From 1bb71c2eb03c50c870c0754680874ae6f1fddaeb Mon Sep 17 00:00:00 2001 From: Nilambar Sharma Date: Tue, 16 Jul 2024 12:05:48 +0545 Subject: [PATCH 1/2] Update code obfuscation tests to show line and columns --- .../Checker/Checks/Abstract_File_Check.php | 21 +++-- .../Plugin_Repo/Code_Obfuscation_Check.php | 87 +++++++++++-------- 2 files changed, 67 insertions(+), 41 deletions(-) diff --git a/includes/Checker/Checks/Abstract_File_Check.php b/includes/Checker/Checks/Abstract_File_Check.php index c8fc83d16..18d510676 100644 --- a/includes/Checker/Checks/Abstract_File_Check.php +++ b/includes/Checker/Checks/Abstract_File_Check.php @@ -187,15 +187,26 @@ final protected static function files_preg_match_all( $pattern, array $files ) { if ( is_array( $matches ) && ! empty( $matches ) ) { foreach ( $matches[0] as $match ) { - list( $before ) = str_split( $contents, $match[1] ); + $line = 0; + $column = 0; - $exploded = explode( PHP_EOL, $before ); - $last_item = end( $exploded ); + if ( 0 === $match[1] ) { + $line = 1; + $column = 1; + } else { + list( $before ) = str_split( $contents, $match[1] ); + + $exploded = explode( PHP_EOL, $before ); + $last_item = end( $exploded ); + + $line = count( $exploded ); + $column = strlen( $last_item ) + 1; + } $matched_files[] = array( 'file' => $file, - 'line' => count( $exploded ), - 'column' => strlen( $last_item ) + 1, + 'line' => $line, + 'column' => $column, ); } } diff --git a/includes/Checker/Checks/Plugin_Repo/Code_Obfuscation_Check.php b/includes/Checker/Checks/Plugin_Repo/Code_Obfuscation_Check.php index 81ac400d3..8246d2801 100644 --- a/includes/Checker/Checks/Plugin_Repo/Code_Obfuscation_Check.php +++ b/includes/Checker/Checks/Plugin_Repo/Code_Obfuscation_Check.php @@ -95,18 +95,23 @@ protected function check_files( Check_Result $result, array $files ) { * @param array $php_files List of absolute PHP file paths. */ protected function look_for_zendguard( Check_Result $result, array $php_files ) { - $obfuscated_file = self::file_preg_match( '/(<\?php \@Zend;)|(This file was encoded by)/', $php_files ); - if ( $obfuscated_file ) { - $this->add_result_error_for_file( - $result, - sprintf( - /* translators: %s: tool name */ - __( 'Code Obfuscation tools are not permitted. Detected: %s', 'plugin-check' ), - __( 'Zend Guard', 'plugin-check' ) - ), - 'obfuscated_code_detected', - $obfuscated_file - ); + $files = self::files_preg_match_all( '/(\<\?php \@Zend;)|(This file was encoded by)/', $php_files ); + + if ( ! empty( $files ) ) { + foreach ( $files as $file ) { + $this->add_result_error_for_file( + $result, + sprintf( + /* translators: %s: tool name */ + __( 'Code Obfuscation tools are not permitted. Detected: %s', 'plugin-check' ), + __( 'Zend Guard', 'plugin-check' ) + ), + 'obfuscated_code_detected', + $file['file'], + $file['line'], + $file['column'] + ); + } } } @@ -119,18 +124,23 @@ protected function look_for_zendguard( Check_Result $result, array $php_files ) * @param array $php_files List of absolute PHP file paths. */ protected function look_for_sourceguardian( Check_Result $result, array $php_files ) { - $obfuscated_file = self::file_preg_match( "/(sourceguardian\.com)|(function_exists\('sg_load'\))|(\$__x=)/", $php_files ); - if ( $obfuscated_file ) { - $this->add_result_error_for_file( - $result, - sprintf( - /* translators: %s: tool name */ - __( 'Code Obfuscation tools are not permitted. Detected: %s', 'plugin-check' ), - __( 'Source Guardian', 'plugin-check' ) - ), - 'obfuscated_code_detected', - $obfuscated_file - ); + $files = self::files_preg_match_all( "/(sourceguardian\.com)|(function_exists\('sg_load'\))|(\$__x=)/", $php_files ); + + if ( ! empty( $files ) ) { + foreach ( $files as $file ) { + $this->add_result_error_for_file( + $result, + sprintf( + /* translators: %s: tool name */ + __( 'Code Obfuscation tools are not permitted. Detected: %s', 'plugin-check' ), + __( 'Source Guardian', 'plugin-check' ) + ), + 'obfuscated_code_detected', + $file['file'], + $file['line'], + $file['column'] + ); + } } } @@ -143,18 +153,23 @@ protected function look_for_sourceguardian( Check_Result $result, array $php_fil * @param array $php_files List of absolute PHP file paths. */ protected function look_for_ioncube( Check_Result $result, array $php_files ) { - $obfuscated_file = self::file_str_contains( $php_files, 'ionCube' ); - if ( $obfuscated_file ) { - $this->add_result_error_for_file( - $result, - sprintf( - /* translators: %s: tool name */ - __( 'Code Obfuscation tools are not permitted. Detected: %s', 'plugin-check' ), - __( 'ionCube', 'plugin-check' ) - ), - 'obfuscated_code_detected', - $obfuscated_file - ); + $files = self::files_preg_match_all( '/ionCube/', $php_files ); + + if ( ! empty( $files ) ) { + foreach ( $files as $file ) { + $this->add_result_error_for_file( + $result, + sprintf( + /* translators: %s: tool name */ + __( 'Code Obfuscation tools are not permitted. Detected: %s', 'plugin-check' ), + __( 'ionCube', 'plugin-check' ) + ), + 'obfuscated_code_detected', + $file['file'], + $file['line'], + $file['column'] + ); + } } } } From 248c1095517d204397ec94030fc42e02e1f927ea Mon Sep 17 00:00:00 2001 From: Nilambar Sharma Date: Tue, 16 Jul 2024 12:37:29 +0545 Subject: [PATCH 2/2] Update unit tests for updated code obfuscation check --- .../load.php | 2 +- .../Checker/Checks/Code_Obfuscation_Check_Tests.php | 12 +++++++++--- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/tests/phpunit/testdata/plugins/test-plugin-code-obfuscation-ioncube-errors/load.php b/tests/phpunit/testdata/plugins/test-plugin-code-obfuscation-ioncube-errors/load.php index 7019ea4f1..98ec593ca 100644 --- a/tests/phpunit/testdata/plugins/test-plugin-code-obfuscation-ioncube-errors/load.php +++ b/tests/phpunit/testdata/plugins/test-plugin-code-obfuscation-ioncube-errors/load.php @@ -1,6 +1,6 @@ assertArrayHasKey( $expected_file, $errors ); $this->assertSame( 1, $check_result->get_error_count() ); - $this->assertTrue( isset( $errors[ $expected_file ][0][0][0] ) ); - $this->assertSame( 'obfuscated_code_detected', $errors[ $expected_file ][0][0][0]['code'] ); + $this->assertTrue( isset( $errors[ $expected_file ][ $line ][ $column ][0] ) ); + $this->assertSame( 'obfuscated_code_detected', $errors[ $expected_file ][ $line ][ $column ][0]['code'] ); } public function data_obfuscation_services() { @@ -38,16 +38,22 @@ public function data_obfuscation_services() { Code_Obfuscation_Check::TYPE_ZEND, 'test-plugin-code-obfuscation-zendguard-errors/load.php', 'obfuscated.php', + 1, + 1, ), 'Source Guardian' => array( Code_Obfuscation_Check::TYPE_SOURCEGUARDIAN, 'test-plugin-code-obfuscation-sourceguardian-errors/load.php', 'obfuscated.php', + 2, + 4, ), 'ionCube' => array( Code_Obfuscation_Check::TYPE_IONCUBE, 'test-plugin-code-obfuscation-ioncube-errors/load.php', 'load.php', + 16, + 19, ), ); }