Null Byte in Path

Why This Happens

PHP 8.0+ throws a ValueError when file functions receive paths containing null bytes. This is a security improvement, as null bytes in paths were historically used for path truncation attacks. The null byte usually comes from unsanitized user input being used directly in file operations.

The Problem

$filename = $_GET['file']; // Could contain null byte
$content = file_get_contents('/uploads/' . $filename);

The Fix

$filename = $_GET['file'] ?? '';
$filename = basename($filename); // Remove path traversal
if (str_contains($filename, "\0") || $filename === '') {
    throw new InvalidArgumentException('Invalid filename');
}
$path = '/uploads/' . $filename;
if (!file_exists($path)) {
    throw new RuntimeException('File not found');
}
$content = file_get_contents($path);

Step-by-Step Fix

1. 1

   Identify the tainted input

   Find where user input enters the file path. Check $_GET, $_POST, and any other external data sources.

2. 2

   Sanitize the input

   Use basename() to strip directory components, and filter out null bytes and other dangerous characters.

3. 3

   Validate the final path

   Use realpath() to resolve the path and verify it is within the expected directory to prevent path traversal attacks.