Skip to content

Commit 0d11be5

Browse files
author
exploit
committed
merge the branch
2 parents 21bd0d7 + fa2ec15 commit 0d11be5

File tree

4 files changed

+101
-115
lines changed

4 files changed

+101
-115
lines changed

‎CFGGenerator.php

+5-76
Original file line numberDiff line numberDiff line change
@@ -517,38 +517,6 @@ public function functionHandler($node, $block, $fileSummary){
517517
//check
518518
if(!$funcBody || !is_object($funcBody)) return ;
519519

520-
//处理递归
521-
if($funcBody->getType() == "Stmt_Function"){
522-
$traverser = new PhpParser\NodeTraverser;
523-
$visitor = new RecursionFunctionVisitor() ;
524-
$visitor->funcName = $funcName ;
525-
$traverser->addVisitor($visitor) ;
526-
$traverser->traverse(array($funcBody)) ;
527-
if($visitor->isRecursion == true){
528-
return ;
529-
}
530-
}else if($funcBody->getType() == "Stmt_ClassMethod"){
531-
$traverser = new PhpParser\NodeTraverser;
532-
$visitor = new RecursionFunctionVisitor() ;
533-
$visitor->funcName = $funcName ;
534-
$traverser->addVisitor($visitor) ;
535-
$traverser->traverse(array($funcBody)) ;
536-
if($visitor->isRecursion == true){
537-
return ;
538-
}
539-
540-
}else if($funcBody->getType() == "Stmt_StaticCall"){
541-
$traverser = new PhpParser\NodeTraverser;
542-
$visitor = new RecursionFunctionVisitor() ;
543-
$visitor->funcName = $funcName ;
544-
$traverser->addVisitor($visitor) ;
545-
$traverser->traverse(array($funcBody)) ;
546-
if($visitor->isRecursion == true){
547-
return ;
548-
}
549-
550-
}
551-
552520
if($funcBody->getType() == "Stmt_ClassMethod"){
553521
$funcBody->stmts = $funcBody->stmts[0] ;
554522
}
@@ -872,51 +840,7 @@ public function leaveNode(Node $node) {
872840
}
873841

874842

875-
/**
876-
* 处理递归语句
877-
* 如果是递归，则返回true
878-
* @author Exploit
879-
*
880-
*/
881-
class RecursionFunctionVisitor extends PhpParser\NodeVisitorAbstract{
882-
public $funcName ;
883-
public $isRecursion = false;
884-
public function leaveNode(Node $node){
885-
//方法调用
886-
if($node->getType() == "Expr_FuncCall"){
887-
if($node->name == $this->funcName){
888-
$this->isRecursion = true ;
889-
}
890-
}
891-
892-
//静态方法
893-
if($node->getType() == "Expr_StaticCall"){
894-
$name = explode(":", $this->funcName) ;
895-
if(count($name) >= 2){
896-
$name = $name[1] ;
897-
}else{
898-
$name = $this->funcName ;
899-
}
900-
901-
if($node->name == $name){
902-
$this->isRecursion = true ;
903-
}
904-
}
905843

906-
//类方法
907-
if($node->getType() == "Expr_MethodCall"){
908-
$name = explode(":", $this->funcName) ;
909-
if(count($name) >= 2){
910-
$name = $name[1] ;
911-
}else{
912-
$name = $this->funcName ;
913-
}
914-
if($node->name == $name){
915-
$this->isRecursion = true ;
916-
}
917-
}
918-
}
919-
}
920844

921845
class nodeFunctionVisitor extends PhpParser\NodeVisitorAbstract{
922846
public $block;
@@ -933,6 +857,7 @@ public function leaveNode(Node $node){
933857
}
934858
}
935859
}
860+
936861
/**
937862
* 处理方法调用
938863
* @author Exploit
@@ -1141,6 +1066,7 @@ public function sinkTracebackBlock($argName,$block,$flowsNum){
11411066
// $scan_type = 'ALL';
11421067
// echo "<pre>" ;
11431068

1069+
11441070
// // //从用户那接受项目路径
11451071
// // $project_path = 'E:/School_of_software/information_security/PHPVulScanner_project/simple-log_v1.3.12/upload/';
11461072
// // $project_path = "D:/MySoftware/wamp/www/code/phpvulhunter/test/test.php" ;
@@ -1151,11 +1077,13 @@ public function sinkTracebackBlock($argName,$block,$flowsNum){
11511077
// // $initModule = new InitModule() ;
11521078
// // $initModule->init($project_path, $allFiles) ;
11531079

1080+
11541081
// $cfg = new CFGGenerator() ;
11551082
// $visitor = new MyVisitor() ;
11561083
// $parser = new PhpParser\Parser(new PhpParser\Lexer\Emulative) ;
11571084
// $traverser = new PhpParser\NodeTraverser ;
11581085
// $path = CURR_PATH . '/test/test.php';
1086+
11591087
// $cfg->getFileSummary()->setPath($path);
11601088
// $code = file_get_contents($path);
11611089
// $stmts = $parser->parse($code) ;
@@ -1166,6 +1094,7 @@ public function sinkTracebackBlock($argName,$block,$flowsNum){
11661094
// $pEntryBlock->is_entry = true ;
11671095
// $ret = $cfg->CFGBuilder($nodes, NULL, NULL, NULL) ;
11681096

1097+
// echo '456';
11691098

11701099

11711100
?>

‎FileSummaryGenerator.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ class FileSummaryGenerator {
88
* @return array(fileSummarys)
99
*/
1010
public static function getIncludeFilesDataFlows($fileSummary){
11-
if (!is_object($fileSummary)){
12-
return null;
11+
if (is_object($fileSummary)){
12+
return;
1313
}
1414
//1.得到include files
1515
$includeFiles = $fileSummary->getIncludeMap();
@@ -53,7 +53,7 @@ public static function getIncludeFilesDataFlows($fileSummary){
5353
public static function getFileSummary($absPath){
5454
if (!$absPath){
5555
return ;
56-
}
56+
}
5757
$visitor = new MyVisitor() ;
5858
$parser = new PhpParser\Parser(new PhpParser\Lexer\Emulative) ;
5959
$traverser = new PhpParser\NodeTraverser ;

‎context/ClassFinder.php

+92-36
Original file line numberDiff line numberDiff line change
@@ -145,8 +145,47 @@ public function getClassMethodBody($funcName,$path,$require_array){
145145
}
146146
}
147147
}
148-
$ret = $this->getFunction($path, $method);
149-
return $ret;
148+
149+
$funcBody = $this->getFunction($path, $method);
150+
151+
152+
//check
153+
if(!$funcBody || !is_object($funcBody)) return ;
154+
155+
//处理递归
156+
if($funcBody->getType() == "Stmt_Function"){
157+
$traverser = new PhpParser\NodeTraverser;
158+
$visitor = new RecursionFunctionVisitor() ;
159+
$visitor->funcName = $funcName ;
160+
$traverser->addVisitor($visitor) ;
161+
$traverser->traverse(array($funcBody)) ;
162+
if($visitor->isRecursion == true){
163+
return null;
164+
}
165+
}else if($funcBody->getType() == "Stmt_ClassMethod"){
166+
$traverser = new PhpParser\NodeTraverser;
167+
$visitor = new RecursionFunctionVisitor() ;
168+
$visitor->funcName = $funcName ;
169+
$traverser->addVisitor($visitor) ;
170+
$traverser->traverse(array($funcBody)) ;
171+
if($visitor->isRecursion == true){
172+
return null;
173+
}
174+
175+
}else if($funcBody->getType() == "Stmt_StaticCall"){
176+
$traverser = new PhpParser\NodeTraverser;
177+
$visitor = new RecursionFunctionVisitor() ;
178+
$visitor->funcName = $funcName ;
179+
$traverser->addVisitor($visitor) ;
180+
$traverser->traverse(array($funcBody)) ;
181+
if($visitor->isRecursion == true){
182+
return null;
183+
}
184+
185+
}
186+
187+
188+
return $funcBody;
150189
}
151190

152191
/**
@@ -341,28 +380,6 @@ public function leaveNode(Node $node){
341380
}
342381

343382

344-
345-
class InFunctionVisitor extends PhpParser\NodeVisitorAbstract{
346-
public $isSameFunction = false;
347-
public $funcName;
348-
public function leaveNode(PhpParser\Node $node){
349-
if(($node->getType() == 'Expr_FuncCall' ||
350-
$node->getType() == 'Expr_MethodCall' ||
351-
$node->getType() == 'Expr_StaticCall'||
352-
$node->getType() == "Expr_Isset")){
353-
$funcName = NodeUtils::getNodeFunctionName($node);
354-
355-
$funcName = substr($funcName, strpos($funcName, ':')+1);
356-
if ($funcName == $this->funcName){
357-
$this->isSameFunction = true;
358-
return ;
359-
}
360-
361-
362-
}
363-
}
364-
}
365-
366383
/*
367384
用来获取方法体的遍历
368385
*/
@@ -371,20 +388,12 @@ class FunctionBodyVisitor extends PhpParser\NodeVisitorAbstract{
371388
public $startLine ;
372389
public $endLine ;
373390
public $funcName ;
391+
private $isSameFunction = false;
374392

375393
public function leaveNode(PhpParser\Node $node){
376-
if(($node->getAttribute('startLine') == $this->startLine) && ($node->getAttribute('endLine') == $this->endLine)){
377-
$parser = new PhpParser\Parser(new PhpParser\Lexer\Emulative) ;
378-
$visitor = new InFunctionVisitor ;
379-
$traverser = new PhpParser\NodeTraverser ;
380-
$visitor->funcName = $this->funcName;
381-
$traverser->addVisitor($visitor) ;
382-
$traverser->traverse(array($node)) ;
383-
384-
if ($visitor->isSameFunction){
385-
return ;
386-
}
387-
$this->func_body = $node ;
394+
if(($node->getAttribute('startLine') == $this->startLine) &&
395+
($node->getAttribute('endLine') == $this->endLine)){
396+
$this->func_body = $node ;
388397
}
389398

390399
}
@@ -396,6 +405,53 @@ public function getFunctionBody(){
396405
}
397406

398407

408+
/**
409+
* 处理递归语句
410+
* 如果是递归，则返回true
411+
* @author Exploit
412+
*
413+
*/
414+
class RecursionFunctionVisitor extends PhpParser\NodeVisitorAbstract{
415+
public $funcName ;
416+
public $isRecursion = false;
417+
public function leaveNode(Node $node){
418+
//方法调用
419+
if($node->getType() == "Expr_FuncCall"){
420+
if($node->name == $this->funcName){
421+
$this->isRecursion = true ;
422+
}
423+
}
424+
425+
//静态方法
426+
if($node->getType() == "Expr_StaticCall"){
427+
$name = explode(":", $this->funcName) ;
428+
if(count($name) >= 2){
429+
$name = $name[1] ;
430+
}else{
431+
$name = $this->funcName ;
432+
}
433+
434+
if($node->name == $name){
435+
$this->isRecursion = true ;
436+
}
437+
}
438+
439+
//类方法
440+
if($node->getType() == "Expr_MethodCall"){
441+
$name = explode(":", $this->funcName) ;
442+
if(count($name) >= 2){
443+
$name = $name[1] ;
444+
}else{
445+
$name = $this->funcName ;
446+
}
447+
if($node->name == $name){
448+
$this->isRecursion = true ;
449+
}
450+
}
451+
}
452+
}
453+
454+
399455
/*
400456
遍历出审计工程中的所有代码
401457
并抽取出所有类的信息

‎main.php

+1
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ function convertResults($resContext){
106106
}
107107

108108
$scan_type = $scanType = strtoupper($scan_type);
109+
$encoding = strtoupper($encoding);
109110
$project_path = str_replace(array('\\','//'), '/', $project_path);
110111
$scan_path = str_replace(array('\\','//'), '/', $scan_path);
111112

0 commit comments

Comments
 (0)