improves rules

FeeiCN · Oct 26, 2017 · 1ef87ea · 1ef87ea
1 parent 41af2e4
commit 1ef87ea
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/rules/CVI-360031.xml b/rules/CVI-360031.xml
@@ -2,7 +2,7 @@
 <cobra document="https://github.com/wufeifei/cobra">
     <name value="webshell31"/>
     <language value="php"/>
-    <match mode="regex-only-match"><![CDATA[ini_get\s*\(\s*\"disable_functions\"\s*\)|\d\s*=>\s*array\s*\(\s*['\"]\s*pipe\s*['\"]|gzuncompress\(base64_decode\(|crypt\(\$_SERVER\['HTTP_H0ST'\],\d+\)==|if\(file_exists\(\$settings\['STOPFILE'\]\)\)]]></match>
+    <match mode="regex-only-match"><![CDATA[ini_get\s*\(\s*\"disable_functions\"\s*\)|gzuncompress\(base64_decode\(|crypt\(\$_SERVER\['HTTP_H0ST'\],\d+\)==|if\(file_exists\(\$settings\['STOPFILE'\]\)\)]]></match>
     <level value="7"/>
     <test>
         <case assert="true"><![CDATA[
@@ -14,6 +14,13 @@
                 return $NXlKO;
             }
         ]]></case>
+        <case assert="false"><![CDATA[
+            $descriptorspec = array(
+			0 => array("pipe", "r"),  // stdin
+			1 => array("pipe", "w"),  // stdout
+			2 => array("pipe", "w")   // stderr
+			)
+        ]]></case>
     </test>
     <solution>
         ## 安全风险