PHP: normalize path of not existing directories to prevent directory traversals?

Question

I would like to normalize a path from an external resource to prevent directory traversal attacks. I know about the realpath() function, but sadly this function returns only the path of existing directories. So if the directory doesn't exist (yet) the realpath() function cuts off the whole part of the path which doesn't exist.

So my Question is: Do you know a PHP function which only normalizes the path?

PS: I also don't want to create all possible directories in advance ;-)

Answer 1

There's no built-in PHP function for this. Use something like the following instead:

function removeDots($path) {
    $root = ($path[0] === '/') ? '/' : '';

    $segments = explode('/', trim($path, '/'));
    $ret = array();
    foreach($segments as $segment){
        if (($segment == '.') || strlen($segment) === 0) {
            continue;
        }
        if ($segment == '..') {
            array_pop($ret);
        } else {
            array_push($ret, $segment);
        }
    }
    return $root . implode('/', $ret);
}

Answer 2

Thanks to Benubird / Cragmonkey corrected me that under some situation my previous answer didn't work. thus I make a new one, for the original purpose: Perform good, fewer lines, and with pure regular expression:

This time I tested with much more strict test case as below.

$path = '/var/.////./user/./././..//.//../////../././.././test/////';

function normalizePath($path) {
    $patterns = array('~/{2,}~', '~/(\./)+~', '~([^/\.]+/(?R)*\.{2,}/)~', '~\.\./~');
    $replacements = array('/', '/', '', '');
    return preg_replace($patterns, $replacements, $path);
}

The correct answer would be /test/.

Not meant to do competition, but performance test is a must:

test case: for loop 100k times, on an Windows 7, i5-3470 Quad Core, 3.20 GHz.

mine: 1.746 secs.

Tom Imrei: 4.548 secs.

Benubird: 3.593 secs.

Ursa: 4.334 secs.

It doesn't means my version is always better. In several situation they perform simular.

Answer 3

I think Tamas' solution will work, but it is also possible to do it with regex, which may be less efficient but looks neater. Val's solution is incorrect; but this one works.

function normalizePath($path) {
    do {
        $path = preg_replace(
            array('#//|/\./#', '#/([^/.]+)/\.\./#'),
            '/', $path, -1, $count
        );
    } while($count > 0);
    return $path;
}

Yes, it does not handle all the possible different encodings of ./\ etc. that there can be, but that is not the purpose of it; one function should do one thing only, so if you want to also convert %2e%2e%2f into ../, run it through a separate function first.

Realpath also resolves symbolic links, which is obviously impossible if the path doesn't exist; but we can strip out the extra '/./', '/../' and '/' characters.

Answer 4

Strict, but safe implementation. If you use only ASCII for file names it would be suitable:

/**
 * Normalise a file path string so that it can be checked safely.
 *
 * @param $path string
 *     The path to normalise.
 * @return string
 *    Normalised path or FALSE, if $path cannot be normalized (invalid).
 */
function normalisePath($path) {
  // Skip invalid input.
  if (!isset($path)) {
    return FALSE;
  }
  if ($path === '') {
    return '';
  }

  // Attempt to avoid path encoding problems.
  $path = preg_replace("/[^\x20-\x7E]/", '', $path);
  $path = str_replace('\\', '/', $path);

  // Remember path root.
  $prefix = substr($path, 0, 1) === '/' ? '/' : '';

  // Process path components
  $stack = array();
  $parts = explode('/', $path);
  foreach ($parts as $part) {
    if ($part === '' || $part === '.') {
      // No-op: skip empty part.
    } elseif ($part !== '..') {
      array_push($stack, $part);
    } elseif (!empty($stack)) {
      array_pop($stack);
    } else {
      return FALSE; // Out of the root.
    }
  }

  // Return the "clean" path
  $path = $prefix . implode('/', $stack);
  return $path;
}

Answer 5

My 2 cents. The regexp is used only for empty blocks of path:

<?php 
echo path_normalize('/a/b/c/../../../d/e/file.txt');

echo path_normalize('a/b/../c');

echo path_normalize('./../../etc/passwd');

echo path_normalize('/var/user/.///////././.././.././././test/');

function path_normalize($path){
    $path   = str_replace('\\','/',$path);
    $blocks = preg_split('#/#',$path,null,PREG_SPLIT_NO_EMPTY);
    $res    = array();

    while(list($k,$block) = each($blocks)){
        switch($block){
            case '.':
                if($k == 0) 
                    $res = explode('/',path_normalize(getcwd()));
            break;
            case '..';
                if(!$res) return false;
                array_pop($res);
            break;
            default:
                $res[] = $block;
            break;
        }
    }
    return implode('/',$res);
}
?>