From ad4467dabd8ebfd1c87bf6aa2aa0f0b18ecdd536 Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Thu, 8 Dec 2016 13:46:29 +0100
Subject: Add a '${${' rule

---
 php-malware-finder/php.yar  | 1 +
 php-malware-finder/tests.sh | 1 +
 2 files changed, 2 insertions(+)

diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
index 2ac9027..8a08308 100644
--- a/php-malware-finder/php.yar
+++ b/php-malware-finder/php.yar
@@ -96,6 +96,7 @@ rule DodgyPhp
         $udp_dos = /fsockopen\s*\(\s*['"]udp:\/\// nocase
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
         $at_eval = /@eval\s*\(/ nocase
+        $double_var = /\${\s*\${/
 
     condition:
         (any of them) and not IsWhitelisted
diff --git a/php-malware-finder/tests.sh b/php-malware-finder/tests.sh
index 4f1c765..d362a14 100755
--- a/php-malware-finder/tests.sh
+++ b/php-malware-finder/tests.sh
@@ -91,6 +91,7 @@ run_test artificial/bypasses.php "0x132:\$var_as_func: \$_POST\['funct'\]("
 run_test real/sucuri_2014_04.php '0x67:$execution3:'
 run_test real/novahot.php 'DodgyStrings'
 run_test real/guidtz.php '0x12d8:$non_printables:'
+run_test real/ice.php 'double_var'
 
 # Asp files
 run_test_asp classic/cmdasp.asp 'DodgyStrings'
-- 
cgit v1.3