summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorjvoisin2018-01-18 10:38:50 +0100
committerjvoisin2018-01-18 10:38:50 +0100
commitf99a8cfbb711756a2c6520a52768f49d9a4380c4 (patch)
tree92470277e9a79cb769ec749ad09db7804c9006b4
parente2b74815a4bdb8fde177d4dce2e3aa1ba3792617 (diff)
Improve the way we're dealing with filtering on parameter positions
This should close #127
-rw-r--r--src/sp_disabled_functions.c6
-rw-r--r--src/tests/disabled_functions_param_pos.phpt2
-rw-r--r--src/tests/disabled_functions_pos_type.phpt6
3 files changed, 7 insertions, 7 deletions
diff --git a/src/sp_disabled_functions.c b/src/sp_disabled_functions.c
index f5051df..933b9af 100644
--- a/src/sp_disabled_functions.c
+++ b/src/sp_disabled_functions.c
@@ -117,12 +117,12 @@ static bool is_param_matching(zend_execute_data* execute_data,
117 const char* builtin_param, const char** arg_name, 117 const char* builtin_param, const char** arg_name,
118 const char* builtin_param_name, 118 const char* builtin_param_name,
119 const char** arg_value_str) { 119 const char** arg_value_str) {
120 int nb_param = execute_data->func->common.num_args; 120 int nb_param = ZEND_CALL_NUM_ARGS(execute_data);
121 int i = 0; 121 int i = 0;
122 zval* arg_value; 122 zval* arg_value;
123 123
124 if (config_node->pos != -1) { 124 if (config_node->pos != -1) {
125 if (config_node->pos <= nb_param) { 125 if (config_node->pos > nb_param - 1) {
126 char* complete_function_path = get_complete_function_path(execute_data); 126 char* complete_function_path = get_complete_function_path(execute_data);
127 sp_log_err("config", 127 sp_log_err("config",
128 "It seems that you wrote a rule filtering on the " 128 "It seems that you wrote a rule filtering on the "
@@ -160,7 +160,7 @@ static bool is_param_matching(zend_execute_data* execute_data,
160 160
161 /* This is the parameter name we're looking for. */ 161 /* This is the parameter name we're looking for. */
162 if (true == pcre_matching || config_node->pos != -1) { 162 if (true == pcre_matching || config_node->pos != -1) {
163 arg_value = ZEND_CALL_VAR_NUM(execute_data, i); 163 arg_value = ZEND_CALL_ARG(execute_data, i + 1);
164 164
165 if (config_node->param_type) { // Are we matching on the `type`? 165 if (config_node->param_type) { // Are we matching on the `type`?
166 if (config_node->param_type == Z_TYPE_P(arg_value)) { 166 if (config_node->param_type == Z_TYPE_P(arg_value)) {
diff --git a/src/tests/disabled_functions_param_pos.phpt b/src/tests/disabled_functions_param_pos.phpt
index a1f8895..1654b5d 100644
--- a/src/tests/disabled_functions_param_pos.phpt
+++ b/src/tests/disabled_functions_param_pos.phpt
@@ -9,5 +9,5 @@ sp.configuration_file={PWD}/config/disabled_functions_pos.ini
9system("id"); 9system("id");
10?> 10?>
11--EXPECTF-- 11--EXPECTF--
12[snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 0th argument of the function 'system', but it takes only 2 arguments. Matching on _all_ arguments instead. 12[snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 1337th argument of the function 'system', but it takes only 1 arguments. Matching on _all_ arguments instead.
13[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/disabled_functions_param_pos.php:2 has been disabled, because its argument 'command' content (id) matched a rule. 13[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/disabled_functions_param_pos.php:2 has been disabled, because its argument 'command' content (id) matched a rule.
diff --git a/src/tests/disabled_functions_pos_type.phpt b/src/tests/disabled_functions_pos_type.phpt
index 7556440..1197971 100644
--- a/src/tests/disabled_functions_pos_type.phpt
+++ b/src/tests/disabled_functions_pos_type.phpt
@@ -9,6 +9,6 @@ sp.configuration_file={PWD}/config/disabled_functions_pos.ini
9system([123, 456]); 9system([123, 456]);
10?> 10?>
11--EXPECTF-- 11--EXPECTF--
12[snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 0th argument of the function 'system', but it takes only 2 arguments. Matching on _all_ arguments instead. 12[snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 1337th argument of the function 'system', but it takes only 1 arguments. Matching on _all_ arguments instead.
13[snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 1st argument of the function 'system', but it takes only 2 arguments. Matching on _all_ arguments instead. 13[snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 1st argument of the function 'system', but it takes only 1 arguments. Matching on _all_ arguments instead.
14[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/disabled_functions_pos_type.php:2 has been disabled, because its argument 'command' content (?) matched the rule '1'. 14[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/tests/disabled_functions_pos_type.php:2 has been disabled, because its argument 'command' content (?) matched the rule '1'.