realpath()

Also Known As

TL;DR

Explanation

realpath($path) resolves all symbolic links, /../ and /./ sequences, and redundant separators to produce the canonical absolute path. It returns false if the file doesn't exist. The standard path traversal guard is: $real = realpath($base . '/' . $userInput); if ($real === false || strpos($real, $base) !== 0) { deny; }. This ensures the resolved path starts with the intended base directory, regardless of what the user submitted.

Common Misconception

Why It Matters

Common Mistakes

• Checking path prefix before calling realpath() — traversal sequences pass the check but resolve differently.
• Not handling realpath() returning false for non-existent paths — the comparison silently fails.
• Using realpath() without checking that the result starts with the intended base directory.
• Trusting that realpath() sanitises the path for security without the subsequent base-directory check.

Code Examples

// Check before realpath — bypassable:
$path = '/var/www/uploads/' . $_GET['file'];
if (str_starts_with($path, '/var/www/uploads/')) {
    readfile($path); // ../../etc/passwd passes the check!
}

// Correct:
$real = realpath('/var/www/uploads/' . $_GET['file']);
if ($real === false || !str_starts_with($real, '/var/www/uploads/')) die('Denied');
readfile($real);

// realpath() resolves ../, ./, symlinks to canonical absolute path
// Returns false if path doesn't exist
$base = realpath('/var/www/uploads');
$path = realpath($base . '/' . $_GET['file']);

if ($path === false) abort(404);  // file doesn't exist
if (!str_starts_with($path, $base . DIRECTORY_SEPARATOR)) abort(403); // path traversal

readfile($path);

// basename() strips directory components:
basename('../../../etc/passwd'); // 'passwd'
$safe = '/var/www/uploads/' . basename($_GET['file']); // still need realpath() too

Tags

🧠 Logic Engine

References

• https://www.php.net/manual/en/function.realpath.php