Beating Blacklists

<?php
// One pass, non-recursive. This is the single most common attempt at
// fixing traversal, and it is worse than doing nothing — because it is
// believed to work.
$page = str_replace('../', '', $_GET['page']);
include('/var/www/html/pages/' . $page);

/*
  Send:      ....//....//....//etc/passwd

  The filter finds the inner ../ in each ....// and removes it:

      ....//   ->   ..  +  /      ->   ../
      ^^--^^

  Result:    ../../../etc/passwd

  The filter did not fail to stop the traversal. It assembled it.

  Same idea, other spellings:
      ..././     -> ../
      ....\/     -> ..\/   (Windows)
      ..;/       -> some proxies strip the ;
*/

<?php
// Loop until the string stops changing. This DOES close the ....// class —
// the filter keeps going until nothing is left to remove.
do {
    $before = $page;
    $page = str_replace('../', '', $page);
} while ($page !== $before);

// So what is left?
//
// 1. Encodings, if anything decodes after this runs.
//      %2e%2e%2f  — decoded by the server BEFORE this, so no help
//      %252e%252e%252f — decoded once before, once after: works if the app
//                        urldecode()s the value itself, which many do
//
// 2. Separators the filter does not know about.
//      ..\  on Windows
//
// 3. Symlinks. There is no ../ anywhere in this and it still escapes:
//      uploads/link-to-root/etc/passwd
//    A string filter cannot see a symlink. realpath() resolves it.
//
// 4. Absolute paths, if nothing is prepended.
//      /etc/passwd
//
// The symlink case is the one that matters: it shows the approach is wrong
// in principle, not merely incomplete. See /guide/path-resolution

<?php
// Best: the parameter stops being a path. There is nothing to filter,
// nothing to encode, and no wrapper is reachable, because the value never
// touches the filesystem API.
$pages = [
    'home'    => 'home.php',
    'about'   => 'about.php',
    'contact' => 'contact.php',
];
$file = $pages[$_GET['page'] ?? 'home'] ?? 'home.php';
include __DIR__ . '/pages/' . $file;


// Acceptable when the set genuinely cannot be enumerated: resolve first,
// then check the RESOLVED path. Every payload on this page is already
// collapsed by the time the comparison happens — including symlinks,
// which no string filter can see.
$base = realpath(__DIR__ . '/pages');
$real = realpath($base . '/' . ($_GET['page'] ?? ''));

if ($real === false || !str_starts_with($real, $base . DIRECTORY_SEPARATOR)) {
    http_response_code(400);
    exit;
}
include $real;

// Note the trailing separator in the comparison. Without it, a sibling
// directory named pages-backup passes the prefix check.