From 1ef87eac3cec87d00914b277831a49ca25a9a325 Mon Sep 17 00:00:00 2001
From: Feei <feei@feei.cn>
Date: Thu, 26 Oct 2017 12:05:53 +0800
Subject: [PATCH] improves rules

---
 rules/CVI-360031.xml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/rules/CVI-360031.xml b/rules/CVI-360031.xml
index 779dd9f7..73e328e5 100644
--- a/rules/CVI-360031.xml
+++ b/rules/CVI-360031.xml
@@ -2,7 +2,7 @@
 <cobra document="https://github.com/wufeifei/cobra">
     <name value="webshell31"/>
     <language value="php"/>
-    <match mode="regex-only-match"><![CDATA[ini_get\s*\(\s*\"disable_functions\"\s*\)|\d\s*=>\s*array\s*\(\s*['\"]\s*pipe\s*['\"]|gzuncompress\(base64_decode\(|crypt\(\$_SERVER\['HTTP_H0ST'\],\d+\)==|if\(file_exists\(\$settings\['STOPFILE'\]\)\)]]></match>
+    <match mode="regex-only-match"><![CDATA[ini_get\s*\(\s*\"disable_functions\"\s*\)|gzuncompress\(base64_decode\(|crypt\(\$_SERVER\['HTTP_H0ST'\],\d+\)==|if\(file_exists\(\$settings\['STOPFILE'\]\)\)]]></match>
     <level value="7"/>
     <test>
         <case assert="true"><![CDATA[
@@ -14,6 +14,13 @@
                 return $NXlKO;
             }
         ]]></case>
+        <case assert="false"><![CDATA[
+            $descriptorspec = array(
+			0 => array("pipe", "r"),  // stdin
+			1 => array("pipe", "w"),  // stdout
+			2 => array("pipe", "w")   // stderr
+			)
+        ]]></case>
     </test>
     <solution>
         ## 安全风险