| @@ -10,8 +10,9 @@ | ||
| 10 | 10 | use Countable; |
| 11 | 11 | use WP_Defender\Traits\IO; |
| 12 | 12 | use Calotes\Component\Behavior; |
| 13 | 13 | use WP_Defender\Behavior\Scan\Malware_Scan; |
| 14 | +use WP_Filesystem_Base; | |
| 14 | 15 | |
| 15 | 16 | /** |
| 16 | 17 | * This will fast travel all yara rules to quickly get files seem suspicious, this is catchy. |
| 17 | 18 | */ |
| @@ -36,9 +37,9 @@ | ||
| 36 | 37 | */ |
| 37 | 38 | public function do_quick_scan( string $file, array $rules ): array { |
| 38 | 39 | global $wp_filesystem; |
| 39 | 40 | // Initialize the WP filesystem, no more using 'file-put-contents' function. |
| 40 | - if ( empty( $wp_filesystem ) ) { | |
| 41 | + if ( ! $wp_filesystem instanceof WP_Filesystem_Base ) { | |
| 41 | 42 | require_once ABSPATH . '/wp-admin/includes/file.php'; |
| 42 | 43 | WP_Filesystem(); |
| 43 | 44 | } |
| 44 | 45 | $total_issues = 0; |
| @@ -78,9 +79,9 @@ | ||
| 78 | 79 | 'text' => $text, |
| 79 | 80 | 'offset' => $offset, |
| 80 | 81 | ); |
| 81 | 82 | } |
| 82 | - if ( empty( $local_issues['catches'] ) ) { | |
| 83 | + if ( array() === $local_issues['catches'] ) { | |
| 83 | 84 | continue; |
| 84 | 85 | } |
| 85 | 86 | |
| 86 | 87 | if ( $this->condition_valid( $local_issues['catches'], $rule ) ) { |
| @@ -104,21 +105,23 @@ | ||
| 104 | 105 | private function condition_valid( $found, $rule ): bool { |
| 105 | 106 | $condition = explode( 'and', $rule['condition'] ); |
| 106 | 107 | $count = 0; |
| 107 | 108 | foreach ( $condition as $item ) { |
| 108 | - $patterns = array( | |
| 109 | - 'x_of_them' => '/([a-z0-9]+)\s*of\s*(.*)/', | |
| 110 | - 'id_at_pos' => '/(\$[a-zA-Z0-9]+)\s*at\s*(\d+)/', | |
| 111 | - ); | |
| 112 | - foreach ( $patterns as $func => $pattern ) { | |
| 113 | - if ( preg_match( $pattern, $item, $match ) ) { | |
| 114 | - ++$count; | |
| 115 | - $ret = $this->$func( $found, $match, $rule ); | |
| 116 | - if ( false === $ret ) { | |
| 117 | - return false; | |
| 118 | - } | |
| 109 | + if ( preg_match( '/([a-z0-9]+)\s*of\s*(.*)/', $item, $match ) ) { | |
| 110 | + ++$count; | |
| 111 | + $ret = $this->x_of_them( $found, $match, $rule ); | |
| 112 | + if ( false === $ret ) { | |
| 113 | + return false; | |
| 119 | 114 | } |
| 120 | 115 | } |
| 116 | + | |
| 117 | + if ( preg_match( '/(\$[a-zA-Z0-9]+)\s*at\s*(\d+)/', $item, $match ) ) { | |
| 118 | + ++$count; | |
| 119 | + $ret = $this->id_at_pos( $found, $match, $rule ); | |
| 120 | + if ( false === $ret ) { | |
| 121 | + return false; | |
| 122 | + } | |
| 123 | + } | |
| 121 | 124 | } |
| 122 | 125 | if ( 0 === $count ) { |
| 123 | 126 | $this->log( $rule['identifier'], Malware_Scan::MALWARE_LOG ); |
| 124 | 127 | $this->log( $found, Malware_Scan::MALWARE_LOG ); |
| @@ -168,9 +171,9 @@ | ||
| 168 | 171 | private function id_at_pos( $found, $check_info, $rule ): bool { |
| 169 | 172 | // Get the text to check. |
| 170 | 173 | foreach ( $found as $item ) { |
| 171 | 174 | if ( $item['id'] === $check_info[1] ) { |
| 172 | - return strpos( $this->content, $item['text'] ) === $check_info[2]; | |
| 175 | + return strpos( $this->content, $item['text'] ) === (int) $check_info[2]; | |
| 173 | 176 | } |
| 174 | 177 | } |
| 175 | 178 | |
| 176 | 179 | return false; |
