Content-Type: text/html Content-Length: 1648 tainted backslash: save, the whole name tainted: 460_dir/a.txt save, the directory tainted: 460_dir/b.txt -f: yes load: text list: a.txt,b.txt delete removes the directory: removed the slash keeps the language of the backslash: json escapes it, as it does with any tainted one: /tests/<\/script>.gif the name of a file is cut at the last separator: b.txt tainted path scheme: file://: Exception: tainted path scheme http://: Exception: tainted path scheme partly tainted: Exception: tainted path scheme tainted after the scheme: /tests/460.html as-is: /tests/460.html tainted file:// without errors: -f of an existing file: no -d of an existing directory: no find of an existing file: not found delete with exception(false) leaves the file: kept the scheme stays tainted through string functions: unescape: Exception: tainted path scheme table cell: Exception: tainted path scheme base64 decode: Exception: tainted path scheme lower: Exception: tainted path scheme replace: Exception: tainted path scheme split and join: Exception: tainted path scheme match: Exception: tainted path scheme hash key always tainted: Exception: tainted path scheme document-root with a backslash: the backslash is kept: \tests and is a separator: a relative name is inside the root: /x.gif vs /tests/x.gif before diskpath of a web path: /tests/x.gif diskpath of file://: /tests/x.gif document-root with a char escaped in file names: the char is replaced: _7Ctests a relative name is outside the root: Exception: is outside of $request:document-root [_7Ctests] diskpath of a web path: _7Ctests/x.gif