Merge pull request #56 from BitScout/22-detect-shell-exec-via-backticks

feat(ban): Add rule to ban shell execution via backticks

Author: mremi

CHANGELOG.md

@@ -4,7 +4,7 @@ CHANGELOG
 master
 ------
 
-* todo...
+* Added rule to ban shell execution via backticks
 
 v1.0.0
 ------

README.md

@@ -64,6 +64,11 @@ parameters:
 					- system
 					- var_dump
 
+			# enable detection of shell execution by backticks
+			-
+				type: Expr_ShellExec
+				functions: null
+
 		# enable detection of `use Tests\Foo\Bar` in a non-test file
 		use_from_tests: true
 ```

extension.neon

@@ -41,6 +41,11 @@ parameters:
 					- system
 					- var_dump
 
+			# enable detection of shell execution by backticks
+			-
+				type: Expr_ShellExec
+				functions: null
+
 		# enable detection of `use Tests\Foo\Bar` in a non-test file
 		use_from_tests: true
 

snippets/backticks.php

@@ -0,0 +1,3 @@
+<?php
+
+`ls -lsa`;

snippets/echo.php

@@ -1,4 +1,3 @@
 <?php
 
 echo 'test echo';
-

snippets/eval.php

@@ -1,4 +1,3 @@
 <?php
 
 eval(true);
-

snippets/exec.php

@@ -1,4 +1,3 @@
 <?php
 
-exec('');
-
+exec('ls -lsa');

snippets/exit.php

@@ -1,4 +1,3 @@
 <?php
 
 exit;
-

snippets/passthru.php

@@ -1,4 +1,3 @@
 <?php
 
 passthru('');
-

snippets/phpinfo.php

@@ -1,4 +1,3 @@
 <?php
 
 phpinfo();
-

snippets/print_r.php

@@ -1,4 +1,3 @@
 <?php
 
 print_r('');
-

snippets/proc_open.php

@@ -1,4 +1,4 @@
 <?php
+
 $pipes = [];
 proc_open('', [], $pipes);
-

snippets/shell_exec.php

@@ -1,4 +1,3 @@
 <?php
 
 shell_exec('');
-

snippets/system.php

@@ -1,4 +1,3 @@
 <?php
 
 system('');
-

snippets/var_dump.php

@@ -1,4 +1,3 @@
 <?php
 
 var_dump('');
-

tests/Rules/BannedNodesRuleTest.php

@@ -20,6 +20,7 @@
 use PhpParser\Node\Expr\Exit_;
 use PhpParser\Node\Expr\FuncCall;
 use PhpParser\Node\Expr\Include_;
+use PhpParser\Node\Expr\ShellExec;
 use PhpParser\Node\Expr\Variable;
 use PhpParser\Node\Name;
 use PhpParser\Node\Scalar\LNumber;
@@ -52,6 +53,7 @@ protected function setUp(): void
             ['type' => 'Expr_Eval'],
             ['type' => 'Expr_Exit'],
             ['type' => 'Expr_FuncCall', 'functions' => ['debug_backtrace', 'dump']],
+            ['type' => 'Expr_ShellExec'],
         ]);
         $this->scope = $this->createMock(Scope::class);
     }
@@ -128,11 +130,12 @@ public function getUnhandledNodes(): \Generator
     }
 
     /**
-     * @return \Generator<array<Eval_|Exit_>>
+     * @return \Generator<array<mixed>>
      */
     public function getHandledNodes(): \Generator
     {
         yield [new Eval_($this->createMock(Expr::class))];
         yield [new Exit_()];
+        yield [new ShellExec([''])];
     }
 }