Remote File Inclusion

from flask import Flask, request, send_from_directory
import os

app = Flask(__name__)

# Define a whitelist of allowed files
ALLOWED_FILES = {"home": "home.html", "about": "about.html"}

@app.route('/page', methods=['GET'])
def serve_page():
    file_key = request.args.get('file', 'home')  # Default to 'home'
    if file_key in ALLOWED_FILES:
        return send_from_directory('templates', ALLOWED_FILES[file_key])  # Securely serve file
    else:
        return "Invalid file request", 400

if __name__ == '__main__':
    app.run(debug=True)

This secure Python implementation prevents RFI by restricting file inclusion to a predefined whitelist (ALLOWED_FILES). Only known, trusted files can be loaded, eliminating the risk of executing malicious remote files.

const express = require('express');
const path = require('path');
const app = express();

// Define a whitelist of allowed files
const ALLOWED_FILES = { home: 'home.html', about: 'about.html' };

app.get('/page', (req, res) => {
    let fileKey = req.query.file || 'home';
    
    if (ALLOWED_FILES[fileKey]) {
        res.sendFile(path.join(__dirname, 'views', ALLOWED_FILES[fileKey])); // Securely serve file
    } else {
        res.status(400).send('Invalid file request');
    }
});

app.listen(3000, () => {
    console.log('Server running on http://localhost:3000');
});

This secure Node.js implementation prevents RFI by enforcing a strict whitelist of allowed files (ALLOWED_FILES). If user input does not match a known safe file, the request is rejected, ensuring that arbitrary files cannot be included or executed.