mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-09 19:45:13 +02:00
20 lines
619 B
PHP
20 lines
619 B
PHP
<?php
|
|
// File I/O — negative fixture.
|
|
// Safe: realpath + prefix validation prevents directory traversal.
|
|
// Entry: runReadFile($userPath) Cap: FILE_IO
|
|
// Expected verdict: NotConfirmed
|
|
|
|
function runReadFile($userPath) {
|
|
$baseDir = '/var/data';
|
|
$filePath = realpath($baseDir . '/' . $userPath);
|
|
if ($filePath === false || strpos($filePath, $baseDir . DIRECTORY_SEPARATOR) !== 0) {
|
|
echo "Access denied\n";
|
|
return;
|
|
}
|
|
$content = @file_get_contents($filePath);
|
|
if ($content !== false) {
|
|
echo substr($content, 0, 100);
|
|
} else {
|
|
echo "File not found\n";
|
|
}
|
|
}
|