02-05 【Code Analysis】thinkphp v5.x App.php s引數RCE

public function pathinfo()
{
if (is_null($this->pathinfo)) {
if (isset($_GET[Config::get('var_pathinfo')])) {
// 判斷URL裡面是否有相容模式引數
$_SERVER['PATH_INFO'] = $_GET[Config::get('var_pathinfo')];
unset($_GET[Config::get('var_pathinfo')]);
} elseif (IS_CLI) {
// CLI模式下 index.php module/controller/action/params/...
$_SERVER['PATH_INFO'] = isset($_SERVER['argv'][1]) ? $_SERVER['argv'][1] : '';
}

// 分析PATHINFO資訊
...
$this->pathinfo = empty($_SERVER['PATH_INFO']) ? '/' : ltrim($_SERVER['PATH_INFO'], '/');
}
return $this->pathinfo;
}

public static function parseUrl($url, $depr = '/', $autoSearch = false)
{
if (isset(self::$bind['module'])) {
$bind = str_replace('/', $depr, self::$bind['module']);
// 如果有模組/控制器繫結
$url = $bind . ('.' != substr($bind, -1) ? $depr : '') . ltrim($url, $depr);
}
$url= str_replace($depr, '|', $url);
list($path, $var) = self::parseUrlPath($url);
$route= [null, null, null];
// ...
}

public static function module($result, $config, $convert = null)
{
if (is_string($result)) {
$result = explode('/', $result);
}

$request = Request::instance();

...

// 設定預設過濾機制
$request->filter($config['default_filter']);

...

try {
$instance = Loader::controller(// 例項化controller類
$controller,
$config['url_controller_layer'],
$config['controller_suffix'],
$config['empty_controller']
);
} catch (ClassNotFoundException $e) {
throw new HttpException(404, 'controller not exists:' . $e->getClass());
}

// 獲取當前操作名
$action = $actionName . $config['action_suffix'];

$vars = [];
if (is_callable([$instance, $action])) {
// 執行操作方法
$call = [$instance, $action];
// 嚴格獲取當前操作方法名
$reflect= new \ReflectionMethod($instance, $action);
$methodName = $reflect->getName();
$suffix= $config['action_suffix'];
$actionName = $suffix ? substr($methodName, 0, -strlen($suffix)) : $methodName;
$request->action($actionName);

} elseif (is_callable([$instance, '_empty'])) {
// 空操作
$call = [$instance, '_empty'];
$vars = [$actionName];
} else {
// 操作不存在
throw new HttpException(404, 'method not exists:' . get_class($instance) . '->' . $action . '()');
}

Hook::listen('action_begin', $call);

return self::invokeMethod($call, $vars);// 呼叫函式
}

public static function invokeMethod($method, $vars = [])
{
if (is_array($method)) {
$class= is_object($method[0]) ? $method[0] : self::invokeClass($method[0]);
$reflect = new \ReflectionMethod($class, $method[1]);
} else {
// 靜態方法
$reflect = new \ReflectionMethod($method);
}

$args = self::bindParams($reflect, $vars);// 獲取引數內容 這裡獲取到引數用做method的引數輸入

self::$debug && Log::record('[ RUN ] ' . $reflect->class . '->' . $reflect->name . '[ ' . $reflect->getFileName() . ' ]', 'info');

return $reflect->invokeArgs(isset($class) ? $class : null, $args);
}

public function run()
{
try {
// 初始化應用
$this->initialize();

...

$dispatch = $this->dispatch;

if (empty($dispatch)) {
// 路由檢測
$dispatch = $this->routeCheck()->init();// 處理module、controller、action
}

// 記錄當前排程資訊
$this->request->dispatch($dispatch);

...

} catch (HttpResponseException $exception) {
$dispatch = null;
$data= $exception->getResponse();
}

$this->middleware->add(function (Request $request, $next) use ($dispatch, $data) {
return is_null($data) ? $dispatch->run() : $data;
});

$response = $this->middleware->dispatch($this->request);// 動態呼叫controller、action

...

return $response;
}

public function routeCheck()
{
// 檢測路由快取
...

// 獲取應用排程資訊
$path = $this->request->path();
// 從Request.php path提取urlpath 具體從pathinfo()，優先獲取$_GET[$this->config['var_pathinfo']]
// var_pathinfo 預設為s

// 是否強制路由模式
$must = !is_null($this->routeMust) ? $this->routeMust : $this->route->config('url_route_must');

// 路由檢測 返回一個Dispatch物件
$dispatch = $this->route->check($path, $must);//返回UrlDispatch類例項，從dispatch類處繼承

...

return $dispatch;
}

public function init()
{
// 解析預設的URL規則
$result = $this->parseUrl($this->dispatch);
// parseUrl函式處理引數值(以/分割，傳入|也行會被替換成/，最終由/來分割)，返回[module,controller,action]

return (new Module($this->request, $this->rule, $result))->init();
}

public function exec()
{
// 監聽module_init
$this->app['hook']->listen('module_init');

try {
// 例項化控制器
$instance = $this->app->controller($this->controller,
$this->rule->getConfig('url_controller_layer'),
$this->rule->getConfig('controller_suffix'),
$this->rule->getConfig('empty_controller'));

if ($instance instanceof Controller) {
$instance->registerMiddleware();
}
} catch (ClassNotFoundException $e) {
throw new HttpException(404, 'controller not exists:' . $e->getClass());
}
// 閉包呼叫
$this->app['middleware']->controller(function (Request $request, $next) use ($instance) {
// 獲取當前操作名
$action = $this->actionName . $this->rule->getConfig('action_suffix');

if (is_callable([$instance, $action])) {
// 執行操作方法
$call = [$instance, $action];

// 嚴格獲取當前操作方法名
$reflect= new ReflectionMethod($instance, $action);
$methodName = $reflect->getName();
$suffix= $this->rule->getConfig('action_suffix');
$actionName = $suffix ? substr($methodName, 0, -strlen($suffix)) : $methodName;
$this->request->setAction($actionName);

// 自動獲取請求變數
$vars = $this->rule->getConfig('url_param_type')
? $this->request->route()
: $this->request->param();
$vars = array_merge($vars, $this->param);
} elseif (is_callable([$instance, '_empty'])) {
// 空操作
$call= [$instance, '_empty'];
$vars= [$this->actionName];
$reflect = new ReflectionMethod($instance, '_empty');
} else {
// 操作不存在
throw new HttpException(404, 'method not exists:' . get_class($instance) . '->' . $action . '()');
}

$this->app['hook']->listen('action_begin', $call);

$data = $this->app->invokeReflectMethod($instance, $reflect, $vars);

return $this->autoResponse($data);
});

return $this->app['middleware']->dispatch($this->request, 'controller');
}

private function filterValue(&$value, $key, $filters)
{
$default = array_pop($filters);

foreach ($filters as $filter) {
if (is_callable($filter)) {
// 呼叫函式或者方法過濾
$value = call_user_func($filter, $value);//呼叫函式
} elseif (is_scalar($value)) {
if (false !== strpos($filter, '/')) {
// 正則過濾
if (!preg_match($filter, $value)) {
// 匹配不成功返回預設值
$value = $default;
break;
}
} elseif (!empty($filter)) {
// filter函式不存在時, 則使用filter_var進行過濾
// filter為非整形值時, 呼叫filter_id取得過濾id
$value = filter_var($value, is_int($filter) ? $filter : filter_id($filter));
if (false === $value) {
$value = $default;
break;
}
}
}
}

return $value;
}