Skip to content

Commit fa2ec15

Browse files
xyw55xyw55
committed
bugfix for functionRecursive
1 parent ef3df82 commit fa2ec15

File tree

4 files changed

+127
-140
lines changed

4 files changed

+127
-140
lines changed

‎CFGGenerator.php

+31-101
Original file line numberDiff line numberDiff line change
@@ -527,38 +527,6 @@ public function functionHandler($node, $block, $fileSummary){
527527
//check
528528
if(!$funcBody || !is_object($funcBody)) return ;
529529

530-
//处理递归
531-
if($funcBody->getType() == "Stmt_Function"){
532-
$traverser = new PhpParser\NodeTraverser;
533-
$visitor = new RecursionFunctionVisitor() ;
534-
$visitor->funcName = $funcName ;
535-
$traverser->addVisitor($visitor) ;
536-
$traverser->traverse(array($funcBody)) ;
537-
if($visitor->isRecursion == true){
538-
return ;
539-
}
540-
}else if($funcBody->getType() == "Stmt_ClassMethod"){
541-
$traverser = new PhpParser\NodeTraverser;
542-
$visitor = new RecursionFunctionVisitor() ;
543-
$visitor->funcName = $funcName ;
544-
$traverser->addVisitor($visitor) ;
545-
$traverser->traverse(array($funcBody)) ;
546-
if($visitor->isRecursion == true){
547-
return ;
548-
}
549-
550-
}else if($funcBody->getType() == "Stmt_StaticCall"){
551-
$traverser = new PhpParser\NodeTraverser;
552-
$visitor = new RecursionFunctionVisitor() ;
553-
$visitor->funcName = $funcName ;
554-
$traverser->addVisitor($visitor) ;
555-
$traverser->traverse(array($funcBody)) ;
556-
if($visitor->isRecursion == true){
557-
return ;
558-
}
559-
560-
}
561-
562530
if($funcBody->getType() == "Stmt_ClassMethod"){
563531
$funcBody->stmts = $funcBody->stmts[0] ;
564532
}
@@ -882,51 +850,7 @@ public function leaveNode(Node $node) {
882850
}
883851

884852

885-
/**
886-
* 处理递归语句
887-
* 如果是递归，则返回true
888-
* @author Exploit
889-
*
890-
*/
891-
class RecursionFunctionVisitor extends PhpParser\NodeVisitorAbstract{
892-
public $funcName ;
893-
public $isRecursion = false;
894-
public function leaveNode(Node $node){
895-
//方法调用
896-
if($node->getType() == "Expr_FuncCall"){
897-
if($node->name == $this->funcName){
898-
$this->isRecursion = true ;
899-
}
900-
}
901-
902-
//静态方法
903-
if($node->getType() == "Expr_StaticCall"){
904-
$name = explode(":", $this->funcName) ;
905-
if(count($name) >= 2){
906-
$name = $name[1] ;
907-
}else{
908-
$name = $this->funcName ;
909-
}
910853

911-
if($node->name == $name){
912-
$this->isRecursion = true ;
913-
}
914-
}
915-
916-
//类方法
917-
if($node->getType() == "Expr_MethodCall"){
918-
$name = explode(":", $this->funcName) ;
919-
if(count($name) >= 2){
920-
$name = $name[1] ;
921-
}else{
922-
$name = $this->funcName ;
923-
}
924-
if($node->name == $name){
925-
$this->isRecursion = true ;
926-
}
927-
}
928-
}
929-
}
930854

931855
class nodeFunctionVisitor extends PhpParser\NodeVisitorAbstract{
932856
public $block;
@@ -943,6 +867,7 @@ public function leaveNode(Node $node){
943867
}
944868
}
945869
}
870+
946871
/**
947872
* 处理方法调用
948873
* @author Exploit
@@ -1147,35 +1072,40 @@ public function sinkTracebackBlock($argName,$block,$flowsNum){
11471072
}
11481073

11491074

1150-
//扫描漏洞类型
1151-
$scan_type = 'ALL';
1152-
echo "<pre>" ;
1075+
// //扫描漏洞类型
1076+
// $scan_type = 'ALL';
1077+
// echo "<pre>" ;
1078+
1079+
// //从用户那接受项目路径
1080+
// $project_path = 'C:/Users/xyw55/Desktop/test/74cms_3.3';
1081+
// // $project_path = 'E:/School_of_software/information_security/PHPVulScanner_project/simple-log_v1.3.12/upload/';
1082+
// // $project_path = "D:/MySoftware/wamp/www/code/phpvulhunter/test/test.php" ;
1083+
// // $project_path = "E:/School_of_software/information_security/PHPVulScanner_project/74cms_3.3/" ;
1084+
1085+
// $allFiles = FileUtils::getPHPfile($project_path);
11531086

1154-
//从用户那接受项目路径
1155-
$project_path = 'E:/School_of_software/information_security/PHPVulScanner_project/simple-log_v1.3.12/upload/';
1156-
$project_path = "D:/MySoftware/wamp/www/code/phpvulhunter/test/test.php" ;
1157-
$project_path = "E:/School_of_software/information_security/PHPVulScanner_project/74cms_3.3/" ;
1158-
$allFiles = FileUtils::getPHPfile($project_path);
1087+
// //初始化
1088+
// $initModule = new InitModule() ;
1089+
// $initModule->init($project_path, $allFiles) ;
11591090

1160-
//初始化
1161-
$initModule = new InitModule() ;
1162-
$initModule->init($project_path, $allFiles) ;
11631091

1164-
$cfg = new CFGGenerator() ;
1165-
$visitor = new MyVisitor() ;
1166-
$parser = new PhpParser\Parser(new PhpParser\Lexer\Emulative) ;
1167-
$traverser = new PhpParser\NodeTraverser ;
1168-
$path = CURR_PATH . '/test/test.php';
1169-
$cfg->getFileSummary()->setPath($path);
1170-
$code = file_get_contents($path);
1171-
$stmts = $parser->parse($code) ;
1172-
$traverser->addVisitor($visitor) ;
1173-
$traverser->traverse($stmts) ;
1174-
$nodes = $visitor->getNodes() ;
1175-
$pEntryBlock = new BasicBlock() ;
1176-
$pEntryBlock->is_entry = true ;
1177-
$ret = $cfg->CFGBuilder($nodes, NULL, NULL, NULL) ;
1092+
// $cfg = new CFGGenerator() ;
1093+
// $visitor = new MyVisitor() ;
1094+
// $parser = new PhpParser\Parser(new PhpParser\Lexer\Emulative) ;
1095+
// $traverser = new PhpParser\NodeTraverser ;
1096+
// $path = CURR_PATH . '/test/test.php';
1097+
// $path = 'C:/Users/xyw55/Desktop/test/74cms_3.3/admin/api/locoyspider.php';
1098+
// $cfg->getFileSummary()->setPath($path);
1099+
// $code = file_get_contents($path);
1100+
// $stmts = $parser->parse($code) ;
1101+
// $traverser->addVisitor($visitor) ;
1102+
// $traverser->traverse($stmts) ;
1103+
// $nodes = $visitor->getNodes() ;
1104+
// $pEntryBlock = new BasicBlock() ;
1105+
// $pEntryBlock->is_entry = true ;
1106+
// $ret = $cfg->CFGBuilder($nodes, NULL, NULL, NULL) ;
11781107

1108+
// echo '456';
11791109

11801110

11811111
?>

‎FileSummaryGenerator.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ class FileSummaryGenerator {
88
* @return array(fileSummarys)
99
*/
1010
public static function getIncludeFilesDataFlows($fileSummary){
11-
if (!is_object($fileSummary)){
12-
return null;
11+
if (is_object($fileSummary)){
12+
return;
1313
}
1414
//1.得到include files
1515
$includeFiles = $fileSummary->getIncludeMap();
@@ -53,7 +53,7 @@ public static function getIncludeFilesDataFlows($fileSummary){
5353
public static function getFileSummary($absPath){
5454
if (!$absPath){
5555
return ;
56-
}
56+
}
5757
$visitor = new MyVisitor() ;
5858
$parser = new PhpParser\Parser(new PhpParser\Lexer\Emulative) ;
5959
$traverser = new PhpParser\NodeTraverser ;

‎context/ClassFinder.php

+92-36
Original file line numberDiff line numberDiff line change
@@ -145,8 +145,47 @@ public function getClassMethodBody($funcName,$path,$require_array){
145145
}
146146
}
147147
}
148-
$ret = $this->getFunction($path, $method);
149-
return $ret;
148+
149+
$funcBody = $this->getFunction($path, $method);
150+
151+
152+
//check
153+
if(!$funcBody || !is_object($funcBody)) return ;
154+
155+
//处理递归
156+
if($funcBody->getType() == "Stmt_Function"){
157+
$traverser = new PhpParser\NodeTraverser;
158+
$visitor = new RecursionFunctionVisitor() ;
159+
$visitor->funcName = $funcName ;
160+
$traverser->addVisitor($visitor) ;
161+
$traverser->traverse(array($funcBody)) ;
162+
if($visitor->isRecursion == true){
163+
return null;
164+
}
165+
}else if($funcBody->getType() == "Stmt_ClassMethod"){
166+
$traverser = new PhpParser\NodeTraverser;
167+
$visitor = new RecursionFunctionVisitor() ;
168+
$visitor->funcName = $funcName ;
169+
$traverser->addVisitor($visitor) ;
170+
$traverser->traverse(array($funcBody)) ;
171+
if($visitor->isRecursion == true){
172+
return null;
173+
}
174+
175+
}else if($funcBody->getType() == "Stmt_StaticCall"){
176+
$traverser = new PhpParser\NodeTraverser;
177+
$visitor = new RecursionFunctionVisitor() ;
178+
$visitor->funcName = $funcName ;
179+
$traverser->addVisitor($visitor) ;
180+
$traverser->traverse(array($funcBody)) ;
181+
if($visitor->isRecursion == true){
182+
return null;
183+
}
184+
185+
}
186+
187+
188+
return $funcBody;
150189
}
151190

152191
/**
@@ -341,28 +380,6 @@ public function leaveNode(Node $node){
341380
}
342381

343382

344-
345-
class InFunctionVisitor extends PhpParser\NodeVisitorAbstract{
346-
public $isSameFunction = false;
347-
public $funcName;
348-
public function leaveNode(PhpParser\Node $node){
349-
if(($node->getType() == 'Expr_FuncCall' ||
350-
$node->getType() == 'Expr_MethodCall' ||
351-
$node->getType() == 'Expr_StaticCall'||
352-
$node->getType() == "Expr_Isset")){
353-
$funcName = NodeUtils::getNodeFunctionName($node);
354-
355-
$funcName = substr($funcName, strpos($funcName, ':')+1);
356-
if ($funcName == $this->funcName){
357-
$this->isSameFunction = true;
358-
return ;
359-
}
360-
361-
362-
}
363-
}
364-
}
365-
366383
/*
367384
用来获取方法体的遍历
368385
*/
@@ -371,20 +388,12 @@ class FunctionBodyVisitor extends PhpParser\NodeVisitorAbstract{
371388
public $startLine ;
372389
public $endLine ;
373390
public $funcName ;
391+
private $isSameFunction = false;
374392

375393
public function leaveNode(PhpParser\Node $node){
376-
if(($node->getAttribute('startLine') == $this->startLine) && ($node->getAttribute('endLine') == $this->endLine)){
377-
$parser = new PhpParser\Parser(new PhpParser\Lexer\Emulative) ;
378-
$visitor = new InFunctionVisitor ;
379-
$traverser = new PhpParser\NodeTraverser ;
380-
$visitor->funcName = $this->funcName;
381-
$traverser->addVisitor($visitor) ;
382-
$traverser->traverse(array($node)) ;
383-
384-
if ($visitor->isSameFunction){
385-
return ;
386-
}
387-
$this->func_body = $node ;
394+
if(($node->getAttribute('startLine') == $this->startLine) &&
395+
($node->getAttribute('endLine') == $this->endLine)){
396+
$this->func_body = $node ;
388397
}
389398

390399
}
@@ -396,6 +405,53 @@ public function getFunctionBody(){
396405
}
397406

398407

408+
/**
409+
* 处理递归语句
410+
* 如果是递归，则返回true
411+
* @author Exploit
412+
*
413+
*/
414+
class RecursionFunctionVisitor extends PhpParser\NodeVisitorAbstract{
415+
public $funcName ;
416+
public $isRecursion = false;
417+
public function leaveNode(Node $node){
418+
//方法调用
419+
if($node->getType() == "Expr_FuncCall"){
420+
if($node->name == $this->funcName){
421+
$this->isRecursion = true ;
422+
}
423+
}
424+
425+
//静态方法
426+
if($node->getType() == "Expr_StaticCall"){
427+
$name = explode(":", $this->funcName) ;
428+
if(count($name) >= 2){
429+
$name = $name[1] ;
430+
}else{
431+
$name = $this->funcName ;
432+
}
433+
434+
if($node->name == $name){
435+
$this->isRecursion = true ;
436+
}
437+
}
438+
439+
//类方法
440+
if($node->getType() == "Expr_MethodCall"){
441+
$name = explode(":", $this->funcName) ;
442+
if(count($name) >= 2){
443+
$name = $name[1] ;
444+
}else{
445+
$name = $this->funcName ;
446+
}
447+
if($node->name == $name){
448+
$this->isRecursion = true ;
449+
}
450+
}
451+
}
452+
}
453+
454+
399455
/*
400456
遍历出审计工程中的所有代码
401457
并抽取出所有类的信息

‎main.php

+1
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ function convertResults($resContext){
106106
}
107107

108108
$scan_type = $scanType = strtoupper($scan_type);
109+
$encoding = strtoupper($encoding);
109110
$project_path = str_replace(array('\\','//'), '/', $project_path);
110111
$scan_path = str_replace(array('\\','//'), '/', $scan_path);
111112

0 commit comments

Comments
 (0)