PHP文件上传中未记录的清理

Question

When handling file uploads, according to the PHP official documentation , the file name should be sanitised against directory traversal and possibly other kinds of attacks:

// basename() may prevent filesystem traversal attacks;
// further validation/sanitation of the filename may be appropriate
$name = basename($_FILES["pictures"]["name"][$key]);

Despite this, I've found that by default, the file name is already sanitised when it arrives to the PHP script.

I have evidence that Apache receives the malicious file name: filename="../file.png", while the PHP script reads a sanitised name in the $_FILES variable instead.

Low-level dump of Apache input:

mod_dumpio: dumpio_in (data-HEAP):
--------------------------eb8b65b665870e02
Content-Disposition: form-data;
name="attachment";
filename="../file.png" ← [Malicious file name]
Content-Type: image/png

PHP script

echo $_FILES['attachment']['name']; ← [File name already sanitised: 'file.png']

I've found this behaviour in both Apache module and php-fpm, running PHP from 5.5 to 7.2, and I have to deduce that the PHP interpreter performs this sanitization before passing the variable to the script.

So, thanks PHP for doing sanitation for me without my knowledge and consent. However (and this is my question) since this feature, as far as I know is undocumented, I'd like to know the sanitisation criteria / regexp / algorithm, to ensure it meets my needs.

Answer 1

You want to look at rfc1867.c , this seems the part you refer to:

SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)

From the comment, it appears that basename() is used to get rid of spurious backslashes, which could actually be correct (I imagine perhaps " Hello\\ World.txt "?). But this is based on IE's behaviour and the comment states that it might be removed in the future.

So you can't rely on this "sanitization" to keep on being there.

...

    /* The \ check should technically be needed for win32 systems only where
     * it is a valid path separator. However, IE in all it's wisdom always sends
     * the full path of the file on the user's filesystem, which means that unless
     * the user does basename() they get a bogus file name. Until IE's user base drops
     * to nill or problem is fixed this code must remain enabled for all systems. */

    s = _basename(internal_encoding, filename TSRMLS_CC);
    if (!s) {
        s = filename;
    }