fork(47) download 
  1. <?php
  2.  
  3. class Ext_Sandbox_PHPValidator
  4. {
  5.     public static function php_syntax_error($code, $tokens = null)
  6.     {
  7.         $braces = 0;
  8.         $inString = 0;
  9.  
  10.         $isCodeHtml = false;
  11.  
  12.         if (!$tokens) {
  13.             $tokens = token_get_all('<?php ' . $code);
  14.         }
  15.  
  16.         // First of all, we need to know if braces are correctly balanced.
  17.         // This is not trivial due to variable interpolation which
  18.         // occurs in heredoc, backticked and double quoted strings
  19.         foreach ($tokens as $token) {
  20.             if (is_array($token)) {
  21.                 switch ($token[0]) {
  22.                     case T_CURLY_OPEN:
  23.                     case T_DOLLAR_OPEN_CURLY_BRACES:
  24.                     case T_START_HEREDOC:
  25.                         ++$inString;
  26.                         break;
  27.                     case T_END_HEREDOC:
  28.                         --$inString;
  29.                         break;
  30.  
  31.                     case T_OPEN_TAG:
  32.                         $isCodeHtml = false;
  33.                         break;
  34.                     case T_CLOSE_TAG:
  35.                         $isCodeHtml = true;
  36.                         break;
  37.                 }
  38.             } else if ($inString & 1) {
  39.                 switch ($token) {
  40.                     case '`':
  41.                     case '"':
  42.                         --$inString;
  43.                         break;
  44.                 }
  45.             } else {
  46.                 switch ($token) {
  47.                     case '`':
  48.                     case '"':
  49.                         ++$inString;
  50.                         break;
  51.  
  52.                     case '{':
  53.                         ++$braces;
  54.                         break;
  55.                     case '}':
  56.                         if ($inString) --$inString;
  57.                         else {
  58.                             --$braces;
  59.                             if ($braces < 0) break 2;
  60.                         }
  61.  
  62.                         break;
  63.                 }
  64.             }
  65.         }
  66.  
  67.         // Display parse error messages and use output buffering to catch them
  68.         $inString = @ini_set('log_errors', false);
  69.         $token = @ini_set('display_errors', true);
  70.         ob_start();
  71.  
  72.         // If $braces is not zero, then we are sure that $code is broken.
  73.         // We run it anyway in order to catch the error message and line number.
  74.  
  75.         // Else, if $braces are correctly balanced, then we can safely put
  76.         // $code in a dead code sandbox to prevent its execution.
  77.         // Note that without this sandbox, a function or class declaration inside
  78.         // $code could throw a "Cannot redeclare" fatal error.
  79.  
  80.         $braces || $code = "if(0){?><?php {$code}\n" . ($isCodeHtml ? '<?php }' : '}');
  81.  
  82.         if (false === eval($code)) {
  83.             if ($braces) $braces = PHP_INT_MAX;
  84.             else {
  85.                 // Get the maximum number of lines in $code to fix a border case
  86.                 false !== strpos($code, "\r") && $code = strtr(str_replace("\r\n", "\n", $code), "\r", "\n");
  87.                 $braces = substr_count($code, "\n");
  88.             }
  89.  
  90.             $code = ob_get_clean();
  91.             $code = strip_tags($code);
  92.  
  93.             // Get the error message and line number
  94.             if (preg_match("/syntax error, (.+) in .+ on line (\\d+)$/s", $code, $code)) {
  95.                 $code[2] = (int)$code[2];
  96.                 $code = $code[2] <= $braces
  97.                     ? array($code[1], $code[2])
  98.                     : array('unexpected $end ' . substr($code[1], 14), $braces);
  99.             } else $code = array('syntax error', 0);
  100.         } else {
  101.             ob_end_clean();
  102.             $code = false;
  103.         }
  104.  
  105.         @ini_set('display_errors', $token);
  106.         @ini_set('log_errors', $inString);
  107.  
  108.         return $code;
  109.     }
  110.  
  111.     public static function validatePHPCode($source, $functions = array(), $enable = true)
  112.     {
  113.         $inner_functions = array();
  114.  
  115.         $func_started = 0;
  116.  
  117.         $previousToken = null;
  118.  
  119.         $callStack = array();
  120.  
  121.         $tokens = token_get_all('<?php ' . $source);
  122.  
  123.         if ($error = self::php_syntax_error($source, $tokens)) {
  124.             throw new Exception($error[0] . ': ' . $error[1]);
  125.         }
  126.  
  127.         $previousTokenContent = '';
  128.  
  129.         foreach ($tokens as $token) {
  130.             if (is_string($token)) {
  131.                 if ($token == '(') {
  132.                     if ($func_started) {
  133.                         $func_started = 0;
  134.                     } else {
  135.                         if ($previousToken[0] == T_STRING) {
  136.                             $funcSearch = implode('::', $callStack);
  137.                             if (strlen($funcSearch) && $funcSearch[0] != '$') {
  138.                                 if (!count($callStack) || (!$enable ^ (false === array_search($funcSearch, $functions)))) {
  139.                                     if (!in_array($funcSearch, $inner_functions)) {
  140.                                         throw new Exception('Function is disabled: ' . $funcSearch);
  141.                                     }
  142.                                 }
  143.                             }
  144.                         }
  145.  
  146.                         if (in_array($previousToken[0], array(T_VARIABLE, T_STRING_VARNAME, T_ENCAPSED_AND_WHITESPACE))) {
  147.                             if (!in_array($previousTokenContent, array('+', '-', '*', '/', '.', '^', '&', '?', '!', '%', '@'))) {
  148.                                 throw new Exception('Only direct function calls allowed, line ' . $previousToken[2]);
  149.                             }
  150.                         }
  151.                     }
  152.                 }
  153.  
  154.                 if ($token != '.') {
  155.                     $callStack = array();
  156.                 }
  157.             } else {
  158.                 list($id, $text) = $token;
  159.  
  160.                 if (in_array($id, array(T_COMMENT, T_DOC_COMMENT, T_WHITESPACE))) {
  161.                     continue;
  162.                 }
  163.  
  164.                 switch ($id) {
  165.                     case T_FUNCTION:
  166.                         $func_started = 1;
  167.                         break;
  168.                     case T_STRING:
  169.                         $callStack[] = $text;
  170.  
  171.                         if ($func_started) {
  172.                             $inner_functions[] = $text;
  173.                         }
  174.                         break;
  175.                     case T_NS_SEPARATOR:
  176.                     case T_DOUBLE_COLON:
  177.                     case T_OBJECT_OPERATOR:
  178.                         break;
  179.                     case T_VARIABLE:
  180.                         $callStack[] = $token[1];
  181.                         break;
  182.                     case T_EVAL:
  183.                         if (!$enable ^ (false === array_search('eval', $functions))) {
  184.                             throw new Exception('Eval is disabled, line ' . $token[2]);
  185.                         }
  186.                         break;
  187.                     case T_PRINT:
  188.                         if (!$enable ^ (false === array_search('print', $functions))) {
  189.                             throw new Exception('Print is disabled, line ' . $token[2]);
  190.                         }
  191.                         break;
  192.                     case T_ECHO:
  193.                         if (!$enable ^ (false === array_search('echo', $functions))) {
  194.                             throw new Exception('Echo is disabled, line ' . $token[2]);
  195.                         }
  196.                         break;
  197.                     case T_EXIT:
  198.                         if (!$enable ^ ((false === array_search('die', $functions)) && (false === array_search('exit', $functions)))) {
  199.                             throw new Exception('Exit/Die is disabled, line ' . $token[2]);
  200.                         }
  201.                         break;
  202.                     case T_THROW:
  203.                         if (!$enable ^ (false === array_search('throw', $functions))) {
  204.                             throw new Exception('Throw is disabled, line ' . $token[2]);
  205.                         }
  206.                         break;
  207.                     default:
  208.                         $callStack = array();
  209.                         break;
  210.                 }
  211.             }
  212.  
  213.             $previousToken = $token;
  214.         }
  215.  
  216.         return true;
  217.     }
  218. }
  219.  
  220.  
  221.  
  222. ##################################
  223.  
  224. $code = <<<PHP
  225. \$b = 1;
  226. \$c = 2;
  227. \$a = \$b + \$c;
  228. echo \$a;
  229.  
  230. class test {
  231.     public function __construct() {
  232.         echo 'construct';
  233.     }
  234.     public function foo(\$num) {
  235.         var_dump(\$num);
  236.     }
  237. }
  238.  
  239. \$test = new test();
  240. \$test->foo(\$a);
  241. PHP;
  242.  
  243. // validate the code
  244. $validator = new Ext_Sandbox_PHPValidator();
  245.  
  246. try
  247. {
  248.     // we enable only one function - echo, all others will throw error
  249.     $validator->validatePHPCode( $code, array('echo'), true);
  250.     $status = 'passed';
  251. }
  252. catch(Exception $ex)
  253. {
  254.     $status = $ex->getMessage();
  255. }
  256.  
  257. echo 'Status of validation is: ' . $status;
Success #stdin #stdout 0.01s 20520KB
comments (?)
stdin 
Standard input is empty
stdout 
Status of validation is: Function is disabled: var_dump
https://ideone.com/e1qx28
language:
PHP (php 7.3.5)
created:
11 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!