irm-1.6-b3/lib/Savant2/Savant2_Compiler_basic.php
/**
	* 
	* Analyze a compiled template for restriction violations.
	* 
	* @access public
	* 
	* @var string $php The compiled PHP code from a template source.
	* 
	* @return array An array of restriction violations; if empty, then
	* there were no violations discovered by analysis.
	* 
	*/
Analyze a compiled template for restriction violations.

@access public

@var string $php The compiled PHP code from a template source.

@return array An array of restriction violations; if empty, then
there were no violations discovered by analysis.
Analyze a compiled template for restriction violations . @access public @var string $php The compiled PHP code from a template source . @return array An array of restriction violations ; if empty then there were no violations discovered by analysis .
function analyze(&$php)
	{
		$ca =& $this->ca;
		$ca->source =& $php;
		$ca->analyze();
		$report = array();
		 go through the list of called functions and make sure each
		 one is allowed via the whitelist.  if not, record each non-
		 allowed function.  this also restricts variable-functions
		 such as $var().
		foreach ($ca->calledFunctions as $func => $lines) {
			if (! in_array($func, $this->allowedFunctions)) {
				$report[$func] = $lines;
			}
		}
		 disallow use of various constructs (include is allowed, we
		 need it for {tpl}).
		$tmp = array(
			'eval',
			'global',
			'include_once',
			'require',
			'require_once',
			'parent',
			'self'
		);
		foreach ($tmp as $val) {
			if (isset($ca->calledConstructs[$val])) {
				$report[$val] = $ca->calledConstructs[$val];
			}
		}
		 disallow instantiation of new classes
		foreach ($ca->classesInstantiated as $key => $val) {
			$report['new ' . $key] = $val;
		}
		 disallow access to the various superglobals
		 so that templates cannot manipulate them.
		$tmp = array(
			'$_COOKIE',
			'$_ENV',
			'$_FILES',
			'$_GET',
			'$_POST',
			'$_REQUEST',
			'$_SERVER',
			'$_SESSION',
			'$GLOBALS',
			'$HTTP_COOKIE_VARS',
			'$HTTP_ENV_VARS',
			'$HTTP_GET_VARS',
			'$HTTP_POST_FILES',
			'$HTTP_POST_VARS',
			'$HTTP_SERVER_VARS',
			'$HTTP_SESSION_VARS'
		);
		foreach ($ca->usedVariables as $var => $lines) {
			if (in_array(strtoupper($var), $tmp)) {
				$report[$var] = $lines;
			}
		}
		 allow only certain $this methods
		$tmp = array('plugin', 'splugin', 'findTemplate');
		if (isset($ca->calledMethods['$this'])) {
			foreach ($ca->calledMethods['$this'] as $method => $lines) {
				if (! in_array($method, $tmp)) {
					$report['$this->' . $method] = $lines;
				}
			}
		}
		 disallow private and variable-variable $this properties
		if (isset($ca->usedMemberVariables['$this'])) {
			foreach ($ca->usedMemberVariables['$this'] as $prop => $lines) {
				$char = substr($prop, 0, 1);
				if ($char == '_' || $char == '$') {
					$report['$this->' . $prop] = $lines;
				}
			}
		}
		 allow only certain static method calls
		foreach ($ca->calledStaticMethods as $class => $methods) {
			foreach ($methods as $method => $lines) {
				if (! array_key_exists($class, $this->allowedStatic)) {
					 the class itself is not allowed
					$report["$class::$method"] = $lines;
				} elseif (! in_array('*', $this->allowedStatic[$class]) &&
					! in_array($method, $this->allowedStatic[$class])){
					 the specific method is not allowed,
					 and there is no wildcard for the class methods.
					$report["$class::$method"] = $lines;
				}
			}
		}
		 only allow includes via $this->findTemplate(*)
		foreach ($ca->filesIncluded as $text => $lines) {
			 in each include statment, look for $this->findTemplate.
			preg_match(
				'/(.*)?\$this->findTemplate\((.*)?\)(.*)/i',
				$text,
				$matches
			);
			if (! empty($matches[1]) || ! empty($matches[3]) ||
				empty($matches[2])) {
				 there is something before or after the findTemplate call,
				 or it's a direct include (which is not allowed)
				$report["include $text"] = $lines;
			}
		}
		 do not allow the use of "$this" by itself;
		 it must be always be followed by "->" or another
		 valid variable-name character (a-z, 0-9, or _).
		$regex = '/(.*)?\$this(?!(\-\>)|([a-z0-9_]))(.*)?/i';
		preg_match_all($regex, $php, $matches, PREG_SET_ORDER);
		foreach ($matches as $val) {
			$report['\'$this\' without \'->\''][] = $val[0];
		}
		 done!
		 +++ DEBUG
		echo "<pre>";
		print_r($ca);
		echo "</pre>";
		 --- DEBUG
		return $report;
	}
function analyze ( & $ php ) { $ ca = & $ this -> ca ; $ ca -> source = & $ php ; $ ca -> analyze ( ) ; $ report = array ( ) ; foreach ( $ ca -> calledFunctions as $ func => $ lines ) { if ( ! in_array ( $ func , $ this -> allowedFunctions ) ) { $ report [ $ func ] = $ lines ; } } $ tmp = array ( 'eval' , 'global' , 'include_once' , 'require' , 'require_once' , 'parent' , 'self' ) ; foreach ( $ tmp as $ val ) { if ( isset ( $ ca -> calledConstructs [ $ val ] ) ) { $ report [ $ val ] = $ ca -> calledConstructs [ $ val ] ; } } foreach ( $ ca -> classesInstantiated as $ key => $ val ) { $ report [ 'new ' . $ key ] = $ val ; } $ tmp = array ( '$_COOKIE' , '$_ENV' , '$_FILES' , '$_GET' , '$_POST' , '$_REQUEST' , '$_SERVER' , '$_SESSION' , '$GLOBALS' , '$HTTP_COOKIE_VARS' , '$HTTP_ENV_VARS' , '$HTTP_GET_VARS' , '$HTTP_POST_FILES' , '$HTTP_POST_VARS' , '$HTTP_SERVER_VARS' , '$HTTP_SESSION_VARS' ) ; foreach ( $ ca -> usedVariables as $ var => $ lines ) { if ( in_array ( strtoupper ( $ var ) , $ tmp ) ) { $ report [ $ var ] = $ lines ; } } $ tmp = array ( 'plugin' , 'splugin' , 'findTemplate' ) ; if ( isset ( $ ca -> calledMethods [ '$this' ] ) ) { foreach ( $ ca -> calledMethods [ '$this' ] as $ method => $ lines ) { if ( ! in_array ( $ method , $ tmp ) ) { $ report [ '$this->' . $ method ] = $ lines ; } } } if ( isset ( $ ca -> usedMemberVariables [ '$this' ] ) ) { foreach ( $ ca -> usedMemberVariables [ '$this' ] as $ prop => $ lines ) { $ char = substr ( $ prop , 0 , 1 ) ; if ( $ char == '_' || $ char == '$' ) { $ report [ '$this->' . $ prop ] = $ lines ; } } } foreach ( $ ca -> calledStaticMethods as $ class => $ methods ) { foreach ( $ methods as $ method => $ lines ) { if ( ! array_key_exists ( $ class , $ this -> allowedStatic ) ) { $ report [ " $ class :: $ method " ] = $ lines ; } elseif ( ! in_array ( '*' , $ this -> allowedStatic [ $ class ] ) && ! in_array ( $ method , $ this -> allowedStatic [ $ class ] ) ) { $ report [ " $ class :: $ method " ] = $ lines ; } } } foreach ( $ ca -> filesIncluded as $ text => $ lines ) { preg_match ( '/(.*)?\$this->findTemplate\((.*)?\)(.*)/i' , $ text , $ matches ) ; if ( ! empty ( $ matches [ 1 ] ) || ! empty ( $ matches [ 3 ] ) || empty ( $ matches [ 2 ] ) ) { $ report [ " include  $ text " ] = $ lines ; } } $ regex = '/(.*)?\$this(?!(\-\>)|([a-z0-9_]))(.*)?/i' ; preg_match_all ( $ regex , $ php , $ matches , PREG_SET_ORDER ) ; foreach ( $ matches as $ val ) { $ report [ '\'$this\' without \'->\'' ] [ ] = $ val [ 0 ] ; } return $ report ; }
Analyze a compiled template for restriction violations.
Analyze a compiled template for restriction violations .
// analyze the compiled code // array of captured restriction violations // ------------------------------------------------------------- // // go through the list of called functions and make sure each // one is allowed via the whitelist.  if not, record each non- // allowed function.  this also restricts variable-functions // such as $var(). // // ------------------------------------------------------------- // // disallow use of various constructs (include is allowed, we // need it for {tpl}). // // ------------------------------------------------------------- // // disallow instantiation of new classes // // ------------------------------------------------------------- // // disallow access to the various superglobals // so that templates cannot manipulate them. // // ------------------------------------------------------------- // // allow only certain $this methods // // ------------------------------------------------------------- // // disallow private and variable-variable $this properties //  // ------------------------------------------------------------- // // allow only certain static method calls // // the class itself is not allowed // the specific method is not allowed, // and there is no wildcard for the class methods. // ------------------------------------------------------------- // // only allow includes via $this->findTemplate(*) // // in each include statment, look for $this->findTemplate. // there is something before or after the findTemplate call, // or it's a direct include (which is not allowed) // ------------------------------------------------------------- // // do not allow the use of "$this" by itself; // it must be always be followed by "->" or another // valid variable-name character (a-z, 0-9, or _). // /** @todo disallow standalone variable-variables, $$var */ /** @todo disallow vars from static classes? class::$var */ // ------------------------------------------------------------- // // done! // // +++ DEBUG //echo "<pre>"; //print_r($ca); //echo "</pre>"; // --- DEBUG