This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.
Imagine you have an app which takes some user input which ends up in a path: $userProvidedData = $_GET [ 'fileName' ]; $path = '/path/to/safe/directory/' . $userProvidedData ; This is no good, if the user sends the value ../../../../etc/passwd then the $path becomes /path/to/safe/directory/../../../../etc/passwd aka /etc/passwd . This is a classic path traversal attack. It's very simple to defeat:…
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.