Regex for unix ../ /.. /../ - php

Question

I am having php admin panel and pure-ftpd server running in the background.
I want to check if the path that user has provided for specific user DOES NOT contain ../ /.. or /../
I am using a php framework Nette and for this validation I am using addRule(Form::PATTERN, 'error message', $pattern) (Nette api-docs: https://api.nette.org/2.4/Nette.Forms.Form.html, Nette docs: https://doc.nette.org/en/2.4/form-validation
Thank you for your time

Answer 1

I don't know if you're open to other solutions, but if it were me I would not attempt to use regex on the path because PHP has an easier way.
If it were me, I would do this:
<?php
// You know your users are limited to their own home directory
$user_base_dir = '/home/skunkbad/';
// And they supply some path that attempts directory transversal
$supplied_path = '/home/skunkbad/../../etc/';
// Realpath in this case would return "/etc/"
$realpath = realpath( $supplied_path );
// So the check to see if the user base directory is in the path that realpath returns would fail
if( stripos( $realpath, $user_base_dir ) !== 0 )
echo 'Invalid Path!';
See: http://php.net/manual/en/function.realpath.php
and: http://php.net/manual/en/function.stripos.php

Answer 2

Thank you #BrianGottier,
but realpath($path) checks if the file really exists in the filesystem and script need permission to execute... So, since I knew what I was looking for I googled and with some stuff from php.net & community i have came up with this:
/**
* #param $path
* #param $baseDir
* #return bool
*/
protected function isDirValid($path, $baseDir)
{
if (stripos($path, '\\'))
return false;
$path = str_replace('/', '/', $path);
$path = str_replace('\\', '/', $path);
$parts = array_filter(explode('/', $path), 'strlen');
$absolutes = [];
foreach ($parts as $part)
{
if ('.' == $part)
continue;
if ('..' == $part)
{
array_pop($absolutes);
} else {
$absolutes[] = $part;
}
}
$realDir = '/' . implode('/', $absolutes);
if (stripos($realDir, $baseDir) !== 0)
return false;
return true;
}