how to build a good router for php mvc

Question

I'm experimenting with php mvc and I'm stucked with the following issue. My request and router classes are really simple and I would like to extend theme to can handle controller calls from sub folders and to controller classes functions should be able to pick up url variables send it threw get and post. my router looks as it follows ``` class Router{ public static function route(Request $request){ $controller = $request->getController().'Controller'; $method = $request->getMethod(); $args = $request->getArgs(); $controllerFile = __SITE_PATH.'/controllers/'.$controller.'.php'; if(is_readable($controllerFile)){ require_once $controllerFile; $controller = new $controller; if(!empty($args)){ call_user_func_array(array($controller,$method),$args); }else{ call_user_func(array($controller,$method)); } return; } throw new Exception('404 - '.$request->getController().'--Controller not found'); } } ``` and Request class ``` private $_controller; private $_method; private $_args; public functio…

Accepted Answer

Your code contains what is known as an LFI vulnerability and is dangerous in its current state. You should whitelist your what can be used as your `$controller`, as otherwise an attacker could try to specify something using NUL bytes and possibly going up a directory to include files that SHOULD NOT be ever included, such as `/etc/passwd`, a config file, whatever.

Your router is not safe for use; beware!

edit: example on whitelisting

```
$safe = array(
    'ajax',
    'somecontroller',
    'foo',
    'bar',
);
if(!in_array($this->_controller, $safe))
{
    throw new Exception(); // replace me with your own error 404 stuff
}
```

how to build a good router for php mvc

Solution

Problem