vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete #39546 and #39547

Browse source
This commit is contained in:
Laurent Destailleur 2026-08-15 16:53:30 +02:00
parent cffdd75591
commit 41dfccfc14
2 changed files with 19 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
htdocs/core/lib/functions.lib.php
View file

@ -12143,7 +12143,7 @@ function dol_eval_new($s)
$forbiddenphpmethods = array_merge($forbiddenphpmethods, array('invoke', 'invokeArgs')); // Methods of ReflectionFunction to execute a function
$prohibited_functions = array($forbiddenphpfunctions, $forbiddenphpfunctions);
$prohibited_functions = array_merge($forbiddenphpfunctions, $forbiddenphpmethods);
$prohibited_token_arrangements = [
// Variable functions "$a(", '"$a"(', "'FN_NAME'(", ('FN_NAME')()
@ -12182,7 +12182,7 @@ function dol_eval_new($s)
T_VARIABLE === $token_id
&& in_array($token_value, $prohibited_variables, true)
) {
return "« {$token_value} » is prohibited in « {$s} »";
return "Bad string syntax to evaluate. « {$token_value} » is prohibited in « {$s} »";
}
// Prohibited Functions
@ -12190,7 +12190,7 @@ function dol_eval_new($s)
T_STRING === $token_id
&& in_array($token_value, $prohibited_functions, true)
) {
return "« {$token_value} » is prohibited in « {$s} »";
return "Bad string syntax to evaluate. « {$token_value} » is prohibited in « {$s} »";
}
}
@ -12198,7 +12198,7 @@ function dol_eval_new($s)
$maxi = count($prohibited_token_ids);
for ($i = 0; $i < $maxi; ++$i) {
if (false !== strpos($tokens_arrangement, " {$prohibited_token_ids[$i]} ")) {
return "« {$prohibited_token_ids[$i]} » is prohibited in « {$s} »";
return "Bad string syntax to evaluate. « {$prohibited_token_ids[$i]} » is prohibited in « {$s} »";
}
}
@ -12206,7 +12206,7 @@ function dol_eval_new($s)
$maxi = count($prohibited_token_arrangements);
for ($i = 0; $i < $maxi; ++$i) {
if (false !== strpos($tokens_arrangement, $prohibited_token_arrangements[$i])) {
return "« {$prohibited_token_arrangements[$i]} » is prohibited in « {$s} »";
return "Bad string syntax to evaluate. « {$prohibited_token_arrangements[$i]} » is prohibited in « {$s} »";
}
}
@ -12214,7 +12214,7 @@ function dol_eval_new($s)
try {
return @eval("return {$s};") ?? '';
} catch (Throwable $ex) {
return "Exception during evaluation: " . $s . " - " . $ex->getMessage();
return "Bad string syntax to evaluate. Exception during evaluation: " . $s . " - " . $ex->getMessage();
}
}

17
test/phpunit/SecurityTest.php
View file

@ -578,7 +578,11 @@ class SecurityTest extends CommonClassTest
include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
include_once DOL_DOCUMENT_ROOT.'/projet/class/task.class.php';
$conf->global->MAIN_USE_DOL_EVAL_NEW = 0;
global $dolibarr_main_use_dol_eval_new;
$dolibarr_main_use_dol_eval_new = 0;
//$conf->global->MAIN_USE_DOL_EVAL_NEW = 1;
$conf->global->MAIN_ALLOW_DOUBLE_COLON_IN_DOL_EVAL = 0;
$conf->global->MAIN_ALLOW_OBFUSCATION_METHODS_IN_DOL_EVAL = 1;
@ -886,6 +890,7 @@ class SecurityTest extends CommonClassTest
* name reached indirectly by a PHP callable-dispatch function like array_map/usort/...
* instead of a direct call.
*
* @depends testDolEval
* @return void
*/
public function testDolEvalNew()
@ -896,11 +901,15 @@ class SecurityTest extends CommonClassTest
$langs = $this->savlangs;
$db = $this->savdb;
$conf->global->MAIN_USE_DOL_EVAL_NEW = 1;
$result = (string) dol_eval("array_map('sys'.'tem', array('id'))", 1, 1, '0');
global $dolibarr_main_use_dol_eval_new;
$dolibarr_main_use_dol_eval_new = 1;
$s = "array_map('sys'.'tem', array('id'))";
$result = (string) dol_eval($s, 1, 1, '0');
print "resultnew1 = ".$result."\n";
$this->assertStringContainsString('is prohibited', $result, 'The string was not detected as evil - array_map bypass');
$this->assertStringContainsString('is prohibited', $result, 'The string '.$s.' returned '.$result.', so was not detected as evil - array_map bypass');
$result = (string) dol_eval("usort(\$a, 'system')", 1, 1, '0');
print "resultnew2 = ".$result."\n";