function type_scalar($type) : bool { static $typemap = ['integer' => 'int', 'double' => 'float', 'boolean' => 'bool', 'true' => 'bool', 'false' => 'bool', 'callback' => 'callable']; if (empty($type) || $type == 'mixed') { return false; } $type = $typemap[$type] ?? $type; if ($type == 'int' || $type == 'float' || $type == 'string') { return true; } if (strpos("|{$type}|", '|mixed|') !== false) { return false; } $type = type_map($type); // our own union types if (strpos($type, '|')) { foreach (explode('|', $type) as $s) { if ($s != 'int' && $s != 'float' && $s != 'string') { return false; } } } else { return false; } return true; }
function node_type($file, $namespace, $node, $current_scope, $current_class, &$taint = null, $check_var_exists = true) { global $classes, $functions, $scope, $namespace_map, $internal_arginfo; if (!$node instanceof \ast\Node) { if ($node === null) { return ''; } return type_map(gettype($node)); } else { if ($node->kind == \ast\AST_ARRAY) { if (!empty($node->children) && $node->children[0] instanceof \ast\Node && $node->children[0]->kind == \ast\AST_ARRAY_ELEM) { // Check the first 5 (completely arbitrary) elements and assume the rest are the same type $etypes = []; for ($i = 0; $i < 5; $i++) { if (empty($node->children[$i])) { break; } if ($node->children[$i]->children[0] instanceof \ast\Node) { $etypes[] = node_type($file, $namespace, $node->children[$i]->children[0], $current_scope, $current_class, $temp_taint); } else { $etypes[] = type_map(gettype($node->children[$i]->children[0])); } } $types = array_unique($etypes); if (count($types) == 1 && !empty($types[0])) { return mkgenerics($types[0]); } } return 'array'; } else { if ($node->kind == \ast\AST_BINARY_OP || $node->kind == \ast\AST_GREATER || $node->kind == \ast\AST_GREATER_EQUAL) { if ($node->kind == \ast\AST_BINARY_OP) { $node_flags = $node->flags; } else { $node_flags = $node->kind; } $taint = var_taint_check($file, $node, $current_scope); switch ($node_flags) { // Always a string from a concat case \ast\flags\BINARY_CONCAT: $temp_taint = false; node_type($file, $namespace, $node->children[0], $current_scope, $current_class, $temp_taint); if ($temp_taint) { $taint = true; return 'string'; } node_type($file, $namespace, $node->children[1], $current_scope, $current_class, $temp_taint); if ($temp_taint) { $taint = true; } return 'string'; break; // Boolean unless invalid operands // Boolean unless invalid operands case \ast\flags\BINARY_IS_IDENTICAL: case \ast\flags\BINARY_IS_NOT_IDENTICAL: case \ast\flags\BINARY_IS_EQUAL: case \ast\flags\BINARY_IS_NOT_EQUAL: case \ast\flags\BINARY_IS_SMALLER: case \ast\flags\BINARY_IS_SMALLER_OR_EQUAL: case \ast\AST_GREATER: case \ast\AST_GREATER_EQUAL: $temp = node_type($file, $namespace, $node->children[0], $current_scope, $current_class); if (!$temp) { $left = ''; } else { $left = type_map($temp); } $temp = node_type($file, $namespace, $node->children[1], $current_scope, $current_class); if (!$temp) { $right = ''; } else { $right = type_map($temp); } $taint = false; // If we have generics and no non-generics on the left and the right is not array-like ... if (!empty(generics($left)) && empty(nongenerics($left)) && !type_check($right, 'array')) { Log::err(Log::ETYPE, "array to {$right} comparison", $file, $node->lineno); } else { // and the same for the right side if (!empty(generics($right)) && empty(nongenerics($right)) && !type_check($left, 'array')) { Log::err(Log::ETYPE, "{$left} to array comparison", $file, $node->lineno); } } return 'bool'; break; // Add is special because you can add arrays // Add is special because you can add arrays case \ast\flags\BINARY_ADD: $temp = node_type($file, $namespace, $node->children[0], $current_scope, $current_class); if (!$temp) { $left = ''; } else { $left = type_map($temp); } $temp = node_type($file, $namespace, $node->children[1], $current_scope, $current_class); if (!$temp) { $right = ''; } else { $right = type_map($temp); } // fast-track common cases if ($left == 'int' && $right == 'int') { return 'int'; } if (($left == 'int' || $left == 'float') && ($right == 'int' || $right == 'float')) { return 'float'; } $left_is_array = !empty(generics($left)) && empty(nongenerics($left)); $right_is_array = !empty(generics($right)) && empty(nongenerics($right)); if ($left_is_array && !type_check($right, 'array')) { Log::err(Log::ETYPE, "invalid operator: left operand is array and right is not", $file, $node->lineno); return ''; } else { if ($right_is_array && !type_check($left, 'array')) { Log::err(Log::ETYPE, "invalid operator: right operand is array and left is not", $file, $node->lineno); return ''; } else { if ($left_is_array || $right_is_array) { // If it is a '+' and we know one side is an array and the other is unknown, assume array return 'array'; } } } return 'int|float'; $taint = false; break; // Everything else should be an int/float // Everything else should be an int/float default: $temp = node_type($file, $namespace, $node->children[0], $current_scope, $current_class); if (!$temp) { $left = ''; } else { $left = type_map($temp); } $temp = node_type($file, $namespace, $node->children[1], $current_scope, $current_class); if (!$temp) { $right = ''; } else { $right = type_map($temp); } if ($left == 'array' || $right == 'array') { Log::err(Log::ETYPE, "invalid array operator", $file, $node->lineno); return ''; } else { if ($left == 'int' && $right == 'int') { return 'int'; } else { if ($left == 'float' || $right == 'float') { return 'float'; } } } return 'int|float'; $taint = false; break; } } else { if ($node->kind == \ast\AST_CAST) { $taint = var_taint_check($file, $node->children[0], $current_scope); switch ($node->flags) { case \ast\flags\TYPE_NULL: return 'null'; break; case \ast\flags\TYPE_BOOL: $taint = false; return 'bool'; break; case \ast\flags\TYPE_LONG: $taint = false; return 'int'; break; case \ast\flags\TYPE_DOUBLE: $taint = false; return 'float'; break; case \ast\flags\TYPE_STRING: return 'string'; break; case \ast\flags\TYPE_ARRAY: return 'array'; break; case \ast\flags\TYPE_OBJECT: return 'object'; break; default: Log::err(Log::EFATAL, "Unknown type (" . $node->flags . ") in cast"); } } else { if ($node->kind == \ast\AST_NEW) { $class_name = find_class_name($file, $node, $namespace, $current_class, $current_scope); if ($class_name) { return $classes[strtolower($class_name)]['type']; } return 'object'; } else { if ($node->kind == \ast\AST_DIM) { $taint = var_taint_check($file, $node->children[0], $current_scope); $type = node_type($file, $namespace, $node->children[0], $current_scope, $current_class); if (!empty($type)) { $gen = generics($type); if (empty($gen)) { if ($type !== 'null' && !type_check($type, 'string|ArrayAccess')) { // array offsets work on strings, unfortunately // Double check that any classes in the type don't have ArrayAccess $ok = false; foreach (explode('|', $type) as $t) { if (!empty($t) && !is_native_type($t)) { if (!empty($classes[strtolower($t)]['type'])) { if (strpos('|' . $classes[strtolower($t)]['type'] . '|', '|ArrayAccess|') !== false) { $ok = true; break; } } } } if (!$ok) { Log::err(Log::ETYPE, "Suspicious array access to {$type}", $file, $node->lineno); } } return ''; } } else { return ''; } return $gen; } else { if ($node->kind == \ast\AST_VAR) { return var_type($file, $node, $current_scope, $taint, $check_var_exists); } else { if ($node->kind == \ast\AST_ENCAPS_LIST) { foreach ($node->children as $encap) { if ($encap instanceof \ast\Node) { if (var_taint_check($file, $encap, $current_scope)) { $taint = true; } } } return "string"; } else { if ($node->kind == \ast\AST_CONST) { if ($node->children[0]->kind == \ast\AST_NAME) { if (defined($node->children[0]->children[0])) { return type_map(gettype(constant($node->children[0]->children[0]))); } else { // Todo: user-defined constant } } } else { if ($node->kind == \ast\AST_CLASS_CONST) { if ($node->children[1] == 'class') { return 'string'; } // class name fetch $class_name = find_class_name($file, $node, $namespace, $current_class, $current_scope); if (!$class_name) { return ''; } $ltemp = strtolower($class_name); while ($ltemp && !array_key_exists($node->children[1], $classes[$ltemp]['constants'])) { $ltemp = strtolower($classes[$ltemp]['parent']); if (empty($classes[$ltemp])) { return ''; } // undeclared class - will be caught elsewhere } if (!$ltemp || !array_key_exists($node->children[1], $classes[$ltemp]['constants'])) { Log::err(Log::EUNDEF, "can't access undeclared constant {$class_name}::{$node->children[1]}", $file, $node->lineno); return ''; } return $classes[$ltemp]['constants'][$node->children[1]]['type']; } else { if ($node->kind == \ast\AST_PROP) { if ($node->children[0]->kind == \ast\AST_VAR) { $class_name = find_class_name($file, $node, $namespace, $current_class, $current_scope); if ($class_name && !$node->children[1] instanceof \ast\Node) { $ltemp = find_property($file, $node, $class_name, $node->children[1], $class_name, false); if (empty($ltemp)) { return ''; } return $classes[$ltemp]['properties'][$node->children[1]]['type']; } } } else { if ($node->kind == \ast\AST_STATIC_PROP) { if ($node->children[0]->kind == \ast\AST_NAME) { $class_name = qualified_name($file, $node->children[0], $namespace); if ($class_name && !$node->children[1] instanceof \ast\Node) { $ltemp = find_property($file, $node, $class_name, $node->children[1], $class_name, false); if (empty($ltemp)) { return ''; } return $classes[$ltemp]['properties'][$node->children[1]]['type']; } } } else { if ($node->kind == \ast\AST_CALL) { if ($node->children[0]->kind == \ast\AST_NAME) { $func_name = $node->children[0]->children[0]; if ($node->children[0]->flags & \ast\flags\NAME_NOT_FQ) { $func = $namespace_map[T_FUNCTION][$file][strtolower($namespace . $func_name)] ?? $namespace_map[T_FUNCTION][$file][strtolower($func_name)] ?? $functions[strtolower($namespace . $func_name)] ?? $functions[strtolower($func_name)] ?? null; } else { $func = $functions[strtolower($func_name)] ?? null; } if ($func['file'] == 'internal' && empty($func['ret'])) { if (!empty($internal_arginfo[$func_name])) { return $internal_arginfo[$func_name][0] ?? ''; } } else { return $func['ret'] ?? ''; } } else { // TODO: Handle $func() and other cases that get here } } else { if ($node->kind == \ast\AST_STATIC_CALL) { $class_name = find_class_name($file, $node, $namespace, $current_class, $current_scope); $method = find_method($class_name, $node->children[1]); if ($method) { return $method['ret'] ?? ''; } } else { if ($node->kind == \ast\AST_METHOD_CALL) { $class_name = find_class_name($file, $node, $namespace, $current_class, $current_scope); if ($class_name) { $method_name = $node->children[1]; $method = find_method($class_name, $method_name); if ($method === false) { Log::err(Log::EUNDEF, "call to undeclared method {$class_name}->{$method_name}()", $file, $node->lineno); } else { if ($method != 'dynamic') { return $method['ret']; } } } } } } } } } } } } } } } } } } return ''; }
function node_type($file, $namespace, $node, $current_scope, $current_class, &$taint = null, $check_var_exists = true) { global $classes, $functions, $scope, $namespace_map, $internal_arginfo; if (!$node instanceof \ast\Node) { if ($node === null) { return ''; } return type_map(gettype($node)); } else { if ($node->kind == \ast\AST_ARRAY) { return 'array'; } else { if ($node->kind == \ast\AST_BINARY_OP) { $taint = var_taint_check($file, $node, $current_scope); switch ($node->flags) { // Always a string from a concat case \ast\flags\BINARY_CONCAT: $temp_taint = false; node_type($file, $namespace, $node->children[0], $current_scope, $current_class, $temp_taint); if ($temp_taint) { $taint = true; return 'string'; } node_type($file, $namespace, $node->children[1], $current_scope, $current_class, $temp_taint); if ($temp_taint) { $taint = true; } return 'string'; break; // Boolean unless invalid operands // Boolean unless invalid operands case \ast\flags\BINARY_IS_IDENTICAL: case \ast\flags\BINARY_IS_NOT_IDENTICAL: case \ast\flags\BINARY_IS_EQUAL: case \ast\flags\BINARY_IS_NOT_EQUAL: case \ast\flags\BINARY_IS_SMALLER: case \ast\flags\BINARY_IS_SMALLER_OR_EQUAL: $taint = false; return 'bool'; break; // Add is special because you can add arrays // Add is special because you can add arrays case \ast\flags\BINARY_ADD: $temp = node_type($file, $namespace, $node->children[0], $current_scope, $current_class); if (!$temp) { $left = ''; } else { $left = type_map($temp); } $temp = node_type($file, $namespace, $node->children[1], $current_scope, $current_class); if (!$temp) { $right = ''; } else { $right = type_map($temp); } if ($left == 'array' && $right == 'array') { return 'array'; } else { if ($left == 'array' && !type_check($right, 'array')) { Log::err(Log::ETYPE, "invalid operator: left operand is array and right is not", $file, $node->lineno); return ''; } else { if ($right == 'array' && !type_check($left, 'array')) { Log::err(Log::ETYPE, "invalid operator: right operand is array and left is not", $file, $node->lineno); return ''; } else { if ($left == 'int' && $right == 'int') { return 'int'; } else { if ($left == 'float' || $right == 'float') { return 'float'; } else { if ($left == 'array' || $right == 'array') { // If it is a '+' and we know one side is an array and the other is unknown, assume array return 'array'; } } } } } } return 'int|float'; $taint = false; break; // Everything else should be an int/float // Everything else should be an int/float default: $temp = node_type($file, $namespace, $node->children[0], $current_scope, $current_class); if (!$temp) { $left = ''; } else { $left = type_map($temp); } $temp = node_type($file, $namespace, $node->children[1], $current_scope, $current_class); if (!$temp) { $right = ''; } else { $right = type_map($temp); } if ($left == 'array' || $right == 'array') { Log::err(Log::ETYPE, "invalid array operator", $file, $node->lineno); return ''; } else { if ($left == 'int' && $right == 'int') { return 'int'; } else { if ($left == 'float' || $right == 'float') { return 'float'; } } } return 'int|float'; $taint = false; break; } } else { if ($node->kind == \ast\AST_CAST) { $taint = var_taint_check($file, $node->children[0], $current_scope); switch ($node->flags) { case \ast\flags\TYPE_NULL: return 'null'; break; case \ast\flags\TYPE_BOOL: $taint = false; return 'bool'; break; case \ast\flags\TYPE_LONG: $taint = false; return 'int'; break; case \ast\flags\TYPE_DOUBLE: $taint = false; return 'float'; break; case \ast\flags\TYPE_STRING: return 'string'; break; case \ast\flags\TYPE_ARRAY: return 'array'; break; case \ast\flags\TYPE_OBJECT: return 'stdClass'; break; default: Log::err(Log::EFATAL, "Unknown type (" . $node->flags . ") in cast"); } } else { if ($node->kind == \ast\AST_NEW) { $class_name = find_class_name($file, $node, $namespace, $current_class, $current_scope); if ($class_name) { return $classes[strtolower($class_name)]['type']; } return 'object'; } else { if ($node->kind == \ast\AST_DIM) { $taint = var_taint_check($file, $node->children[0], $current_scope); // TODO: Do something smart with array elements return ''; } else { if ($node->kind == \ast\AST_VAR) { return var_type($file, $node, $current_scope, $taint, $check_var_exists); } else { if ($node->kind == \ast\AST_ENCAPS_LIST) { foreach ($node->children as $encap) { if ($encap instanceof \ast\Node) { if (var_taint_check($file, $encap, $current_scope)) { $taint = true; } } } return "string"; } else { if ($node->kind == \ast\AST_CONST) { if ($node->children[0]->kind == \ast\AST_NAME) { if (defined($node->children[0]->children[0])) { return type_map(gettype(constant($node->children[0]->children[0]))); } else { // Todo: user-defined constant } } } else { if ($node->kind == \ast\AST_PROP) { if ($node->children[0]->kind == \ast\AST_VAR) { $class_name = find_class_name($file, $node, $namespace, $current_class, $current_scope); if ($class_name && !$node->children[1] instanceof \ast\Node) { if (empty($classes[strtolower($class_name)]['properties'][$node->children[1]])) { return ''; } return $classes[strtolower($class_name)]['properties'][$node->children[1]]['value']; } } } else { if ($node->kind == \ast\AST_CALL) { if ($node->children[0]->kind == \ast\AST_NAME) { $func_name = $node->children[0]->children[0]; if ($node->children[0]->flags & \ast\flags\NAME_NOT_FQ) { $func = $namespace_map[T_FUNCTION][$file][strtolower($namespace . $func_name)] ?? $namespace_map[T_FUNCTION][$file][strtolower($func_name)] ?? $functions[strtolower($namespace . $func_name)] ?? $functions[strtolower($func_name)] ?? null; } else { $func = $functions[strtolower($func_name)] ?? null; } if ($func['file'] == 'internal' && empty($func['ret'])) { if (!empty($internal_arginfo[$func_name])) { return $internal_arginfo[$func_name][0] ?? ''; } } else { return $func['ret'] ?? ''; } } else { // TODO: Handle $func() and other cases that get here } } else { if ($node->kind == \ast\AST_STATIC_CALL) { $class_name = find_class_name($file, $node, $namespace, $current_class, $current_scope); $method = find_method($class_name, $node->children[1]); if ($method) { return $method['ret'] ?? ''; } } else { if ($node->kind == \ast\AST_METHOD_CALL) { $class_name = find_class_name($file, $node, $namespace, $current_class, $current_scope); if ($class_name) { $method_name = $node->children[1]; $method = find_method($class_name, $method_name); if ($method === false) { Log::err(Log::EUNDEF, "call to undeclared method {$class_name}->{$method_name}()", $file, $node->lineno); } else { if ($method != 'dynamic') { return $method['ret']; } } } } } } } } } } } } } } } } return ''; }
function node_type($file, $node, $current_scope, &$taint = null, $check_var_exists = true) { global $classes, $functions, $namespace, $internal_arginfo; if (!$node instanceof \ast\Node) { return type_map(gettype($node)); } else { if ($node->kind == \ast\AST_ARRAY) { return 'array'; } else { if ($node->kind == \ast\AST_BINARY_OP) { $taint = var_taint_check($file, $node, $current_scope); switch ($node->flags) { // Always a string from a concat case \ast\flags\BINARY_CONCAT: $temp_taint = false; node_type($file, $node->children[0], $current_scope, $temp_taint); if ($temp_taint) { $taint = true; return 'string'; } node_type($file, $node->children[1], $current_scope, $temp_taint); if ($temp_taint) { $taint = true; } return 'string'; break; // Boolean unless invalid operands // Boolean unless invalid operands case \ast\flags\BINARY_IS_IDENTICAL: case \ast\flags\BINARY_IS_NOT_IDENTICAL: case \ast\flags\BINARY_IS_EQUAL: case \ast\flags\BINARY_IS_NOT_EQUAL: case \ast\flags\BINARY_IS_SMALLER: case \ast\flags\BINARY_IS_SMALLER_OR_EQUAL: $taint = false; return 'bool'; break; // Everything else should be an int/float // Everything else should be an int/float default: $left = type_map(node_type($file, $node->children[0], $current_scope)); $right = type_map(node_type($file, $node->children[1], $current_scope)); if ($left == 'array' && $right != 'array') { Log::err(Log::ETYPE, "invalid operator: left operand is array and right is not", $file, $node->lineno); return 'mixed'; } else { if ($right == 'array' && $left != 'array') { Log::err(Log::ETYPE, "invalid operator: right operand is array and left is not", $file, $node->lineno); return 'mixed'; } else { if ($left == 'int' && $right == 'int') { return 'int'; } else { if ($left == 'float' || $right == 'float') { return 'float'; } } } } $taint = false; return $left; break; } } else { if ($node->kind == \ast\AST_CAST) { $taint = var_taint_check($file, $node->children[0], $current_scope); switch ($node->flags) { case \ast\flags\TYPE_NULL: return 'null'; break; case \ast\flags\TYPE_BOOL: $taint = false; return 'bool'; break; case \ast\flags\TYPE_LONG: $taint = false; return 'int'; break; case \ast\flags\TYPE_DOUBLE: $taint = false; return 'float'; break; case \ast\flags\TYPE_STRING: return 'string'; break; case \ast\flags\TYPE_ARRAY: return 'array'; break; case \ast\flags\TYPE_OBJECT: return 'object:stdClass'; break; default: Log::err(Log::EFATAL, "Unknown type (" . $node->flags . ") in cast"); } } else { if ($node->kind == \ast\AST_NEW) { if ($node->children[0]->kind == \ast\AST_NAME) { $name = var_name($node->children[0]); if ($name == 'self' || $name == 'static') { list($class, ) = explode('::', $current_scope); $name = $class; } if (empty($classes[$namespace . strtolower($name)]) && empty($classes[strtolower($name)])) { Log::err(Log::EUNDEF, "Trying to instantiate undeclared class {$name}", $file, $node->lineno); } return 'object:' . $name; } return 'object'; } else { if ($node->kind == \ast\AST_DIM) { $taint = var_taint_check($file, $node->children[0], $current_scope); // TODO: Do something smart with array elements return 'mixed'; } else { if ($node->kind == \ast\AST_VAR) { return var_type($file, $node, $current_scope, $taint, $check_var_exists); } else { if ($node->kind == \ast\AST_ENCAPS_LIST) { foreach ($node->children as $encap) { if ($encap instanceof \ast\Node) { if (var_taint_check($file, $encap, $current_scope)) { $taint = true; } } } return "string"; } else { if ($node->kind == \ast\AST_CONST) { if ($node->children[0]->kind == \ast\AST_NAME) { if (defined($node->children[0]->children[0])) { return type_map(gettype(constant($node->children[0]->children[0]))); } else { // User-defined constant } } } else { if ($node->kind == \ast\AST_CALL) { if ($node->children[0]->kind == \ast\AST_NAME) { $func_name = $node->children[0]->children[0]; $func = $functions[strtolower($namespace . $func_name)] ?? $functions[strtolower($func_name)] ?? null; if ($func['file'] == 'internal' && empty($func['ret'])) { if (!empty($internal_arginfo[$func_name])) { return $internal_arginfo[$func_name][0] ?? 'mixed'; } } else { return $func['ret'] ?? 'mixed'; } } else { // TODO: Handle $func() and other cases that get here } } else { if ($node->kind == \ast\AST_STATIC_CALL) { // If the called static method has a return type defined, use that $call = $node->children[0]; if ($call->kind == \ast\AST_NAME) { // Simple static function call $class_name = $call->children[0]; $method_name = $node->children[1]; $method = find_method($namespace . $class_name, $method_name); if (!$method) { find_method($class_name, $method_name); } if ($method) { return $method['ret'] ?? 'mixed'; } } else { // Weird dynamic static call - give up return 'mixed'; } } } } } } } } } } } } return "mixed"; }