Skip to content

Commit 21bd0d7

Browse files
author
exploit
committed
bugfix for the assignHandler
调整了处理函数赋值的过程，并且在return前加入flow中
1 parent ef3df82 commit 21bd0d7

File tree

4 files changed

+45
-49
lines changed

4 files changed

+45
-49
lines changed

‎CFGGenerator.php

+33-43
Original file line numberDiff line numberDiff line change
@@ -233,39 +233,29 @@ private function assignHandler($node,$block,$dataFlow,$type){
233233
if($part && ($part->getType() == "Expr_FuncCall" ||
234234
$part->getType() == "Expr_MethodCall" ||
235235
$part->getType() == "Expr_StaticCall" ) ){
236-
236+
237237
//处理 id = urlencode($_GET['id']) ;
238-
if(!SymbolUtils::isValue($part)){
238+
if($type == 'right' && !SymbolUtils::isValue($part)){
239239
$funcName = NodeUtils::getNodeFunctionName($part) ;
240240
BIFuncUtils::assignFuncHandler($part, $type, $dataFlow, $funcName) ;
241241
if($dataFlow->getValue() != null){
242+
//如果处理完函数赋值，则立即返回
243+
$block->getBlockSummary()->addDataFlowItem($dataFlow);
242244
return ;
243-
}
244-
}
245-
246-
//处理编码和净化信息
247-
if($type == 'right'){
248-
//处理iconv等函数
249-
//处理 id = urlencode($_GET['id']) ;
250-
$encode_convert = array('iconv') ;
251-
$funcName = NodeUtils::getNodeFunctionName($part);
252-
if (array_key_exists($funcName, $encode_convert)){
253-
//将函数加入净化栈
254-
$oneFunction = new OneFunction($funcName);
255-
$dataFlow->getLocation()->addSanitization($oneFunction) ;
256245
}else{
246+
//处理 id = urlencode($_GET['id']) ;
257247
//检查是否为sink函数
258248
$this->functionHandler($part, $block, $this->fileSummary);
259-
249+
260250
//处理净化信息和编码信息
261251
SanitizationHandler::setSanitiInfo($part,$dataFlow, $block, $this->fileSummary) ;
262252
EncodingHandler::setEncodeInfo($part, $dataFlow, $block, $this->fileSummary) ;
263253
}
264254
}
255+
265256
}
266257
//处理类型强制转换
267-
if($part
268-
&& ($part->getType() == "Expr_Cast_Int" || $part->getType() == "Expr_Cast_Double")
258+
if($part && ($part->getType() == "Expr_Cast_Int" || $part->getType() == "Expr_Cast_Double")
269259
&& $type == "right"){
270260
$dataFlow->getLocation()->setType("int") ;
271261
$symbol = SymbolUtils::getSymbolByNode($part->expr) ;
@@ -1147,34 +1137,34 @@ public function sinkTracebackBlock($argName,$block,$flowsNum){
11471137
}
11481138

11491139

1150-
//扫描漏洞类型
1151-
$scan_type = 'ALL';
1152-
echo "<pre>" ;
1140+
// //扫描漏洞类型
1141+
// $scan_type = 'ALL';
1142+
// echo "<pre>" ;
11531143

1154-
//从用户那接受项目路径
1155-
$project_path = 'E:/School_of_software/information_security/PHPVulScanner_project/simple-log_v1.3.12/upload/';
1156-
$project_path = "D:/MySoftware/wamp/www/code/phpvulhunter/test/test.php" ;
1157-
$project_path = "E:/School_of_software/information_security/PHPVulScanner_project/74cms_3.3/" ;
1158-
$allFiles = FileUtils::getPHPfile($project_path);
1144+
// // //从用户那接受项目路径
1145+
// // $project_path = 'E:/School_of_software/information_security/PHPVulScanner_project/simple-log_v1.3.12/upload/';
1146+
// // $project_path = "D:/MySoftware/wamp/www/code/phpvulhunter/test/test.php" ;
1147+
// // $project_path = "E:/School_of_software/information_security/PHPVulScanner_project/74cms_3.3/" ;
1148+
// // $allFiles = FileUtils::getPHPfile($project_path);
11591149

1160-
//初始化
1161-
$initModule = new InitModule() ;
1162-
$initModule->init($project_path, $allFiles) ;
1150+
// // //初始化
1151+
// // $initModule = new InitModule() ;
1152+
// // $initModule->init($project_path, $allFiles) ;
11631153

1164-
$cfg = new CFGGenerator() ;
1165-
$visitor = new MyVisitor() ;
1166-
$parser = new PhpParser\Parser(new PhpParser\Lexer\Emulative) ;
1167-
$traverser = new PhpParser\NodeTraverser ;
1168-
$path = CURR_PATH . '/test/test.php';
1169-
$cfg->getFileSummary()->setPath($path);
1170-
$code = file_get_contents($path);
1171-
$stmts = $parser->parse($code) ;
1172-
$traverser->addVisitor($visitor) ;
1173-
$traverser->traverse($stmts) ;
1174-
$nodes = $visitor->getNodes() ;
1175-
$pEntryBlock = new BasicBlock() ;
1176-
$pEntryBlock->is_entry = true ;
1177-
$ret = $cfg->CFGBuilder($nodes, NULL, NULL, NULL) ;
1154+
// $cfg = new CFGGenerator() ;
1155+
// $visitor = new MyVisitor() ;
1156+
// $parser = new PhpParser\Parser(new PhpParser\Lexer\Emulative) ;
1157+
// $traverser = new PhpParser\NodeTraverser ;
1158+
// $path = CURR_PATH . '/test/test.php';
1159+
// $cfg->getFileSummary()->setPath($path);
1160+
// $code = file_get_contents($path);
1161+
// $stmts = $parser->parse($code) ;
1162+
// $traverser->addVisitor($visitor) ;
1163+
// $traverser->traverse($stmts) ;
1164+
// $nodes = $visitor->getNodes() ;
1165+
// $pEntryBlock = new BasicBlock() ;
1166+
// $pEntryBlock->is_entry = true ;
1167+
// $ret = $cfg->CFGBuilder($nodes, NULL, NULL, NULL) ;
11781168

11791169

11801170

‎analyser/SqliAnalyser.class.php

-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ class SqliAnalyser {
2020
private function check_sanitization($var,$saniArr){
2121
//CMS的编码
2222
global $encoding ;
23-
2423
//如果数组为空，说明没有进行任何净化
2524
if(count($saniArr) == 0){
2625
return false ;

‎analyser/TaintAnalyser.class.php

+5-5
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@ public function multiBlockHandler($block, $argName, $node, $fileSummary){
249249

250250
$this->getPrevBlocks($block) ;
251251
$block_list = $this->pathArr ;
252-
252+
253253
//单基本块进入 算法停止
254254
if(empty($block_list)){
255255
// 首先，在当前基本块中探测变量，如果有source和不完整的santi则报告漏洞
@@ -281,8 +281,8 @@ public function multiBlockHandler($block, $argName, $node, $fileSummary){
281281
}
282282
}
283283

284-
285284
$vars = $this->getVarsByFlow($flow) ;
285+
286286
foreach ($vars as $var){
287287
$varName = $this->getVarName($var) ;
288288
//如果$varName 为source
@@ -373,8 +373,10 @@ public function multiBlockHandler($block, $argName, $node, $fileSummary){
373373
foreach ($bitem as $block_item){
374374
$flows = $block_item->getBlockSummary()->getDataFlowMap() ;
375375
$flows = array_reverse($flows) ;
376+
376377
//如果flow中没有信息，则换下一个基本块
377378
if($flows == null){
379+
if($argName == 'key') echo "x3";
378380
//找到新的argName
379381
foreach ($block->getBlockSummary()->getDataFlowMap() as $flow){
380382
if($flow->getName() == $argName){
@@ -431,7 +433,7 @@ public function multiBlockHandler($block, $argName, $node, $fileSummary){
431433
return "safe" ;
432434
}
433435
}
434-
436+
435437
//获取flow中的右边赋值变量
436438
//得到flow->getValue()的变量node
437439
//$sql = $a . $b ; => array($a,$b)
@@ -645,8 +647,6 @@ public function analysis($block, $node, $argName, $fileSummary){
645647
$this->getPrevBlocks($block) ;
646648
$block_list = $this->pathArr ;
647649
array_push($block_list, $block) ;
648-
//首先，在当前基本块中探测变量，如果有source和不完整的santi则报告漏洞
649-
//$this->currBlockTaintHandler($block, $node, $argName, $fileSummary) ;
650650
//多个基本块的处理
651651
$this->pathArr = array() ;
652652
$this->multiBlockHandler($block, $argName, $node, $fileSummary) ;

‎utils/BIFuncUtils.class.php

+7
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,14 @@ public static function getSingleFuncs(){
3434
*/
3535
public static function assignFuncHandler($part, $type, $dataFlow, $funcName){
3636
$single_func = self::getSingleFuncs() ;
37+
$encoding_convert = array('iconv') ;
3738
if($type == "right" && array_key_exists($funcName, $single_func)){
39+
//首先搜索不安全字符的转换函数
40+
if(in_array($funcName, $encoding_convert)){
41+
$oneFunction = new OneFunction($funcName);
42+
$dataFlow->getLocation()->addSanitization($oneFunction) ;
43+
}
44+
3845
$position = $single_func[$funcName] ;
3946
$value = $part->args[$position]->value ;
4047

0 commit comments

Comments
 (0)