def main():
try:
long_options = ['help', 'input-files=']
opts, _ = getopt.getopt(sys.argv[1:], "hi:", long_options)
except getopt.GetoptError:
# print help information and exit:
usage()
return -3
input_file_list = None
for o, a in opts:
if o in ('-h', '--help'):
usage()
return 0
if o in ('-i', '--input-files='):
input_file_list = a.split(',')
if input_file_list is None:
usage()
return -3
for input_file in input_file_list:
analyzer = PhpSCA(infile=input_file)
for vulnerability_type in analyzer.get_vulns():
print vulnerability_type
for vulnerability in analyzer.get_vulns()[vulnerability_type]:
print ' ', vulnerability
if len(analyzer.get_alerts()) > 0:
print ''
print 'Alerts:'
for alert in analyzer.get_alerts():
print alert
def test_classes_2(self):
code = '''
<?php
class A {
function foo($var) {
$this->prop = $var;
$this->baz();
}
function bar() {
include($this->prop);
}
function baz() {
$this->bar();
echo $_GET[1];
}
}
$obj1 = new A();
$obj1->foo($_GET[1]); # XSS, FILE
$obj1->bar('clean'); # FILE
$obj2 = new A();
$obj2->bar(); # Clean
$obj2->baz(); # XSS
?>
'''
analyzer = PhpSCA(code)
vulns = analyzer.get_vulns()
self.assertEquals(2, len(vulns['XSS']))
self.assertEquals(2, len(vulns['FILE_INCLUDE']))
def test_classes_3(self):
code = '''
<?php
class A {
function foo($var) {
$this->prop = $var;
}
function bar() {
$var = 'bla' . somefunc($this->prop);
echo $var;
}
}
$obj1 = new A();
$obj1->foo($_GET[1]);
$obj1->bar();
?>
'''
# Poperty to var test
analyzer = PhpSCA(code)
vulns = analyzer.get_vulns()
self.assertEquals(1, len(vulns['XSS']))
def analyze_(self, test_case):
for input_file_obj in test_case.files:
input_file_name = os.path.join(self.SAMATE_TEST_DIR, input_file_obj.file)
analyzer = PhpSCA(infile=input_file_name)
identified_vulns = []
for vuln_type in analyzer.get_vulns():
for vuln_func_call in analyzer.get_vulns()[vuln_type]:
identified_vulns.append((vuln_type, vuln_func_call[0]._lineno))
expected_vulns = []
for flaw in input_file_obj.flaws:
sca_name = SAMATE_TO_SCA[flaw.vuln_name]
expected_vulns.append((sca_name, int(flaw.vuln_line_no)))
#print set(expected_vulns), set(identified_vulns)
assert set(expected_vulns) == set(identified_vulns)
def test_include_require_2(self):
analyzer = PhpSCA(infile = os.path.join(self.TEST_DIR, '2', 'a.php'))
echo = analyzer.get_func_calls()[1]
self.assertTrue('XSS' in echo.vulntypes)
self.assertEquals('core' + os.sep + 'tests' + os.sep + 'test_include_require' + os.sep + '2' + os.sep + 'b.php', echo.get_file_name())
vulns = analyzer.get_vulns()
self.assertEquals('core' + os.sep + 'tests' + os.sep + 'test_include_require' + os.sep + '2' + os.sep + 'a.php', vulns['XSS'][0][-1].get_file_name())
self.assertEquals(2, vulns['XSS'][0][-1].lineno)
def test_classes_1(self):
code = '''
<?php
class A {
private $prop1 = 'ok';
function foo($var1) {
echo $_GET[1];
$this->prop1 = $var1;
}
function bar($prop2 = 'default') {
echo $this->prop1;
$this->prop2 = $prop2;
}
function baz() {
if (1) {
system($this->prop2);
}
}
}
$obj1 = new A();
$obj1->foo($_GET[1]); #XSS
$obj1->bar(); #XSS
$obj1->baz();
$awsome = $_POST[1];
$obj2 = new A();
$obj2->foo('test'); #XSS
$obj2->bar($awsome);
$obj2->baz(); #OS COMMANDING
$obj1->bar(); #XSS again
?>'''
analyzer = PhpSCA(code)
vulns = analyzer.get_vulns()
self.assertEquals(4, len(vulns['XSS']))
self.assertEquals(1, len(vulns['OS_COMMANDING']))
self.assertEquals(18, vulns['OS_COMMANDING'][0][0].lineno)
self.assertEquals('$awsome', vulns['OS_COMMANDING'][0][-1].name)
self.assertEquals(28, vulns['OS_COMMANDING'][0][-1].lineno)
objects = analyzer.get_objects();
self.assertTrue('$obj1' and '$obj2' in objects)
