How can a cracker get past through this regexp?

Question

I recently had a chat with a cracker and he told me that he can get past uri regexp checking.

I'm checking if the path_info matches my regexp and after that I match that to my routing table. If there is no routing for that path i redirect to a 404 page.

I have some little code here and I was wondering whehter someone can crack this by providing wrong data or my web app is protected? Is it possible to bypass this? (Please note that this is just some sample code):

<?php
// alphabetic characters, numbers, "-" and "/" are allowed
$pathRegex = '/[a-zA-Z0-9\/-]+/';
$pathInfo = $_SERVER["PATH_INFO"];
$routes = array(
    "homepage" => "/",
    "some_page" => "/param1/param2-something"
);

$res = preg_match($pathRegex, $pathInfo, $matches);
if ($res && $matches[0] == $pathInfo) {
    if (checkRouting($pathInfo, $routes)) {
        // keep on running
    } else {
        // 404, sorry
    }
} else {
    // wrong path
}

function checkRouting($path, $routes) {
    $res = false;
    foreach($routes as $key => $val) {
        if ($val == $path) {
            $res = true;
            break;
        }
    }
    return $res;
}
?>

Answer 1

Seems fine to me except maybe i'd do this regexp instead:

'#/([a-z0-9]+(-|/)?)*#i'

1. It will force your url to start with /
2. It will force your url parts to start with a letter or number
3. It will then allow 1 - or / and then start lettering/numbering again
4. It allows uppercase and lowercase letters all the time

I think it doesn't trash too many possibilities, anyway you can tweak it again, but the reason IMO was that he could use any number of /- at any time in the url, maybe he knew something about that.

Answer 2

Using a regular expression creates uncertainty, makes it difficult to debug and can be resource intensive. That being said I use Regex buddy to debug regular expressions. In fact this is a tool I used to hack PHPIDS, which contains many regular expressions. The best security systems I have encountered are very simple and easy to understand, complexity is the worst enemy of security.

However what you are doing is just a simple white list to insure that $_SERVER["PATH_INFO"] is an approved path. This can be done in O(1) time complexity with a dictionary. Create a dictionary where each path is the key called $route_paths;

if(isset($route_paths[$_SERVER["PATH_INFO"]])){
    // keep on running
} else {
    // 404, sorry
}