php-file-write-audit

To detect arbitrary file write vulnerabilities in PHP, trace user-controlled input from GET, POST, or COOKIE data to write sinks like file_put_contents and fwrite, validating path traversal. This process identifies unconstrained writes that could lead to remote code execution.

Path traversal in PHP file write operations occurs when user-controlled data manipulates the target path of functions like fopen or copy, escaping the intended base directory. Normalization checks verify that the final resolved path remains safely within allowed boundaries.

Audit PHP write sinks for remote code execution by mapping content origins to user input and assessing if the destination falls within web-accessible or executable directories. This determines whether newly written files can be triggered to execute malicious payloads.

Yes, you can trace user input from sources like uploads and cookies to file_put_contents sinks during a PHP security audit. Content origin mapping verifies if attacker-controlled data directly influences the text being written to disk.

Yes, this file write audit works with PHP rename and copy operations. It detects write paths initiated through these functions alongside standard write calls like fwrite and stream_write, ensuring comprehensive sink coverage during code reviews.

Static analysis for PHP path traversal detection may face limitations with dynamic path construction and complex framework routing obscuring the base directory. It requires clear resolution of destination paths and accurate content source mapping to avoid false positives.