是否将“http：//”添加到PHP的fopen（）文件名中，足以防止读取本地文件？

Question

I have a PHP script that accepts a file URL by GET and opens it with fopen.
Is this solution safe enough or is it a security breach?

$filename = $_GET['file'];
if( substr( $filename, 0, 7 ) !== 'http://' )
    $filename = 'http://'.$filename;

fopen( $filename, 'r' );
// etc...

This way you can't force a local path to the script to read from it.

Answer 1

That should work, but here are two more things to think about:

• Giving access to other servers. If your server is behind a firewall, someone could use this to fetch data from another server behind your firewall (or hit a service, etc.) using HTTP, FTP, etc.

• Recursive denial of service. Make sure that there's not a way for someone to give you the URL of the script itself to fetch in a way that makes a recursion loop.