8
8
* License: GNU/GPLv2
9
9
* @see LICENSE.txt
10
10
*
11
- * This file: The scanner (last modified: 2020.11.20 ).
11
+ * This file: The scanner (last modified: 2020.11.27 ).
12
12
*/
13
13
14
14
namespace phpMussel \Core ;
@@ -921,7 +921,8 @@ private function dataHandler(string $str = '', int $Depth = 0, string $OriginalF
921
921
'/0a(?:4(?:36f6e74656e742d54797065|4617465|6726f6d|d6573736167652d4944|d4 ' .
922
922
'94d452d56657273696f6e)|5(?:265706c792d546f|2657475726e2d50617468|3656e64 ' .
923
923
'6572|375626a656374|46f|82d4d61696c6572))3a20/i ' ,
924
- $ str_hex ) || preg_match ('/0a2d2d.{32}(?:2d2d)?(?:0d)?0a/i ' , $ str_hex ));
924
+ $ str_hex
925
+ ) || preg_match ('/0a2d2d.{32}(?:2d2d)?(?:0d)?0a/i ' , $ str_hex ));
925
926
926
927
/** Look for potential Mach-O indicators. */
927
928
$ is_macho = preg_match ('/^(?:cafe(?:babe|d00d)|c[ef]faedfe|feedfac[ef])$/ ' , $ fourcc );
@@ -975,7 +976,7 @@ private function dataHandler(string $str = '', int $Depth = 0, string $OriginalF
975
976
if (!isset ($ Fragment [1 ]) || substr ($ Fragment [1 ], 0 , 1 ) !== '$ ' ) {
976
977
continue 2 ;
977
978
}
978
- $ lv_haystack = substr ($ Fragment [1 ],1 );
979
+ $ lv_haystack = substr ($ Fragment [1 ], 1 );
979
980
if (!isset ($ $ lv_haystack ) || is_array ($ $ lv_haystack )) {
980
981
continue 2 ;
981
982
}
@@ -1940,9 +1941,9 @@ private function dataHandler(string $str = '', int $Depth = 0, string $OriginalF
1940
1941
$ VN = $ this ->getShorthand ($ VN [0 ]);
1941
1942
$ VNLC = strtolower ($ VN );
1942
1943
if (($ is_not_php && (
1943
- strpos ($ VNLC , '-php ' ) !== false || strpos ($ VNLC , '.php ' ) !== false
1944
+ strpos ($ VNLC , '-php ' ) !== false || strpos ($ VNLC , '.php ' ) !== false
1944
1945
)) || ($ is_not_html && (
1945
- strpos ($ VNLC , '-htm ' ) !== false || strpos ($ VNLC , '.htm ' ) !== false
1946
+ strpos ($ VNLC , '-htm ' ) !== false || strpos ($ VNLC , '.htm ' ) !== false
1946
1947
))) {
1947
1948
continue ;
1948
1949
}
@@ -2002,7 +2003,6 @@ private function dataHandler(string $str = '', int $Depth = 0, string $OriginalF
2002
2003
2003
2004
/** Perform API lookups for domains. */
2004
2005
if (isset ($ URLScanner ) && empty ($ this ->Loader ->ScanResultsText [$ AtInstanceLookupKey ])) {
2005
-
2006
2006
$ URLScanner ['DomainsCount ' ] = count ($ URLScanner ['DomainParts ' ]);
2007
2007
2008
2008
$ URLScanner ['URLsCount ' ] = count ($ URLScanner ['URLParts ' ]);
@@ -2236,7 +2236,9 @@ private function dataHandler(string $str = '', int $Depth = 0, string $OriginalF
2236
2236
'https://www.virustotal.com/vtapi/v2/file/report?apikey= ' .
2237
2237
urlencode ($ this ->Loader ->Configuration ['virustotal ' ]['vt_public_api_key ' ]) .
2238
2238
'&resource= ' . $ md5 ,
2239
- $ VTParams , 12 );
2239
+ $ VTParams ,
2240
+ 12
2241
+ );
2240
2242
$ VTJSON = json_decode ($ VTRequest , true );
2241
2243
$ VTCacheTime = $ this ->Loader ->Configuration ['virustotal ' ]['vt_quota_time ' ] * 60 ;
2242
2244
$ this ->Loader ->InstanceCache ['vt_quota ' ] .= ($ this ->Loader ->Time + $ VTCacheTime ) . '; ' ;
@@ -2615,7 +2617,8 @@ private function archiveRecursor(string $Data, string $File = '', int $ScanDepth
2615
2617
$ ThisItemRef = $ ItemRef . '→ ' . preg_replace (['~[\x00-\x1f]~ ' , '~^[ \\\/]~ ' ], '' , $ Filename );
2616
2618
2617
2619
/** Verify filesize, integrity, etc. Exit early in case of problems. */
2618
- if ($ Filesize !== strlen ($ Content ) || ($ InternalCRC &&
2620
+ if ($ Filesize !== strlen ($ Content ) || (
2621
+ $ InternalCRC &&
2619
2622
preg_replace ('~^0+~ ' , '' , $ DataCRC32 ) !== preg_replace ('~^0+~ ' , '' , $ InternalCRC )
2620
2623
)) {
2621
2624
$ this ->Loader ->atHit ($ Hash , $ Filesize , $ ThisItemRef , sprintf (
@@ -2905,11 +2908,13 @@ private function imageIndicators(string $Ext, string $Head): bool
2905
2908
return (
2906
2909
preg_match (
2907
2910
'/^(?:bm[2p]|c(d5|gm)|d(ib|w[fg]|xf)|ecw|fits|gif|img|j(f?if?|p[2s]|pe?g?2?|xr)|p(bm|cx|dd|gm|ic|n[gms]| ' .
2908
- 'pm|s[dp])|s(id|v[ag])|tga|w(bmp?|ebp|mp)|x(cf|bmp))$/ '
2909
- , $ Ext ) ||
2911
+ 'pm|s[dp])|s(id|v[ag])|tga|w(bmp?|ebp|mp)|x(cf|bmp))$/ ' ,
2912
+ $ Ext
2913
+ ) ||
2910
2914
preg_match (
2911
- '/^(?:0000000c6a502020|25504446|38425053|424d|474946383[79]61|57454250|67696d7020786366|89504e47|ffd8ff)/ '
2912
- , $ Head )
2915
+ '/^(?:0000000c6a502020|25504446|38425053|424d|474946383[79]61|57454250|67696d7020786366|89504e47|ffd8ff)/ ' ,
2916
+ $ Head
2917
+ )
2913
2918
);
2914
2919
}
2915
2920
@@ -3090,7 +3095,9 @@ function_exists('gzinflate') &&
3090
3095
'/(base64_decode|decode_base64|base64\.b64decode|atob|Base64\.decode64)(\s* ' .
3091
3096
'\(\s*[" \'\`])([\da-z+\/]{4})*([\da-z+\/]{4}|[\da-z+\/]{3}=|[\da-z+\/]{2}==)([" \'\`] ' .
3092
3097
'\s*\))/i ' ,
3093
- $ str , $ matches )) {
3098
+ $ str ,
3099
+ $ matches
3100
+ )) {
3094
3101
for ($ i = 0 ; $ c > $ i ; $ i ++) {
3095
3102
$ str = str_ireplace (
3096
3103
$ matches [0 ][$ i ],
@@ -3102,7 +3109,9 @@ function_exists('gzinflate') &&
3102
3109
}
3103
3110
if ($ c = preg_match_all (
3104
3111
'/(str_rot13\s*\(\s*[" \'])([^ \'"\(\)]{1,4096})([" \']\s*\))/i ' ,
3105
- $ str , $ matches )) {
3112
+ $ str ,
3113
+ $ matches
3114
+ )) {
3106
3115
for ($ i = 0 ; $ c > $ i ; $ i ++) {
3107
3116
$ str = str_ireplace (
3108
3117
$ matches [0 ][$ i ],
@@ -3114,7 +3123,9 @@ function_exists('gzinflate') &&
3114
3123
}
3115
3124
if ($ c = preg_match_all (
3116
3125
'/(hex2bin\s*\(\s*[" \'])([\da-f]{1,4096})([" \']\s*\))/i ' ,
3117
- $ str , $ matches )) {
3126
+ $ str ,
3127
+ $ matches
3128
+ )) {
3118
3129
for ($ i = 0 ; $ c > $ i ; $ i ++) {
3119
3130
$ str = str_ireplace (
3120
3131
$ matches [0 ][$ i ],
@@ -3126,7 +3137,9 @@ function_exists('gzinflate') &&
3126
3137
}
3127
3138
if ($ c = preg_match_all (
3128
3139
'/([Uu][Nn][Pp][Aa][Cc][Kk]\s*\(\s*[" \']\s*H\*\s*[" \']\s*,\s*[" \'])([\da-fA-F]{1,4096})([" \']\s*\))/ ' ,
3129
- $ str , $ matches )) {
3140
+ $ str ,
3141
+ $ matches
3142
+ )) {
3130
3143
for ($ i = 0 ; $ c > $ i ; $ i ++) {
3131
3144
$ str = str_replace ($ matches [0 ][$ i ], '" ' . $ this ->Loader ->hexSafe ($ this ->Loader ->substrBeforeLast ($ this ->Loader ->substrAfterFirst ($ matches [0 ][$ i ], $ matches [1 ][$ i ]), $ matches [3 ][$ i ])) . '" ' , $ str );
3132
3145
}
0 commit comments