在PHP的fopen（）的文件名前加上“ http：//”是否足够安全，可以防止读取本地文件？

Question

I have a PHP script that accepts a file URL by GET and opens it with fopen.
Is this solution safe enough or is it a security breach?

$filename = $_GET['file'];
if( substr( $filename, 0, 7 ) !== 'http://' )
    $filename = 'http://'.$filename;

fopen( $filename, 'r' );
// etc...

This way you can't force a local path to the script to read from it.

Answer 1

That should work, but here are two more things to think about:

• Giving access to other servers. If your server is behind a firewall, someone could use this to fetch data from another server behind your firewall (or hit a service, etc.) using HTTP, FTP, etc.

• Recursive denial of service. Make sure that there's not a way for someone to give you the URL of the script itself to fetch in a way that makes a recursion loop.

Answer 2

Not exactly sure, but you might need to escape it also to be safe.

$filename=escapeshellarg ( $filename );

See: http://php.net/manual/en/function.escapeshellarg.php

Answer 3

It's sort of fragile, as the security depends on the http handler being registered. What if in a future version of PHP it will be removed or optional?

Here's the problem. This actually works (after a warning):

stream_wrapper_unregister('http');
file_get_contents('http://../../../../../etc/passwd');

Answer 4

另一个安全措施/选项是使用chroot() http://php.net/manual/en/function.chroot.php