Rules / PHP
SHIELD-PHP-007
File inclusion (LFI/RFI) via dynamic path
What it detects
include/require with a variable path enables local or remote file inclusion.
How to fix
Include only from a fixed whitelist of allowed files; never use raw user input in paths.
Vulnerable — Shield flags thisindex.php
<?php
// Template router — vulnerable to local/remote file inclusion
$page = $_GET['page'] ?? 'home';
include $page . '.php';
Fixed — scans cleanindex.php
<?php
// Only files from a fixed whitelist can ever be included
$pages = ['home' => 'home.php', 'about' => 'about.php', 'contact' => 'contact.php'];
$page = $_GET['page'] ?? 'home';
if (!isset($pages[$page])) {
http_response_code(404);
exit;
}
include __DIR__ . '/pages/' . $pages[$page];
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-007, the fixed one does not.