phanalist

E0055: Dynamic Include or Require

In plain English: include $path loads whatever file the variable points to. If the path comes from a request, an attacker may be able to load an unexpected file.

Why it matters: Dynamic include paths can load attacker-controlled code, expose local files, and make it difficult to know which files a project uses.

Bad

include $_GET['page'];
include $base . '/bootstrap.php';

Good

switch ($page) {
    case 'home':
        include __DIR__ . '/pages/home.php';
        break;

    case 'about':
        include __DIR__ . '/pages/about.php';
        break;

    default:
        http_response_code(404);
}

Literal paths, __DIR__, __FILE__, and project constants such as APP_ROOT are treated as safe.

What the rule checks

• A path that is a variable, property access, array access, or function call
• A concatenation where any part is dynamic
• A conditional or other computed path expression

When it does not report

• The path is a literal string.
• The path uses a magic constant such as __DIR__ or __FILE__.
• The path uses a project constant.
• The path is built with dirname() or realpath() from a fixed path.
• A concatenation contains only safe values.

How to fix

• Use a fixed path.
• Choose between fixed paths with a switch or match.
• Do not pass request data directly to include or require.
• If paths must vary, validate the value against a fixed allowlist and include literal paths.

Model limits

• The rule is a local syntactic check and does not trace where a variable came from.
• dirname() and realpath() are treated as safe only when their path and level arguments are themselves fixed. Other function calls are treated as dynamic even when they return a fixed path.
• Constants are trusted without checking their value.
• Interpolated strings are treated as dynamic.
• Closures and arrow functions are traversed.

Configuration

E0055 has no configuration options and is enabled by default.

This site is open source. Improve this page.