2
class TemplateController
{
    public function get(string $template): string
    {
        return file_get_contents(_DIST . '/resources/templates/' . $template . '.html');
    }
}

I use $_GET or a direct argument to the address bar to import a template from SPA application. Can this cause problems?

I use quotes around the input to run commend to access inaccessible files, etc.

HYAR7E
  • 194
  • 2
  • 10
이장희
  • 101
  • 6

1 Answers1

2

It would be possible for someone to pass a value to the $template variable that used ../ or / to navigate out of the directory you have set in the parameter.

In theory they could navigate up to more vulnerable directories and access files you don't want them to. I would say the best approach to secure against that would be to validate against the input string containing ../ or / If you know the file name will never have any . or / characters in you could throw a validation error for any string containing any . or / characters.

On top of that, following best practices around setting up your users and permissions on your production server will help to protect you. This thread offers some useful help there: How to set up file permissions for Laravel?

Other than that I can't think of any other vulnerabilities... anyone else?

Jon White
  • 682
  • 4
  • 12
  • Updated answer with some helpful stuff on best practices around file permissions on your server. Well worth being sure you've got that right too. – Jon White Dec 21 '19 at 19:02