I have a script that have this code:
$name = preg_replace('/[^a-z0-9_.]/', '', $_GET['name']);
$_GET['name'] = ../../conf.php but preg_replace filtered my slash (/) and $name will be ....conf.php Can I bypass it ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Likely not. That is a whitelist regex (the ^ is a not) which replaces anything that isn't literally a-z or 0-9 or underscore or period with nothing - it removes it.
That is actually the recommended way to do that if you can - by being so restrictive on what is allowed, they eliminate control characters, slashes, escaping (% or &), everything that might break it.
Best you can do that I can see is '..', which might cause it to open the parent directory and provide some info for you, but probably not.