Why this matters
Including files from user‐supplied paths without validation can lead to Local/Remote File Inclusion (LFI/RFI), allowing attackers to execute arbitrary code or access sensitive system files.
Avoid passing untrusted values to include/require statements. If you need to include files based on external input, strictly validate that input (for example, using a whitelist of valid filenames).
Including files from user‐supplied paths without validation can lead to Local/Remote File Inclusion (LFI/RFI), allowing attackers to execute arbitrary code or access sensitive system files.
Side-by-side examples engineers can pattern-match during review.
<?php
$page = $_GET['pagina'];
include "$page.php";
?><?php
$page = $_GET['pagina'];
$allowed = ['home', 'about', 'contact'];
if (in_array($page, $allowed)) {
include $page . '.php';
} else {
include '404.php';
}
?><?php
$page = $_GET['pagina'];
include "$page.php";
?><?php
$page = $_GET['pagina'];
$allowed = ['home', 'about', 'contact'];
if (in_array($page, $allowed)) {
include $page . '.php';
} else {
include '404.php';
}
?>From the same buckets as this rule.