Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
	public function fileGetHash(){
		$pageNum = 1024 * 1024 * 10;
		$this->in['pageNum'] = isset($this->in['pageNum']) ? $this->in['pageNum'] : $pageNum;
		$this->in['pageNum'] = $this->in['pageNum'] >= $pageNum ? $pageNum : $this->in['pageNum'];
		// ActionCall("explorer.editor.fileGet");exit;

		$url = $this->in['path'];
		$urlInfo = parse_url_query($url);
		if( !isset($urlInfo["explorer/share/unzipListHash"]) && 
			!isset($urlInfo["accessToken"])){
			show_json(LNG('common.pathNotExists'),false);
		}
		$index 	  = json_decode(rawurldecode($urlInfo['index']),true);
		$zipFile  = $this->fileHash(rawurldecode($urlInfo['path']));
		$filePart = IOArchive::unzipPart($zipFile,$index ? $index:'-1');
		if(!$filePart || !IO::exist($filePart['file'])){
			show_json(LNG('common.pathNotExists'),false);
		}
		Action("explorer.editor")->fileGetMake($filePart['file'],IO::info($filePart['file']),$url);
	}