Skip to content

Commit 5694a64

Browse files
eric-theronderic-therond
authored
Merge pull request #61 from designsecurity/update
update
2 parents 04affa6 + 8ecf205 commit 5694a64

File tree

11 files changed

+63
-63
lines changed

11 files changed

+63
-63
lines changed

‎.devcontainer/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ FROM php:8.1.13-cli
33
RUN apt-get update && apt-get install -y vim git sudo wget
44

55
RUN php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" \
6-
&& php -r "if (hash_file('sha384', 'composer-setup.php') === '55ce33d7678c5a611085589f1f3ddf8b3c52d662cd01d4ba75c0ee0459970c2200a51f492d557530c71c15d8dba01eae') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;" \
6+
&& php -r "if (hash_file('sha384', 'composer-setup.php') === 'dac665fdc30fdd8ec78b38b9800061b4150413ff2e3b6f88543c636f7cd84f6db9189d43a81e5503cda447da73c7e5b6') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;" \
77
&& php composer-setup.php \
88
&& php -r "unlink('composer-setup.php');" \
99
&& sudo mv composer.phar /usr/local/bin/composer \

‎.gitattributes

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# All files are checked into the repo with LF
2+
* text=auto
3+
4+
# These files are checked out using LF locally
5+
*.* eol=lf

‎.github/workflows/main.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ jobs:
1414
- "8.0"
1515
- "8.1"
1616
- "8.2"
17+
- "8.3"
1718
steps:
1819
- name: "Checkout"
1920
uses: "actions/checkout@v2"

‎build.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#!/usr/bin/env bash
1+
#!/bin/bash
22

33
# Check if phar-composer.phar is in the $PATH
44
if ! [ -x "$(command -v phar-composer.phar)" ]; then

‎package/src/progpilot/Analysis/SecurityAnalysis.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,12 +92,12 @@ public static function taintedStateFlow($context, $mySink, $indexParameter, $tai
9292
$oneTainted["flow_name"] = $ret["source_name"];
9393
$oneTainted["flow_line"] = $ret["source_line"];
9494
$oneTainted["flow_column"] = $ret["source_column"];
95-
$oneTainted["flow_file"] =$ret["source_file"];
95+
$oneTainted["flow_file"] = $ret["source_file"];
9696

9797
$resultTaintedFlow[] = $oneTainted;
9898

9999
$idFlow .= \progpilot\Utils::printDefinition($fromTaintedDef);
100-
$idFlow .= "-".$fromTaintedDef->getSourceMyFile()->getName();
100+
$idFlow .= "-".$fromTaintedDef->getSourceMyFile()->fileName;
101101
$taintedDef = $fromTaintedDef;
102102
$taintedState = $fromTaintedState;
103103
break 2;

‎package/src/progpilot/Analyzer.php

Lines changed: 17 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -347,7 +347,7 @@ public function run($context, $cmdFiles = null)
347347

348348
$context->readConfiguration();
349349
// try to resolve incorrect included/excluded file paths
350-
$context->inputs->resolvePaths();
350+
$context->inputs->resolvePathsIncludedAndExcludedFiles();
351351

352352
// add all configurations inside frameworks folders except if overwritten
353353
$context->inputs->readFrameworks();
@@ -360,17 +360,15 @@ public function run($context, $cmdFiles = null)
360360
$context->inputs->readDefaultCustomRules();
361361

362362
if ($cmdFiles !== null) {
363+
$cmdFiles = \progpilot\Inputs\MyInputsInternalApi::resolvePaths($cmdFiles);
363364
foreach ($cmdFiles as $cmdFile) {
364365
if (is_dir($cmdFile)) {
365366
$this->getFilesOfDir($context, $cmdFile, $cmdFile, $files);
366367
} else {
367-
$realpath = realpath($cmdFile);
368-
if($realpath) {
369-
$cmdFileA = new FileAnalysis($realpath, dirname($realpath));
370-
if (!in_array($cmdFileA, $files, true)
371-
&& !$context->inputs->isExcludedFile($realpath)) {
372-
$files[] = $cmdFileA;
373-
}
368+
$cmdFileA = new FileAnalysis($cmdFile, dirname($cmdFile));
369+
if (!in_array($cmdFileA, $files, true)
370+
&& !$context->inputs->isExcludedFile($cmdFile)) {
371+
$files[] = $cmdFileA;
374372
}
375373
}
376374
}
@@ -382,28 +380,24 @@ public function run($context, $cmdFiles = null)
382380
if (is_dir($includedFile)) {
383381
$this->getFilesOfDir($context, $includedFile, $includedFile, $files);
384382
} else {
385-
$realpath = realpath($includedFile);
386-
if($realpath) {
387-
$cmdFileA = new FileAnalysis($realpath, dirname($realpath));
388-
if (!in_array($cmdFileA, $files, true)
389-
&& !$context->inputs->isExcludedFile($realpath)) {
390-
$files[] = $cmdFileA;
391-
}
383+
$cmdFileA = new FileAnalysis($includedFile, dirname($includedFile));
384+
if (!in_array($cmdFileA, $files, true)
385+
&& !$context->inputs->isExcludedFile($includedFile)) {
386+
$files[] = $cmdFileA;
392387
}
393388
}
394389
}
395390

396391
if (!is_null($context->inputs->getFolder())) {
397-
$this->getFilesOfDir($context, $context->inputs->getFolder(), $context->inputs->getFolder(), $files);
392+
$folder = \progpilot\Inputs\MyInputsInternalApi::resolvePath($context->inputs->getFolder());
393+
$this->getFilesOfDir($context, $folder, $folder, $files);
398394
} else {
399395
if ($context->inputs->getFile() !== null) {
400-
$realpath = realpath($context->inputs->getFile());
401-
if($realpath) {
402-
$cmdFileA = new FileAnalysis($realpath, dirname($realpath));
403-
if (!in_array($cmdFileA, $files, true)
404-
&& !$context->inputs->isExcludedFile($realpath)) {
405-
$files[] = $cmdFileA;
406-
}
396+
$file = \progpilot\Inputs\MyInputsInternalApi::resolvePath($context->inputs->getFile());
397+
$cmdFileA = new FileAnalysis($file, dirname($file));
398+
if (!in_array($cmdFileA, $files, true)
399+
&& !$context->inputs->isExcludedFile($file)) {
400+
$files[] = $cmdFileA;
407401
}
408402
}
409403
}

‎package/src/progpilot/Console/Application.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
class Application extends BaseApplication
1818
{
1919
const NAME = 'progpilot';
20-
const VERSION = '1.0.2';
20+
const VERSION = '1.1.0';
2121

2222
public function __construct()
2323
{

‎package/src/progpilot/Inputs/MyInputsInternalApi.php

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -70,50 +70,50 @@ public function __construct()
7070
$this->falsePositives= null;
7171
}
7272

73-
public function resolvePaths()
73+
public static function resolvePath($file)
7474
{
75-
$tmpFiles = $this->excludesFilesAnalysis;
76-
$this->excludesFilesAnalysis = [];
75+
if (strpos($file, "/") !== false
76+
|| strpos($file, "\\") !== false) {
77+
// there is a slash, the dev likely wants a path
78+
if (str_starts_with("./", $file) === 0
79+
&& str_starts_with(".\\", $file) === 0
80+
&& str_starts_with("/", $file) === 0
81+
&& preg_match("/^[a-bA-B]*:/", $file) === 0) {
82+
// it's not a relative or absolute path
83+
$file = ".".DIRECTORY_SEPARATOR.$file;
84+
}
7785

78-
foreach ($tmpFiles as $excludedFile) {
79-
if (strpos($excludedFile, "/") !== false
80-
|| strpos($excludedFile, "\\") !== false) {
81-
// there is a slash, the dev likely wants a path
82-
if (str_starts_with("./", $excludedFile) === 0
83-
&& str_starts_with(".\\", $excludedFile) === 0
84-
&& str_starts_with("/", $excludedFile) === 0
85-
&& preg_match("/^[a-bA-B]*:/", $excludedFile) === 0) {
86-
// it's not a relative or absolute path
87-
$excludedFile = ".".DIRECTORY_SEPARATOR.$excludedFile;
88-
}
86+
$file = realpath($file);
87+
}
8988

90-
$excludedFile = realpath($excludedFile);
91-
}
89+
return $file;
90+
}
9291

92+
public static function resolvePaths($files)
93+
{
94+
$resolvePaths = [];
95+
foreach ($files as $file) {
96+
$resolvePaths[] = MyInputsInternalApi::resolvePath($file);
97+
}
98+
99+
return $resolvePaths;
100+
}
101+
102+
public function resolvePathsIncludedAndExcludedFiles()
103+
{
104+
$tmpFiles = MyInputsInternalApi::resolvePaths($this->excludesFilesAnalysis);
105+
$this->excludesFilesAnalysis = [];
106+
107+
foreach ($tmpFiles as $excludedFile) {
93108
if (!in_array($excludedFile, $this->excludesFilesAnalysis, true)) {
94109
$this->excludesFilesAnalysis[] = $excludedFile;
95110
}
96111
}
97112

98-
99-
$tmpFiles = $this->includesFilesAnalysis;
113+
$tmpFiles = MyInputsInternalApi::resolvePaths($this->includesFilesAnalysis);
100114
$this->includesFilesAnalysis = [];
101115

102116
foreach ($tmpFiles as $includedFile) {
103-
if (strpos($includedFile, "/") !== false
104-
|| strpos($includedFile, "\\") !== false) {
105-
// there is a slash, the dev likely wants a path
106-
if (str_starts_with("./", $includedFile) === 0
107-
&& str_starts_with(".\\", $includedFile) === 0
108-
&& str_starts_with("/", $includedFile) === 0
109-
&& preg_match("/^[a-bA-B]*:/", $includedFile) === 0) {
110-
// it's not a relative or absolute path
111-
$includedFile = ".".DIRECTORY_SEPARATOR.$includedFile;
112-
}
113-
114-
$includedFile = realpath($includedFile);
115-
}
116-
117117
if (!in_array($includedFile, $this->includesFilesAnalysis, true)) {
118118
$this->includesFilesAnalysis[] = $includedFile;
119119
}

‎projects/example/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"description": "Example of use of Progpilot",
44
"require": {
55
"php": ">=7.4",
6-
"designsecurity/progpilot": "^1.0.2",
6+
"designsecurity/progpilot": "^1.1.0",
77
"ircmaxell/php-cfg": "^0.7.0"
88
}
99
}

‎projects/example_config/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
],
1010
"require": {
1111
"php": ">=7.4",
12-
"progpilot/package": "^1.0.2",
12+
"progpilot/package": "^1.1.0",
1313
"ircmaxell/php-cfg": "^0.7.0"
1414
}
1515
}

‎projects/tests/tests/real/composer/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"name": "test vuln composer package",
2+
"name": "test/vuln",
33
"description": "test vuln composer package",
44
"repositories": [
55
{

0 commit comments

Comments
 (0)