A small BUG in thinkphp

Two days before a small thinkphp BUG, I found my website had a file added inexplicably.
Address: http://bbs.csdn.net/topics/390469279

I looked at these inexplicable HTML files this morning and finally found the problem !!!
Cause:
If static cache is enabled, the static rules contain parameters, such

// Static cache 'HTML _ CACHE_ON '=> true, 'HTML _ CACHE_RULES' => array ('infor: search' => array ('Home /{: module}/{: action}/{key }'),),

Example
{Key} = test
Html/home/Infor/search/test.html
{Key} = ../boot
Html/home/Infor/boot.html
Yes, the second static file HTML flew to the parent directory, so many files and folders were added to the server directory.
This is a small BUG in thinkphp. although it does not harm the website, it is very annoying.

The solution is also simple.
Static rules do not directly use parameters. we recommend that you use MD5 for processing {$ _ SERVER. REQUEST_URI | md5}

Witty? Silk

Reply to discussion (solution)

Here we can see that static cache is rarely used.

This is not a thinkphp bug.
Naturally, you are responsible for your own actions.

For the rule in your example, if key = ../boot
By $ rule = preg_replace ('/{(\ w +)}/E', "\ $ _ GET [' \ 1 ']", $ rule );
It can be interpreted as home/MODULE_NAME/ACTION_NAME/../boot

What is the reason for TP to prevent you from placing static files in the parent directory?

This is not a thinkphp bug.
Naturally, you are responsible for your own actions.

For the rule in your example, if key = ../boot
By $ rule = preg_replace ('/{(\ w +)}/E', "\ $ _ GET [' \ 1 ']", $ rule );
It can be interpreted as home/MODULE_NAME/ACTION_NAME/../boot

What is the reason for TP to prevent you from placing static files in the parent directory?

I think TP should consider filtering the {key} parameter.

If you want to filter, you must also give rules and write code.
At least URLs like http://bbs.csdn.net/topics/390469279/..x do not constitute attacks
You can't expect people to do anything for you. after all, he is just a development tool.
If this occurs in dede, it can be said to be a bug.