diff options
| author | jvoisin | 2018-01-18 10:38:50 +0100 |
|---|---|---|
| committer | jvoisin | 2018-01-18 10:38:50 +0100 |
| commit | f99a8cfbb711756a2c6520a52768f49d9a4380c4 (patch) | |
| tree | 92470277e9a79cb769ec749ad09db7804c9006b4 | |
| parent | e2b74815a4bdb8fde177d4dce2e3aa1ba3792617 (diff) | |
Improve the way we're dealing with filtering on parameter positions
This should close #127
| -rw-r--r-- | src/sp_disabled_functions.c | 6 | ||||
| -rw-r--r-- | src/tests/disabled_functions_param_pos.phpt | 2 | ||||
| -rw-r--r-- | src/tests/disabled_functions_pos_type.phpt | 6 |
3 files changed, 7 insertions, 7 deletions
diff --git a/src/sp_disabled_functions.c b/src/sp_disabled_functions.c index f5051df..933b9af 100644 --- a/src/sp_disabled_functions.c +++ b/src/sp_disabled_functions.c | |||
| @@ -117,12 +117,12 @@ static bool is_param_matching(zend_execute_data* execute_data, | |||
| 117 | const char* builtin_param, const char** arg_name, | 117 | const char* builtin_param, const char** arg_name, |
| 118 | const char* builtin_param_name, | 118 | const char* builtin_param_name, |
| 119 | const char** arg_value_str) { | 119 | const char** arg_value_str) { |
| 120 | int nb_param = execute_data->func->common.num_args; | 120 | int nb_param = ZEND_CALL_NUM_ARGS(execute_data); |
| 121 | int i = 0; | 121 | int i = 0; |
| 122 | zval* arg_value; | 122 | zval* arg_value; |
| 123 | 123 | ||
| 124 | if (config_node->pos != -1) { | 124 | if (config_node->pos != -1) { |
| 125 | if (config_node->pos <= nb_param) { | 125 | if (config_node->pos > nb_param - 1) { |
| 126 | char* complete_function_path = get_complete_function_path(execute_data); | 126 | char* complete_function_path = get_complete_function_path(execute_data); |
| 127 | sp_log_err("config", | 127 | sp_log_err("config", |
| 128 | "It seems that you wrote a rule filtering on the " | 128 | "It seems that you wrote a rule filtering on the " |
| @@ -160,7 +160,7 @@ static bool is_param_matching(zend_execute_data* execute_data, | |||
| 160 | 160 | ||
| 161 | /* This is the parameter name we're looking for. */ | 161 | /* This is the parameter name we're looking for. */ |
| 162 | if (true == pcre_matching || config_node->pos != -1) { | 162 | if (true == pcre_matching || config_node->pos != -1) { |
| 163 | arg_value = ZEND_CALL_VAR_NUM(execute_data, i); | 163 | arg_value = ZEND_CALL_ARG(execute_data, i + 1); |
| 164 | 164 | ||
| 165 | if (config_node->param_type) { // Are we matching on the `type`? | 165 | if (config_node->param_type) { // Are we matching on the `type`? |
| 166 | if (config_node->param_type == Z_TYPE_P(arg_value)) { | 166 | if (config_node->param_type == Z_TYPE_P(arg_value)) { |
diff --git a/src/tests/disabled_functions_param_pos.phpt b/src/tests/disabled_functions_param_pos.phpt index a1f8895..1654b5d 100644 --- a/src/tests/disabled_functions_param_pos.phpt +++ b/src/tests/disabled_functions_param_pos.phpt | |||
| @@ -9,5 +9,5 @@ sp.configuration_file={PWD}/config/disabled_functions_pos.ini | |||
| 9 | system("id"); | 9 | system("id"); |
| 10 | ?> | 10 | ?> |
| 11 | --EXPECTF-- | 11 | --EXPECTF-- |
| 12 | [snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 0th argument of the function 'system', but it takes only 2 arguments. Matching on _all_ arguments instead. | 12 | [snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 1337th argument of the function 'system', but it takes only 1 arguments. Matching on _all_ arguments instead. |
| 13 | [snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/disabled_functions_param_pos.php:2 has been disabled, because its argument 'command' content (id) matched a rule. | 13 | [snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/disabled_functions_param_pos.php:2 has been disabled, because its argument 'command' content (id) matched a rule. |
diff --git a/src/tests/disabled_functions_pos_type.phpt b/src/tests/disabled_functions_pos_type.phpt index 7556440..1197971 100644 --- a/src/tests/disabled_functions_pos_type.phpt +++ b/src/tests/disabled_functions_pos_type.phpt | |||
| @@ -9,6 +9,6 @@ sp.configuration_file={PWD}/config/disabled_functions_pos.ini | |||
| 9 | system([123, 456]); | 9 | system([123, 456]); |
| 10 | ?> | 10 | ?> |
| 11 | --EXPECTF-- | 11 | --EXPECTF-- |
| 12 | [snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 0th argument of the function 'system', but it takes only 2 arguments. Matching on _all_ arguments instead. | 12 | [snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 1337th argument of the function 'system', but it takes only 1 arguments. Matching on _all_ arguments instead. |
| 13 | [snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 1st argument of the function 'system', but it takes only 2 arguments. Matching on _all_ arguments instead. | 13 | [snuffleupagus][0.0.0.0][config][error] It seems that you wrote a rule filtering on the 1st argument of the function 'system', but it takes only 1 arguments. Matching on _all_ arguments instead. |
| 14 | [snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/disabled_functions_pos_type.php:2 has been disabled, because its argument 'command' content (?) matched the rule '1'. | 14 | [snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/tests/disabled_functions_pos_type.php:2 has been disabled, because its argument 'command' content (?) matched the rule '1'. |
