Is using an absolute path in a require() function enough to prevent attacks?

Question

The use of the function dirname(__FILE__) or the magic constant __DIR__ is appropriately safe to prevent a local file inclusion or a remote file inclusion in a require() receiving parameters per GET?

There is a solution to this problem?

Answer 1

Setting the absolute path to directories avoids accessing other folders?

No. Because if the "attacker" puts ../, knowing the file path, it may access an unwanted directory in any way.

That is, for the following structure below:

app/
    database.php
web/
    index.php
    pages/
       home.php
       contact.php

If the web/index.php is the "root" of your application, but the malicious user put the ?page=../app/database.php, he would theoretically be doing with what PHP does include normally.

For you to understand. All this below results in the same operation

include 'app/database.php';

include __DIR__ . '/app/database.php'

#supondo que estamos na pasta 'web'

include __DIR__ . '../app/database.php';

Note that providing an absolute name for the root directory of a particular directory or file does not prevent other files (outside of it) from being accessed.

In this case, I find it very appropriate that, for loading pages through get, perform functions with specific treatments.

Example:

function page_include($page)
{

    if (strpos($page, '..') !== false) {
       throw new Exception("Caractere inválido detectado");
    }

    include WEB_DIRECTORY . '/pages/' . $page;
}

_{Maybe this is something basic. You could include other checks, avoiding attacks.}

Remote file inclusion (remote file inclusion)

allow_url_include is a configuration that allows you to use the include in urls (which I don’t think is good at all). On this I recommend that you disable the configuration allow_url_include, because in that case, allowing such a configuration is to give your hands-kissed application in the hand of malicious people.

PHP Injection

It is another common problem involving files or folders in PHP. Read about it here: What is PHP Injection? What is its difference to SQL Injection? And how to avoid it?