| @@ -6122,9 +6122,8 @@ | ||
| 6122 | 6122 | // name and its parenthesis hides nothing. The first two cannot match |
| 6123 | 6123 | // without a superglobal of the request, so only the files that name |
| 6124 | 6124 | // one are prepared that way, about one in twenty. The third is looked |
| 6125 | 6125 | // for in the file as it is and checked again that way when it matches. |
| 6126 | - // The dynamic function constructor, further down, reuses the copy. | |
| 6127 | 6126 | $code = null; |
| 6128 | 6127 | |
| 6129 | 6128 | if ( $this->found( '/\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\b/', $content ) ) { |
| 6130 | 6129 | $code = $this->blank_comments( $content ); |
| @@ -6156,25 +6155,12 @@ | ||
| 6156 | 6155 | if ( $this->found_in_code( '/(?<![a-z0-9_>$])(?:include|require)(?:_once)?\s*+(?:\(\s*+)?[\'"]https?:\/\//i', $content, $code ) ) { |
| 6157 | 6156 | return __( 'a file from another server is included', 'vigilante' ); |
| 6158 | 6157 | } |
| 6159 | 6158 | |
| 6160 | - // Deprecated dynamic function constructor, nearly always malicious in | |
| 6161 | - // modern code. It is a call, so it is looked for in the code and not | |
| 6162 | - // in the comments, like the three above: an old call left commented | |
| 6163 | - // out runs nothing, and plugins that are not on WordPress.org keep | |
| 6164 | - // them. Only the files that name it are prepared that way, and the | |
| 6165 | - // search goes straight to the copy without comments, so a comment | |
| 6166 | - // between the name and its parenthesis hides nothing either. | |
| 6167 | - if ( ! empty( $cf ) && false !== stripos( $content, rtrim( $cf, '(' ) ) ) { | |
| 6168 | - if ( null === $code ) { | |
| 6169 | - $code = $this->blank_comments( $content ); | |
| 6170 | - } | |
| 6171 | - | |
| 6172 | - // When PHP cannot be asked what is a comment, the match stands. | |
| 6173 | - if ( $this->needle_present( false === $code ? $content : $code, $cf ) ) { | |
| 6174 | - // The name alone, for the same reason as the labels above. | |
| 6175 | - return rtrim( $cf, '(' ); | |
| 6176 | - } | |
| 6159 | + // Deprecated dynamic function constructor, nearly always malicious in modern code | |
| 6160 | + if ( ! empty( $cf ) && $this->needle_present( $content, $cf ) ) { | |
| 6161 | + // The name alone, for the same reason as the labels above. | |
| 6162 | + return rtrim( $cf, '(' ); | |
| 6177 | 6163 | } |
| 6178 | 6164 | |
| 6179 | 6165 | // Remote fetch piped into unserialize: a PHP object-injection / supply-chain |
| 6180 | 6166 | // vector seen in trojanized or nulled plugins (download a payload from a |
