Is there any possibility to pass this weak comparison? Can user input a file with an extension not contained in $allowed and get past the security check?

$allowed = array('txt','docx');
if (isset($_REQUEST['file'])) {
    $file = $_REQUEST['file'];
    if (preg_match('#\.(.+)$#', $file, $matched) && isset($matched[1]) && !in_array($matched[1], $allowed)) 
        echo 'You can not pass beacause extension is bad';   

If previous code return that it is correct extension. There is next validation:

if (strrpos($file, '.') !== false)
    $ext = substr($file, strrpos($file, '.'));
    $ext = '';

I wondered if I can enter something what bypass all check and in variable $ext = ''; I have something like 'jpg' or 'bmp' what is out of range allowed table. It is some example of strange verification I found on server to penetration.

  • your code isn't working. Do you mean $userinput = $ext? It seems secure to me, but you really should use strict checking. See the first comment in the doc for some examples. – tim Jan 22 '16 at 11:00
  • Yes I mean $userinput = $ext. But I think that strict check is not needed in this case of use because there is strings in array, It can not be cast double long etc. I – sebastianpszczolka Jan 22 '16 at 11:04
  • 3
    Please stop extending and changing your question all the time. Give all informations in the very beginning and leave it like that, only giving more data if necessary. Your last edit was useless as i already fixed your regex, there is absolutely no point in adding this. -1 for not giving any votes or responses but changing your question all the time (to the worse). – James Cameron Jan 22 '16 at 14:14
  • I'd probably need to see more of your code, like what you're doing with $ext beyond what you've posted. Perhaps an edit is in order? – Mark Buffalo Jan 22 '16 at 14:53
  • It is contacentaed with string with filename and it is red from filesystem but file on filesystem is without txt and doc extension so I want to baypass it – sebastianpszczolka Jan 22 '16 at 15:50


No, your provided code for filtering a given extension is working fine and there shouldn't be a way tricking it. You should enable the strict - flag though.

Then again...

The file formats you provided don't have to be safe. DOCX - Files can embed malicious macros.

Your code can be improved though. Your regex catches on too early when having multiple extensions, the if condition approves a script if it doesnt have any extension at all, some parts are necessary and it looks like your missing to cancel the script after displaying the error. See my edits below.

$allowed = array('txt','docx');
if (isset($_REQUEST['file'])) {
    $file = $_REQUEST['file'];
    $match = preg_match('#\.(\w+)$#', $file, $matched);
    if (!$match || ($match && !in_array($matched[1], $allowed, true))) 
        echo 'Invalid file extension';
        return; // Stop script right here
| improve this answer | |
  • Extension is obtained by preg_match('#\.(.+)$#', $file, $matched) and it is checked by !in_array( $matched[1]'', $allowedTable) – sebastianpszczolka Jan 22 '16 at 11:06
  • Please edit it into your starting post so i can talk about it in my answer above. – James Cameron Jan 22 '16 at 11:08
  • depends on the front end also and where this file is going.. i can call anything with code in it a .txt or a .docx...I would need to play with the code.. could I access the document once its uploaded? maliciouscode.txt.php? im not good with regex, but it might be the weak point – TheHidden Jan 22 '16 at 13:04
  • Thats what i mentioned before already regarding the regex. Its been included and multiple file endings are prevented in my regex (and his kinda too). As the question is only about filtering the extension additional scopes about general IT security are out of scope. – James Cameron Jan 22 '16 at 13:35

Remember that file extensions aren't really worth relying on. Desktop GUIs may use extensions as a hint on how to open or display files based on their extensions (and then again may not because of a user re-defined action on any specific extension) but the OS doesn't take notice of extension when working out what kind of content a file is.

Different operating systems treat this slightly differently, but usually it's the permissions of a file that make it dangerous not the extension. Many compilers and interpreters for example don't care about the extensions, nor do various shells etc. which will try to execute a file call 'fred.gif' quite happily if you, or a program, tells it to because the permissions are right.

Different operating systems and services treat extensions differently in this manner, but be aware.

| improve this answer | |
  • It really isn't the permissions. It is the content and what you do with it that make a file dangerous or not. You can perfectly safely read ANY kind of file as long as you make sure what you read fits into memory and then process it safely. You are correct though that the extensions are worthless as a security check. Anyone can name a file anything. – Julian Knight Jan 23 '16 at 15:57
  • I'm assuming that the permissions and the content obviously! An executable empty file is pretty unlikely as an attack! – David Scholefield Jan 23 '16 at 20:22
  • But the question is not really about executables. The Op hasn't said what they intend to do with it. Reading a file with PHP doesn't constitute a danger even if it is a rogue executable. You can read in a malware file marked as executable in the file system with no danger at all as long as you only treat it as data. – Julian Knight Jan 23 '16 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.