@@ -15,22 +15,22 @@ |
||
| 15 | 15 | class PathChecker |
| 16 | 16 | { |
| 17 | 17 | |
| 18 | - /** |
|
| 19 | - * Check absolute file path to prevent attacks. |
|
| 20 | - * |
|
| 21 | - * - Prevents non printable characters |
|
| 22 | - * - Prevents stream wrappers |
|
| 23 | - * - Prevents directory traversal |
|
| 24 | - * |
|
| 25 | - * Preventing non printable characters is especially done to prevent the NUL character, which can be used |
|
| 26 | - * to bypass other tests. See https://st-g.de/2011/04/doing-filename-checks-securely-in-PHP. |
|
| 27 | - * |
|
| 28 | - * Preventeng stream wrappers is especially done to protect against Phar Deserialization. |
|
| 29 | - * See https://blog.ripstech.com/2018/new-php-exploitation-technique/ |
|
| 30 | - * |
|
| 31 | - * @param string $absFilePath |
|
| 32 | - * @return void |
|
| 33 | - */ |
|
| 18 | + /** |
|
| 19 | + * Check absolute file path to prevent attacks. |
|
| 20 | + * |
|
| 21 | + * - Prevents non printable characters |
|
| 22 | + * - Prevents stream wrappers |
|
| 23 | + * - Prevents directory traversal |
|
| 24 | + * |
|
| 25 | + * Preventing non printable characters is especially done to prevent the NUL character, which can be used |
|
| 26 | + * to bypass other tests. See https://st-g.de/2011/04/doing-filename-checks-securely-in-PHP. |
|
| 27 | + * |
|
| 28 | + * Preventeng stream wrappers is especially done to protect against Phar Deserialization. |
|
| 29 | + * See https://blog.ripstech.com/2018/new-php-exploitation-technique/ |
|
| 30 | + * |
|
| 31 | + * @param string $absFilePath |
|
| 32 | + * @return void |
|
| 33 | + */ |
|
| 34 | 34 | public static function checkAbsolutePath($absFilePath, $text = 'file') |
| 35 | 35 | { |
| 36 | 36 | if (empty($absFilePath)) { |