I'm aware of this vulnerability via PHP's filter
stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php
.
So I went ahead to guard against this kind of attack/exploit, by filtering for/away the "php" keyword, to attempt to stop any PHP stream wrapper.
Any idea whether this is safe/secure enough, or is there another possible attack/injection vector to exploit & view the source code of my PHP scripts?
For reference, if it matters, I'm serving these PHP scripts via nginx
and PHP 5.5.9
on Ubuntu.
if (!isset($_GET["file"])) { die(); }
$file = $_GET["file"];
if (preg_match("/data:/i", $file)) {
die();
}
$file = trim($file);
if (preg_match("/php/i", $file)) {
die();
}
include($file);
Thanks