Skip to content

[4.x] Add opt-in path validation to saveBodyToFile and getRawStream#551

Open
JonPurvis wants to merge 2 commits into
saloonphp:v4from
JonPurvis:save-body-to-file-fix
Open

[4.x] Add opt-in path validation to saveBodyToFile and getRawStream#551
JonPurvis wants to merge 2 commits into
saloonphp:v4from
JonPurvis:save-body-to-file-fix

Conversation

@JonPurvis
Copy link
Copy Markdown
Contributor

Hey 👋

Currently, saveBodyToFile and getRawStream do not sanitize input paths. This allows path traversal (../) and malicious stream wrappers (phar://, php://, etc.) to be executed. This becomes exploitable if a developer is determining the save path dynamically, such as extracting a filename from a Content-Disposition header. Whilst I don't think this affects the majority of Saloon users, it's definitely worth fixing.

This PR:

  • Adds a new, opt-in $validatePath boolean to both methods.
  • It defaults to false to ensure strict backwards compatibility for existing integrations.
  • Adds a private assertSafePath helper that throws an InvalidArgumentException if traversal sequences or stream wrappers are detected.
  • Developers dynamically saving files can now simply pass true to the method signature to sanitize the operation.

Tested on a Laravel 13 application and works well, we'll need to update the docs too if this proposal is accepted and merged!

@JonPurvis JonPurvis changed the title Add opt-in path validation to saveBodyToFile and getRawStream [4.x] Add opt-in path validation to saveBodyToFile and getRawStream May 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant