@@ -15,22 +15,22 @@ |
||
15 | 15 | class PathChecker |
16 | 16 | { |
17 | 17 | |
18 | - /** |
|
19 | - * Check absolute file path to prevent attacks. |
|
20 | - * |
|
21 | - * - Prevents non printable characters |
|
22 | - * - Prevents stream wrappers |
|
23 | - * - Prevents directory traversal |
|
24 | - * |
|
25 | - * Preventing non printable characters is especially done to prevent the NUL character, which can be used |
|
26 | - * to bypass other tests. See https://st-g.de/2011/04/doing-filename-checks-securely-in-PHP. |
|
27 | - * |
|
28 | - * Preventeng stream wrappers is especially done to protect against Phar Deserialization. |
|
29 | - * See https://blog.ripstech.com/2018/new-php-exploitation-technique/ |
|
30 | - * |
|
31 | - * @param string $absFilePath |
|
32 | - * @return void |
|
33 | - */ |
|
18 | + /** |
|
19 | + * Check absolute file path to prevent attacks. |
|
20 | + * |
|
21 | + * - Prevents non printable characters |
|
22 | + * - Prevents stream wrappers |
|
23 | + * - Prevents directory traversal |
|
24 | + * |
|
25 | + * Preventing non printable characters is especially done to prevent the NUL character, which can be used |
|
26 | + * to bypass other tests. See https://st-g.de/2011/04/doing-filename-checks-securely-in-PHP. |
|
27 | + * |
|
28 | + * Preventeng stream wrappers is especially done to protect against Phar Deserialization. |
|
29 | + * See https://blog.ripstech.com/2018/new-php-exploitation-technique/ |
|
30 | + * |
|
31 | + * @param string $absFilePath |
|
32 | + * @return void |
|
33 | + */ |
|
34 | 34 | public static function checkAbsolutePath($absFilePath, $text = 'file') |
35 | 35 | { |
36 | 36 | if (empty($absFilePath)) { |