CODEWITHSUNDEEP
phpsecurity
tim
tim

Reputation: 2039

Do file_get_contents and readfile execute PHP code?

I was always sure that the PHP functions file_get_contents and readfile execute any PHP code in any files - regardless of file type - that are given to it. I tried this on multiple setups, and it always worked.

I received a question regarding this here, and the user seems to think that this is not the case.

I looked at the PHP documentation for the functions, and they do not mention code execution (which is something that I would expect if this is normally the case, as it has serious security implications).

I also searched for it, and found a lot of claims that the functions do not execute PHP code. For example:

readfile does not execute the code on your server so there is no issue there. source

Searching for "php file_get_contents code execution" also returns various questions trying to execute the retrieved PHP code, which seems odd if it would indeed normally execute any given PHP code.

I also found one question that asks about not execution PHP code, so execution does seem to happen to others as well.

So my questions are:

Upvotes: 7

Views: 6821

Answers (2)

Álvaro González
Álvaro González

Reputation: 146460

Those functions are described in the «Function Reference / File System Related Extensions / Filesystem» section of the manual, while function to execute code are described at «Function Reference / Process Control Extensions».

I'm pretty sure the misunderstanding comes from a somehow widespread confusion between file system and network and that's made worse by the PHP streams feature that provides protocol wrappers which allow to use the same functions to transparently open any kind of resources: local files, networks resources, compressed archives, etc. I see endless posts here where someone does something like this:

file_get_contents('http://example.com/inc/database.inc.php');

... and wonders why he cannot see this database connection. And the answer is clear: you are not loading a file, you're fetching a URL. As a result, code inside database.inc.php gets effectively executed... though rather indirectly.

Upvotes: 7

deceze
deceze

Reputation: 522250

file_get_contents and readfile do not execute code. All they do is return the raw contents of the file. That could be text, PHP code, binary (e.g. image files), or anything else. No interpretation of the files' contents is happening at all.

The only situation in which it may appear as if execution is happening is:

  1. <?php ?> tags will likely be hidden by the browser because it's trying to interpret them as HTML tags, so this may lead to the impression that the PHP disappeared and hence may have been executed.
  2. You're reading from a source which executes the code, e.g. when reading from http://example.com/foo.php. In this case the functions have the same effect as visiting those URLs in a web browser: the serving web server is executing the PHP code and returning the result, but file_get_contents merely gets that result and returns it.

Upvotes: 13

Related Questions