Skip to content
This repository was archived by the owner on Nov 28, 2023. It is now read-only.

Commit 5b05623

Browse files
authored
Merge pull request #532 from BlBana/origin/develop
Optimization of detection eval
2 parents ffefb27 + b6550df commit 5b05623

File tree

2 files changed

+13
-2
lines changed

2 files changed

+13
-2
lines changed

cobra/cve_parse.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -390,8 +390,8 @@ def parse_math(cve_path, cve_id, cve_level, module_):
390390
mr.rule_name = rule_name
391391
mr.level = cve_level
392392
mr.file_path = module_name
393-
mr.line_number = module_version
394-
mr.code_content = 'Module:' + mr.file_path
393+
mr.line_number = 1
394+
mr.code_content = module_name + ':' + module_version
395395

396396
logger.debug('[CVE {i}] {r}:Find {n}:{v} have vul {c} and level is {l}'.format(i=mr.id, r=mr.rule_name,
397397
n=mr.file_path, v=mr.line_number,

cobra/parser.py

+11
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,12 @@ def get_silence_params(node):
9595
if isinstance(node.expr, php.FunctionCall):
9696
param.append(node.expr)
9797

98+
if isinstance(node.expr, php.Eval):
99+
param.append(node.expr)
100+
101+
if isinstance(node.expr, php.Assignment):
102+
param.append(node.expr)
103+
98104
return param
99105

100106

@@ -608,6 +614,7 @@ def analysis(nodes, vul_function, back_node, vul_lineo, function_params=None):
608614
:param function_params: 自定义函数的所有参数列表
609615
:return:
610616
"""
617+
buffer_ = []
611618
for node in nodes:
612619
if isinstance(node, php.FunctionCall): # 函数直接调用,不进行赋值
613620
anlysis_function(node, back_node, vul_function, function_params, vul_lineo)
@@ -619,6 +626,10 @@ def analysis(nodes, vul_function, back_node, vul_lineo, function_params=None):
619626
if isinstance(node.expr, php.Eval):
620627
analysis_eval(node.expr, vul_function, back_node, vul_lineo, function_params)
621628

629+
if isinstance(node.expr, php.Silence):
630+
buffer_.append(node.expr)
631+
analysis(buffer_, vul_function, back_node, vul_lineo, function_params)
632+
622633
elif isinstance(node, php.Print) or isinstance(node, php.Echo):
623634
analysis_echo_print(node, back_node, vul_function, vul_lineo, function_params)
624635

0 commit comments

Comments
 (0)