Response::file() & directory traversal [3.x]

[quickapps]

Currently the method Response::file() performs a very basic checking against "Directory Traversal" attacks by doing this:

if (strpos($path, '..') !== false) {
    throw new NotFoundException('The requested file contains `..` and will not be read.');
}

This approach doesn't allow us to work with file names containing two consecutive dots symbols, e.g. Some truncated name ... .pdf

Proposed solution, remove filename from $path before checking:

if (strpos(dirname($path), '..') !== false) {
    throw new NotFoundException('The requested file contains `..` and will not be read.');
}

[antograssiot]

@quickapps would you like to submit a PR for this ?

[antograssiot]

closed with #7021