Rule Definition
The software does not properly neutralize special elements that are part of paths or file names used in file system operations. This could allow an attacker to access or modify system files or other files that are critical to the application. It could range from: Creating files - Example: file_put_contents - Risk: Depending on the server configuration this may result in remote code execution. (e.g. writing a file in the web root) Modifying files - Example: file_put_contents - Risk: Depending on the server configuration this may result in remote code execution. (e.g. modifying a PHP file) Reading files - Example: file_get_contents - Risk: Sensitive data could be exposed from the filesystem. (e.g. config values, source code, user-submitted files) Deleting files - Example: unlink - Risk: Denial of Service or potentially RCE. (e.g. deleting application code, removing a .htaccess file)

Remediation
Use an allowlist approach where possible to verify names on file operations. Sanitize user-controlled filenames by stripping .., \ and /.

Violation Code Sample

<?php

function readFiles(PDOStatement $stmt) : void {
    $stmt->execute();
    $filenames = $stmt->fetchAll(PDO::FETCH_COLUMN, 0);
    foreach ($filenames as $filename) {
        $content = file_get_contents($filename);   // VIOLATION
        echo $content;
    }
}

Fixed Code Sample

<?php

/**
* @psalm-taint-escape file
*/
function my_escaping_function_for_file_names(string $input) : string {
    // Check that input is part of a hard-coded white-list of permitted file names
};

function readFiles(PDOStatement $stmt) : void {
    $stmt->execute();
    $filenames = $stmt->fetchAll(PDO::FETCH_COLUMN, 0);
    foreach ($filenames as $filename) {
        $escaped_filename = my_escaping_function_for_file_names($filename);
        $content = file_get_contents($escaped_filename);
        echo $content;
    }
}

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') https://cwe.mitre.org/data/definitions/22.html CWE-73: External Control of File Name or Path https://cwe.mitre.org/data/definitions/73.html CWE-434: Unrestricted Upload of File with Dangerous Type https://cwe.mitre.org/data/definitions/434.html Open Web Application Security Project (OWASP) OWASP Top Ten 2017 Category A1:2017-Injection https://www.owasp.org/index.php/Top_10-2017_A1-Injection OWASP Top Ten 2021 Category A03:2021 - Injection https://owasp.org/Top10/A03_2021-Injection/ CISQ rule: ASCSM-CWE-22.