此脚本是否容易受到shell命令绕过？

Question

I'm using this script to receive base 64 encoded images from an Android app. I was wondering if there's any way possible to bypass a PHP shell command inside a POST request and get it to work in the server, for example, sending the command shell encoded and a name like "shell.php", "shell.php%0delete0". According to the script, everything will be saved as .png, so I'd say it's safe, but maybe I'm wrong and the script is actually vulnerable to shell command uploads.

<?php 
header('charset=utf-8');

if($_SERVER['REQUEST_METHOD'] == 'POST') {
    if(isset($_POST['image']) && isset($_POST['name'])) {
        $image = $_POST['image'];
        $name = $_POST['name'];
        file_put_contents("/var/www/html/admigas/android/uploads/$name".strval(date('_Ym')).".png",base64_decode($image));
        echo "Success";
    } else {
        echo "Wrong params";
    }
} else {
    echo "Nothing to do";
}

?>

Answer 1

So, let's look at the code step-by-step. My comments are preceded by # :

<?php 
header('charset=utf-8');

if($_SERVER['REQUEST_METHOD'] == 'POST') {
    if(isset($_POST['image']) && isset($_POST['name'])) {
        # This is provided by the user:
        $image = $_POST['image'];
        # This is provided by the user:
        $name = $_POST['name'];
        # Where does $name come from? User input, of course!
        file_put_contents("/var/www/html/admigas/android/uploads/$name".strval(date('_Ym')).".png",base64_decode($image));
        echo "Success";
    } else {
        echo "Wrong params";
    }
} else {
    echo "Nothing to do";
}

Consequently, sending name=../../../../reverse-shell.php%00 with a base64-encoded payload will allow an attacker to upload an arbitrary file (in this case, PHP code), and probably execute it on the subsequent PHP request.

Solution (presented in diff format):

-           $name = $_POST['name'];
+           $name = preg_replace('#[^A-Za-z0-9\-_]#', '', $_POST['name']);

You definitely want to remove any non-URL-safe characters to prevent attacks. You may want to totally rethink your strategy, of course .