Skip to content

Forbid a few other dangerous functions #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 25, 2020
Merged

Forbid a few other dangerous functions #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
<!-- There is always Unreleased section on the top. Subsections (Added, Changed, Fixed, Removed) should be added as needed. -->

## Unreleased
- Add various dangerous function calls to forbidden functions.

## 2.0.4 - 2020-09-23
- Fix an improper fix of PSR-2 checks made in 2.0.3 to really make them being used again.
Expand Down
43 changes: 37 additions & 6 deletions easy-coding-standard.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,16 +39,47 @@ services:
# Some functions should not appear in the code
PHP_CodeSniffer\Standards\Generic\Sniffs\PHP\ForbiddenFunctionsSniff:
forbiddenFunctions:
var_dump: null
dump: null
echo: null
require: null
require_once: null
# Program execution functions, inspired by https://github.com/spaze/phpstan-disallowed-calls
exec: null
passthru: null
proc_open: null
shell_exec: null
system: null
pcntl_exec: null
popen: null

# Dangerous function calls, inspired by https://github.com/spaze/phpstan-disallowed-calls
apache_setenv: null # might overwrite existing variables
dl: null # removed from most SAPIs, might load untrusted code
eval: null # eval is evil, please write more code and do not use eval()
extract: null # do not use extract() and especially not on untrusted data
highlight_file: null # might reveal source code or config files
pfsockopen: null # use fsockopen() to create non-persistent socket connections
posix_getpwuid: null # might reveal system user information
posix_kill: null # do not send signals to processes from the script
posix_mkfifo: null # do not create named pipes in the script
posix_mknod: null # do not create special files in the script
proc_nice: null # changes the priority of the current process
putenv: null # might overwrite existing variables
Copy link

@florianjiri florianjiri Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tady stimhle bych byl opatrny, dost se to pouziva

Copy link

@legendik legendik Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Envy bys v aplikaci nemel vytvaret, jen prijimat.

Copy link
Contributor Author

@OndraM OndraM Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Máš nějaký příklad?

V pár specifických případech se to asi používá oprávněně (třeba v command-line tools), tam bych si to pak dal do výjimek.

Copy link

@florianjiri florianjiri Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Jop vetsinou se jedna o command-line, nebo o testy.

treba priklad

$input = new ArgvInput();
if (null !== $_ENV['APP_ENV'] = $input->getParameterOption(['--env', '-e'], null, true)) {
    putenv('APP_ENV='.$_ENV['APP_ENV']);
    // force loading .env files when --env is defined
    $_SERVER['APP_ENV'] = null;
}

Copy link
Contributor Author

@OndraM OndraM Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tohle ale bude v nějakém bootstrap.php nebo index.php, kde už je beztak i require_once (načítá se composer autoloader), takže to stejně bude ve výjimkách, ne?

Copy link

@hokypierce hokypierce Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nejenom tam, vyuziva to napr. SF komponenta Dotenv

Copy link

@florianjiri florianjiri Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

Copy link
Contributor Author

@OndraM OndraM Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@hokypierce To jo, ale ty sám to ze svého kódu mimo nějaký index.php nevoláš, nebo jo? Kdyžtak mi hoď do Slacku link do bitbucket jestli to někde máte, kouknu.

Copy link

@hokypierce hokypierce Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@OndraM mas pravdu ze to je jen z bootstrapu pri init app

show_source: null # might reveal source code or config files (alias of highlight_file())
socket_create_listen: null # do not accept new socket connections in the PHP script
socket_listen: null # do not accept new socket connections in the PHP script

# PHP include/require functions, use autoloading instead
include: null
include_once: null
require: null
require_once: null

# Probably forgotten debug calls, use logger instead
dump: null
echo: null
phpinfo: null
eval: null
print_r: null
printf: null
var_export: null
var_dump: null

# When referencing arrays you should not put whitespace around the opening bracket or before the closing bracket
PHP_CodeSniffer\Standards\Squiz\Sniffs\Arrays\ArrayBracketSpacingSniff: ~
# Various array declaration rules (but some of the rules are skipped)
Expand Down