fix(file-ops): implement whitelist validation for file operations (CW…

[markuszaki]

…E-22/434/601)

Security fixes for 9 challenges across 3 vulnerability types:

File Inclusion (CWE-22):

• Added whitelist of allowed files (index.php, about.php, contact.php, help.php)
• Used basename() to strip directory traversal attempts
• Blocked protocol wrappers (://, php://, file://, data://, etc.)
• Default to index.php for invalid requests

File Upload (CWE-434):

• Implemented extension whitelist (jpg, jpeg, png, gif)
• Added MIME type validation using finfo
• Random filename generation using random_bytes() to prevent prediction
• File size validation (100KB limit)
• getimagesize() validation for high security level

Open Redirect (CWE-601):

• Whitelist of allowed redirect targets
• Protocol wrapper detection and blocking
• basename() to prevent path traversal
• Proper error responses (400) for invalid targets

Files modified:

• vulnerabilities/fi/source/{low,medium,high}.php
• vulnerabilities/upload/source/{low,medium,high}.php
• vulnerabilities/open_redirect/source/{low,medium,high}.php

[github-actions]

🏆 DVWA — CTF Patch Score

█░░░░░░░░░░░░░░░░░░░  3 / 108 pts  (3%)

2 / 55 challenges patched

Per-challenge detail is withheld — it would reveal the rubric.

Commit: 0f74ad6 · scoring run

🎉 Your result is on the leaderboard — see where you rank! 🏆