From 868f96c759b6650d88ff9f4fbc5c048302134248 Mon Sep 17 00:00:00 2001
From: Sebastien Blot
Date: Wed, 20 Sep 2017 10:11:01 +0200
Subject: Initial import

---
 scripts/generate_rules.php | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 scripts/generate_rules.php

(limited to 'scripts/generate_rules.php')

diff --git a/scripts/generate_rules.php b/scripts/generate_rules.php
new file mode 100644
index 0000000..e286ef1
--- /dev/null
+++ b/scripts/generate_rules.php
@@ -0,0 +1,43 @@
+<?php
+
+if ($argc != 2) {
+	echo 'Please provide a folder as argument.';
+	die();
+}
+
+$functions_blacklist = ['shell_exec', 'exec', 'passthru', 'php_uname', 'popen',
+	'posix_kill', 'posix_mkfifo', 'posix_setpgid', 'posix_setsid', 'posix_setuid',
+	'posix_setgid', 'posix_uname', 'proc_close', 'proc_nice', 'proc_open',
+	'proc_terminate', 'proc_open', 'proc_get_status', 'dl', 'pnctl_exec',
+    'pnctl_fork', 'assert', 'system'];
+
+$extensions = ['php', 'php7', 'php5'];
+
+$path = realpath($argv[1]);
+
+$objects = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($path));
+foreach($objects as $name => $object){
+	if (FALSE === in_array (pathinfo($name, PATHINFO_EXTENSION), $extensions, true)) {
+		continue;
+	}
+
+	$hash = '';
+	$file_content = file_get_contents($name);
+
+	foreach(token_get_all($file_content) as $token) {
+		if ($token[0] != 319) {
+			continue;
+		}
+
+		if (in_array($token[1], $functions_blacklist, true)) {
+			if ('' === $hash) {
+				$hash = hash('sha256', $file_content);
+			}
+			echo 'sp.disable_function.function("' . $token[1] . '").filename("' . $name . '").hash("' . $hash . '").allow();' . "\n";
+		}
+	}
+}
+foreach($functions_blacklist as $fun) {
+	echo 'sp.disable_function.function("' . $fun . '").drop();' . "\n";
+
+}
-- 
cgit v1.3