FilesExpand file tree

main

/

request-path-to-filesystem.php

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

78 lines (63 loc) · 2.6 KB

main

/

request-path-to-filesystem.php

Copy path

Top

File metadata and controls

• Code
• Blame

78 lines (63 loc) · 2.6 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

<?php

use Utopia\Http\Http;

class RequestPathFixture

{

public function action(string $path, Response $response): void

{

// ruleid: php.appwrite.request-path-to-filesystem

$contents = file_get_contents(APP_STORAGE_UPLOADS . '/' . $path);

// ruleid: php.appwrite.request-path-to-filesystem

\unlink(APP_STORAGE_UPLOADS . '/' . $path);

// ok: php.appwrite.request-path-to-filesystem

$safe = file_get_contents(APP_STORAGE_UPLOADS . '/' . \basename($path));

}

}

class RealpathFixture

{

public function action(string $name, Request $request, Response $response): void

{

$base = \realpath(APP_STORAGE_UPLOADS);

// ruleid: php.appwrite.request-path-to-filesystem

$contents = file_get_contents(realpath($base . '/' . $request->getParam('path')));

$unchecked = \realpath($base . '/' . $name);

// ruleid: php.appwrite.request-path-to-filesystem

$response->send(\file_get_contents($unchecked));

$warned = \realpath($base . '/' . $name);

if (!\str_starts_with($warned, $base . '/')) {

Console::warning('Path outside base');

}

// ruleid: php.appwrite.request-path-to-filesystem

\unlink($warned);

$real = \realpath($base . '/' . $name);

if (!\str_starts_with($real, $base . '/')) {

throw new Exception(Exception::GENERAL_UNAUTHORIZED_SCOPE);

}

// ok: php.appwrite.request-path-to-filesystem

$response->send(\file_get_contents($real));

$absolute = \realpath($base . '/' . $request->getParam('file', ''));

if (\substr($absolute, 0, \strlen($base)) !== $base) {

throw new Exception(Exception::GENERAL_UNAUTHORIZED_SCOPE);

}

// ok: php.appwrite.request-path-to-filesystem

\readfile($absolute);

$inside = \realpath($base . '/' . $name);

if (\str_starts_with($inside, $base . '/')) {

// ok: php.appwrite.request-path-to-filesystem

\unlink($inside);

}

}

}

Http::get('/v1/things/:file')

->action(function (string $file, Request $request) {

// ruleid: php.appwrite.request-path-to-filesystem

include __DIR__ . '/views/' . $file;

$name = $request->getParam('name', '');

// ruleid: php.appwrite.request-path-to-filesystem

unlink('/tmp/' . $name);

// ok: php.appwrite.request-path-to-filesystem

readfile(__DIR__ . '/views/index.html');

});

foreach (Config::getParam('services', []) as $service) {

// ok: php.appwrite.request-path-to-filesystem

include_once $service['controller'];

}