02-05 【Code Analysis】thinkphp v5.x App.php s参数RCE

public function pathinfo()
{
    if (is_null($this->pathinfo)) {
        if (isset($_GET[Config::get('var_pathinfo')])) {
            // 判断URL里面是否有兼容模式参数
            $_SERVER['PATH_INFO'] = $_GET[Config::get('var_pathinfo')];
            unset($_GET[Config::get('var_pathinfo')]);
        } elseif (IS_CLI) {
            // CLI模式下 index.php module/controller/action/params/...
            $_SERVER['PATH_INFO'] = isset($_SERVER['argv'][1]) ? $_SERVER['argv'][1] : '';
        }

        // 分析PATHINFO信息
        ...
        $this->pathinfo = empty($_SERVER['PATH_INFO']) ? '/' : ltrim($_SERVER['PATH_INFO'], '/');
    }
    return $this->pathinfo;
}

public static function parseUrl($url, $depr = '/', $autoSearch = false)
{
    if (isset(self::$bind['module'])) {
        $bind = str_replace('/', $depr, self::$bind['module']);
        // 如果有模块/控制器绑定
        $url = $bind . ('.' != substr($bind, -1) ? $depr : '') . ltrim($url, $depr);
    }
    $url              = str_replace($depr, '|', $url);
    list($path, $var) = self::parseUrlPath($url);
    $route            = [null, null, null];
    // ...
}

public static function module($result, $config, $convert = null)
{
    if (is_string($result)) {
        $result = explode('/', $result);
    }

    $request = Request::instance();

    ...

    // 设置默认过滤机制
    $request->filter($config['default_filter']);

    ...

    try {
        $instance = Loader::controller(// 实例化controller类
            $controller,
            $config['url_controller_layer'],
            $config['controller_suffix'],
            $config['empty_controller']
        );
    } catch (ClassNotFoundException $e) {
        throw new HttpException(404, 'controller not exists:' . $e->getClass());
    }

    // 获取当前操作名
    $action = $actionName . $config['action_suffix'];

    $vars = [];
    if (is_callable([$instance, $action])) {
        // 执行操作方法
        $call = [$instance, $action];
        // 严格获取当前操作方法名
        $reflect    = new \ReflectionMethod($instance, $action);
        $methodName = $reflect->getName();
        $suffix     = $config['action_suffix'];
        $actionName = $suffix ? substr($methodName, 0, -strlen($suffix)) : $methodName;
        $request->action($actionName);

    } elseif (is_callable([$instance, '_empty'])) {
        // 空操作
        $call = [$instance, '_empty'];
        $vars = [$actionName];
    } else {
        // 操作不存在
        throw new HttpException(404, 'method not exists:' . get_class($instance) . '->' . $action . '()');
    }

    Hook::listen('action_begin', $call);

    return self::invokeMethod($call, $vars);// 调用函数
}

public static function invokeMethod($method, $vars = [])
{
    if (is_array($method)) {
        $class   = is_object($method[0]) ? $method[0] : self::invokeClass($method[0]);
        $reflect = new \ReflectionMethod($class, $method[1]);
    } else {
        // 静态方法
        $reflect = new \ReflectionMethod($method);
    }

    $args = self::bindParams($reflect, $vars);// 获取参数内容 这里获取到参数用做method的参数输入

    self::$debug && Log::record('[ RUN ] ' . $reflect->class . '->' . $reflect->name . '[ ' . $reflect->getFileName() . ' ]', 'info');

    return $reflect->invokeArgs(isset($class) ? $class : null, $args);
}

public function run()
{
    try {
        // 初始化应用
        $this->initialize();

        ...

        $dispatch = $this->dispatch;

        if (empty($dispatch)) {
            // 路由检测
            $dispatch = $this->routeCheck()->init();// 处理module、controller、action
        }

        // 记录当前调度信息
        $this->request->dispatch($dispatch);

        ...

    } catch (HttpResponseException $exception) {
        $dispatch = null;
        $data     = $exception->getResponse();
    }

    $this->middleware->add(function (Request $request, $next) use ($dispatch, $data) {
        return is_null($data) ? $dispatch->run() : $data;
    });

    $response = $this->middleware->dispatch($this->request);// 动态调用controller、action

    ...

    return $response;
}

public function routeCheck()
{
    // 检测路由缓存
    ...

    // 获取应用调度信息
    $path = $this->request->path();
    // 从Request.php path提取urlpath 具体从pathinfo()，优先获取$_GET[$this->config['var_pathinfo']]
    // var_pathinfo 默认为s

    // 是否强制路由模式
    $must = !is_null($this->routeMust) ? $this->routeMust : $this->route->config('url_route_must');

    // 路由检测 返回一个Dispatch对象
    $dispatch = $this->route->check($path, $must);//返回UrlDispatch类实例，从dispatch类处继承

    ...

    return $dispatch;
}

public function init()
{
    // 解析默认的URL规则
    $result = $this->parseUrl($this->dispatch);
    // parseUrl函数处理参数值(以/分割，传入|也行会被替换成/，最终由/来分割)，返回[module,controller,action]

    return (new Module($this->request, $this->rule, $result))->init();
}

public function exec()
{
    // 监听module_init
    $this->app['hook']->listen('module_init');

    try {
        // 实例化控制器
        $instance = $this->app->controller($this->controller,
            $this->rule->getConfig('url_controller_layer'),
            $this->rule->getConfig('controller_suffix'),
            $this->rule->getConfig('empty_controller'));

        if ($instance instanceof Controller) {
            $instance->registerMiddleware();
        }
    } catch (ClassNotFoundException $e) {
        throw new HttpException(404, 'controller not exists:' . $e->getClass());
    }
    // 闭包调用
    $this->app['middleware']->controller(function (Request $request, $next) use ($instance) {
        // 获取当前操作名
        $action = $this->actionName . $this->rule->getConfig('action_suffix');

        if (is_callable([$instance, $action])) {
            // 执行操作方法
            $call = [$instance, $action];

            // 严格获取当前操作方法名
            $reflect    = new ReflectionMethod($instance, $action);
            $methodName = $reflect->getName();
            $suffix     = $this->rule->getConfig('action_suffix');
            $actionName = $suffix ? substr($methodName, 0, -strlen($suffix)) : $methodName;
            $this->request->setAction($actionName);

            // 自动获取请求变量
            $vars = $this->rule->getConfig('url_param_type')
            ? $this->request->route()
            : $this->request->param();
            $vars = array_merge($vars, $this->param);
        } elseif (is_callable([$instance, '_empty'])) {
            // 空操作
            $call    = [$instance, '_empty'];
            $vars    = [$this->actionName];
            $reflect = new ReflectionMethod($instance, '_empty');
        } else {
            // 操作不存在
            throw new HttpException(404, 'method not exists:' . get_class($instance) . '->' . $action . '()');
        }

        $this->app['hook']->listen('action_begin', $call);

        $data = $this->app->invokeReflectMethod($instance, $reflect, $vars);

        return $this->autoResponse($data);
    });

    return $this->app['middleware']->dispatch($this->request, 'controller');
}

private function filterValue(&$value, $key, $filters)
{
    $default = array_pop($filters);

    foreach ($filters as $filter) {
        if (is_callable($filter)) {
            // 调用函数或者方法过滤
            $value = call_user_func($filter, $value);//调用函数
        } elseif (is_scalar($value)) {
            if (false !== strpos($filter, '/')) {
                // 正则过滤
                if (!preg_match($filter, $value)) {
                    // 匹配不成功返回默认值
                    $value = $default;
                    break;
                }
            } elseif (!empty($filter)) {
                // filter函数不存在时, 则使用filter_var进行过滤
                // filter为非整形值时, 调用filter_id取得过滤id
                $value = filter_var($value, is_int($filter) ? $filter : filter_id($filter));
                if (false === $value) {
                    $value = $default;
                    break;
                }
            }
        }
    }

    return $value;
}