f62acf93a29/main/rfc1867.c#L558
[2]:
https://github.com/php/php-src/blob/2e97ae91c8ac404be00050eef414b555aba45a1c/ext/mbstring/mbstring.c#L852
[3]:
https://github.com/php/php-src/blob/7ee1fdb657f2a6da65087552e6dda8cf2f4bd1ef/main/rfc1867.c#L1088

--000000000000e75d9a059ee6fc86--