Rule Definition
The software does not properly neutralize special elements that are part of paths or file names used in XXXX Passing untrusted user input to include calls is dangerous, as it can allow an attacker to execute arbitrary scripts on your server. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers.

Remediation
Explicitly specify what to include. If that is not a viable solution, validate user input thoroughly with below functions: basename($PATH, ...) linkinfo($PATH, ...) readlink($PATH, ...) realpath($PATH, ...) include_safe(...)

Violation Code Sample

<?php

$name = $_GET["name"];

includeCode($name);

function includeCode(string $name) : void {
    include($name . '.php');                  // VIOLATION
}

Fixed Code Sample

<?php

/**
* @psalm-taint-escape include
*/
function my_escaping_function_for_included_files(string input) : string {
    // Check that input is part of a hard-coded white-list of permitted included files
};

$name = $_GET["name"];
$name = my_escaping_function_for_included_files($name);  // USE A FUNCTION ANNOTATED WITH @psalm-taint-escape include
includeCode($name);

function includeCode(string $name) : void {
    include($name . '.php');                             // FIXED
}

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') https://cwe.mitre.org/data/definitions/98.html https://www.php.net/manual/en/function.include.php https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/EasyRFISniff.php https://en.wikipedia.org/wiki/File_inclusion_vulnerability#Types_of_Inclusion Open Web Application Security Project (OWASP) OWASP Top Ten 2017 Category A1:2017-Injection https://www.owasp.org/index.php/Top_10-2017_A1-Injection OWASP Top Ten 2021 Category A03:2021 - Injection https://owasp.org/Top10/A03_2021-Injection/