Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
	public function fileOutBy(){
		if(!$this->in['path']) return; 
		
		// 拼接转换相对路径;
		$add   = rawurldecode($this->in['add']);
		$parse = kodIO::parse($this->in['path']);
		$allow = array('',kodIO::KOD_IO,kodIO::KOD_USER_DRIVER,kodIO::KOD_SHARE_LINK);
		if(in_array($parse['type'],$allow)){
			$distPath = kodIO::pathTrue(get_path_father($parse['path']).'/'.ltrim($add,'/'));
			$distInfo = IO::info($distPath);
		}else{//KOD_SOURCE KOD_SHARE_ITEM(source,)
			$info = IO::info($parse['path']);
			if($parse['type'] == kodIO::KOD_SOURCE){
				$level = Model("Source")->parentLevelArray($info['parentLevel']);
				$pathRoot = '{source:'.$level[0].'}';
			}else if($parse['type'] == kodIO::KOD_SHARE_ITEM){
				$pathArr   = explode('/',trim($parse['path'],'/'));
				$pathRoot  = $pathArr[0];
				$shareInfo = Model('Share')->getInfo($parse['id']); // source路径内部协作分享;
				if($shareInfo['sourceID']){$pathRoot = $pathRoot.'/'.$shareInfo['sourceID'];}
			}
			
			$displayPathArr = explode('/',trim($info['pathDisplay'],'/'));array_shift($displayPathArr);
			$displayPath = $pathRoot.'/'.implode('/',$displayPathArr);
			$distPath = kodIO::pathTrue(get_path_father($displayPath).'/'.$add);
			$distInfo = IO::infoFullSimple($distPath);
		}
		// pr($distPath,$distInfo,$parse,[$pathRoot,$displayPath,$info,$shareInfo]);exit;
		if(!$distInfo || $distInfo['type'] != 'file'){
			return show_json(LNG('common.pathNotExists'),false);
		}
		
		ActionCall('explorer.auth.canView',$distInfo['path']);// 再次判断新路径权限;
		$this->updateLastOpen($distInfo['path']);
		Hook::trigger('explorer.fileOut', $distInfo['path']);
		IO::fileOut($distInfo['path'],false);
	}