{"action":"closed","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/294","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/294/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/294/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/294/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/294","id":135551369,"number":294,"title":"Detect 'variable functions'","user":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/labels/V3.0.0-rc1%20PHP%20Project","name":"V3.0.0-rc1 PHP Project","color":"d4c5f9"}],"state":"closed","locked":false,"assignee":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2016-02-22T21:34:04Z","updated_at":"2016-06-05T12:28:02Z","closed_at":"2016-06-05T12:28:02Z","body":"An evasion technique for calling PHP functions is 'variable functions'. For instance, to evade the `php-function-names.data` file, one would do:\r\n\r\n```\r\n$fgc = 'fil' . 'e_get' . '_contents';\r\n$fgc('...');\r\n```\r\n\r\nor a more complex variant:\r\n\r\n```\r\n$aB_4c[5]['d'] = 'fil' . 'e_get' . '_contents';\r\n$aB_4c[5]['d'] /* comment */ ('...');\r\n```\r\n\r\nA regexp for this might get a little hairy, but we can likely detect many uses with a regexp having low FP.\r\n\r\nWatch out for multiline comments."}}
{"actor":{"display_login":"lifeforms"}}