Skip to content

Commit a05eb5b

Browse files
committed
BadFunctions/EasyRFI: bug fix - fix detecting of start/end of the statement [3]
An `include`/`require` statement can be used within template files to include another template and doesn't need a closing semi-colon in that case. That situation was so far not being considered by the sniff and the sniff could in that case search way to far and report on completely unrelated statements after the include.
1 parent 4447e8b commit a05eb5b

File tree

4 files changed

+13
-1
lines changed

4 files changed

+13
-1
lines changed

Security/Sniffs/BadFunctions/EasyRFISniff.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ public function register() {
3838
* @return void
3939
*/
4040
public function process(File $phpcsFile, $stackPtr) {
41-
$closer = $phpcsFile->findNext(T_SEMICOLON, ($stackPtr + 1));
41+
$closer = $phpcsFile->findNext(array(T_SEMICOLON, T_CLOSE_TAG), ($stackPtr + 1));
4242
if ($closer === false) {
4343
// Live coding or parse error.
4444
return;

Security/Tests/BadFunctions/EasyRFIUnitTest.0.inc

+5
Original file line numberDiff line numberDiff line change
@@ -16,5 +16,10 @@ include arg(2) . drupal_get_query_parameters()['param'];
1616
// Prevent false positives on safe $_SERVER variables.
1717
include $_SERVER['DOCUMENT_ROOT'] . '/filename.php';
1818

19+
?>
20+
<?php include $_POST['path'] ?><!-- Error. -->
21+
<?php
22+
echo function_call($param);
23+
1924
// Intentional parse error. This should be the last test in the file.
2025
require_once

Security/Tests/BadFunctions/EasyRFIUnitTest.1.inc

+5
Original file line numberDiff line numberDiff line change
@@ -16,5 +16,10 @@ include arg(2) . drupal_get_query_parameters()['param']; // Warning x 2.
1616
// Prevent false positives on safe $_SERVER variables.
1717
include $_SERVER['DOCUMENT_ROOT'] . '/filename.php'; // Error.
1818

19+
?>
20+
<?php include $_POST['path'] ?><!-- Error. -->
21+
<?php
22+
echo function_call($param);
23+
1924
// Intentional parse error. This should be the last test in the file.
2025
require $_GET['path']

Security/Tests/BadFunctions/EasyRFIUnitTest.php

+2
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,15 @@ public function getErrorList($testFile = '')
2929
return [
3030
8 => 1,
3131
10 => 1,
32+
20 => 1,
3233
];
3334

3435
case 'EasyRFIUnitTest.1.inc':
3536
return [
3637
8 => 1,
3738
10 => 1,
3839
17 => 1,
40+
20 => 1,
3941
];
4042

4143
case 'EasyRFIUnitTest.Drupal7.1.inc':

0 commit comments

Comments
 (0)