Krdytkyu

PHP realpath($path); is insufficient for some cases since it returns false on paths that dont exist on a file system.

I need a function that extends realpath($path); to return even path that does not exist yet. Such function would be used for keeping a user within his filesystem directory and/or restricting modifications to some directories and files.

function DesiredRealPath($path_string) {

    $desired_path = explode("/", str_replace("\", "/", $path_string)); // convert back slashes to front slashes and create array of desired directories

    $real_path = explode("/", str_replace("\", "/", realpath("."))); // convert back slashes to front slashes and create array of actual directories

    if(mb_substr($path_string, 0, 1) == "/" || mb_substr($path_string, 0, 1) == "\") { // if path string begins with a slash, slice all actual directories except for root

        $real_path = array_slice($real_path, 0, 1); // "/" points to root directory

    }

    foreach ($desired_path as $desired_element) {

        switch ($desired_element) {

            case "":

                break;

            case ".":

                break;

            case "..": // remove last element of actual directories if array has at least 2 directories left

                if(count($real_path) >= 2) {

                    array_pop($real_path);

                }

                break;

            default: // push desired directory into actual directories

                array_push($real_path, $desired_element);

                break;

        }

    }

    return implode("/", $real_path); // put array of actual directories into a string

}

So far I have tested on both Windows and Linux, this function has determined precise directory even non-existant ones.

My question is, whether this function has any flaws or security vulnerabilities?