/**
* 根据AST node获取相应的symbol
* @param unknown $node
*/
public static function getSymbolByNode($node)
{
if ($node && SymbolUtils::isValue($node)) {
//在DataFlow加入Location以及name
$vs = new ValueSymbol();
$vs->setValueByNode($node);
return $vs;
} elseif ($node && SymbolUtils::isVariable($node)) {
//加入dataFlow
$vars = new VariableSymbol();
$vars->setNameByNode($node);
$vars->setValue($node);
return $vars;
} elseif ($node && SymbolUtils::isArrayDimFetch($node)) {
//加入dataFlow
$arr = new ArrayDimFetchSymbol();
$arr->setValue($node);
return $arr;
} elseif ($node && SymbolUtils::isConcat($node)) {
$concat = new ConcatSymbol();
$concat->setItemByNode($node);
return $concat;
} elseif ($node && $node->getType() == "Scalar_Encapsed") {
$arr = array();
$symbol = new MutipleSymbol();
foreach ($node->parts as $item) {
if (is_object($item) && self::isValue($item) == false) {
$sym = self::getSymbolByNode($item);
array_push($arr, $sym);
}
}
$symbol->setSymbols($arr);
return $symbol;
} else {
return null;
}
}
/**
* 处理赋值的assign语句，添加至dataFlows中
* @param AST $node
* @param DataFlow $dataFlow
* @param string $type
*/
public function assignHandler($node, $dataFlow, $type, $block, $fileSummary)
{
$part = null;
if ($type == "left") {
$part = $node->var;
} else {
if ($type == "right") {
$part = $node->expr;
} else {
return;
}
}
//处理$GLOBALS的赋值
//$GLOBAL['name'] = "chongrui" ; 数据流信息为 $name = "chongrui" ;
if ($part && SymbolUtils::isArrayDimFetch($part) && substr(NodeUtils::getNodeStringName($part), 0, 7) == "GLOBALS") {
//加入dataFlow
$arr = new ArrayDimFetchSymbol();
$arr->setValue($part);
if ($type == "left") {
$dataFlow->setLocation($arr);
$dataFlow->setName(NodeUtils::getNodeGLOBALSNodeName($part));
} else {
if ($type == "right") {
$dataFlow->setValue($arr);
}
}
return;
}
//处理赋值语句，存放在DataFlow
//处理赋值语句的左边
if ($part && SymbolUtils::isValue($part)) {
//在DataFlow加入Location以及name
$vs = new ValueSymbol();
$vs->setValueByNode($part);
if ($type == "left") {
$dataFlow->setLocation($vs);
$dataFlow->setName($part->name);
} else {
if ($type == "right") {
$dataFlow->setValue($vs);
}
}
} elseif ($part && SymbolUtils::isVariable($part)) {
//加入dataFlow
$vars = new VariableSymbol();
$vars->setValue($part);
if ($type == "left") {
$dataFlow->setLocation($vars);
$dataFlow->setName($part->name);
} else {
if ($type == "right") {
$dataFlow->setValue($part);
}
}
} elseif ($part && SymbolUtils::isConstant($part)) {
//加入dataFlow
$con = new ConstantSymbol();
$con->setValueByNode($part);
$con->setName($part->name->parts[0]);
if ($type == "left") {
$dataFlow->setLocation($con);
$dataFlow->setName($part->name);
} else {
if ($type == "right") {
$dataFlow->setValue($con);
}
}
} elseif ($part && SymbolUtils::isArrayDimFetch($part)) {
//加入dataFlow
$arr = new ArrayDimFetchSymbol();
$arr->setValue($part);
if ($type == "left") {
$dataFlow->setLocation($arr);
$dataFlow->setName(NodeUtils::getNodeStringName($part));
} else {
if ($type == "right") {
$dataFlow->setValue($arr);
}
}
} elseif ($part && SymbolUtils::isConcat($part)) {
$concat = new ConcatSymbol();
$concat->setItemByNode($part);
if ($type == "left") {
$dataFlow->setLocation($concat);
$dataFlow->setName($part->name);
} else {
if ($type == "right") {
$dataFlow->setValue($concat);
}
}
} else {
//不属于已有的任何一个symbol类型,如函数调用
if ($part && ($part->getType() == "Expr_FuncCall" || $part->getType() == "Expr_MethodCall" || $part->getType() == "Expr_StaticCall")) {
if ($type == "left") {
$dataFlow->setLocation($arr);
$dataFlow->setName(NodeUtils::getNodeStringName($part));
} else {
if ($type == "right") {
//处理净化信息和编码信息
SanitizationHandler::setSanitiInfo($part, $dataFlow, $block, $fileSummary);
EncodingHandler::setEncodeInfo($part, $dataFlow, $block, $fileSummary);
}
}
}
//处理三元表达式
if ($part && $part->getType() == "Expr_Ternary") {
BIFuncUtils::ternaryHandler($type, $part, $dataFlow);
}
}
}
/**
* 处理foreach语句:
* foreach($_GET['id'] as $key => $value)
* 转为两条赋值：
* $key = $_GET
* $value = $_GET
* 即key和value全部被传染
* 存入block的summary中
* @param BasicBlock $block
* @param Node $node
*/
public function foreachHandler($block, $node)
{
if ($node->expr->getType() == "Expr_ArrayDimFetch") {
// 处理$key
if ($node->keyVar != null) {
$keyFlow = new DataFlow();
$keyFlow->setName(NodeUtils::getNodeStringName($node->keyVar));
$location = new ArrayDimFetchSymbol();
$location->setValue($node->keyVar);
$keyFlow->setLocation($location);
$keyFlow->setValue($node->expr);
$block->getBlockSummary()->addDataFlowItem($keyFlow);
}
//处理$value
if ($node->valueVar != null) {
$valueFlow = new DataFlow();
$valueFlow->setName(NodeUtils::getNodeStringName($node->valueVar));
$location = new ArrayDimFetchSymbol();
$location->setValue($node->valueVar);
$valueFlow->setLocation($location);
$valueFlow->setValue($node->expr);
$block->getBlockSummary()->addDataFlowItem($valueFlow);
}
}
}
