| @@ -6122,8 +6122,9 @@ | ||
| 6122 | 6122 | // name and its parenthesis hides nothing. The first two cannot match |
| 6123 | 6123 | // without a superglobal of the request, so only the files that name |
| 6124 | 6124 | // one are prepared that way, about one in twenty. The third is looked |
| 6125 | 6125 | // for in the file as it is and checked again that way when it matches. |
| 6126 | + // The dynamic function constructor, further down, reuses the copy. | |
| 6126 | 6127 | $code = null; |
| 6127 | 6128 | |
| 6128 | 6129 | if ( $this->found( '/\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\b/', $content ) ) { |
| 6129 | 6130 | $code = $this->blank_comments( $content ); |
| @@ -6155,12 +6156,25 @@ | ||
| 6155 | 6156 | if ( $this->found_in_code( '/(?<![a-z0-9_>$])(?:include|require)(?:_once)?\s*+(?:\(\s*+)?[\'"]https?:\/\//i', $content, $code ) ) { |
| 6156 | 6157 | return __( 'a file from another server is included', 'vigilante' ); |
| 6157 | 6158 | } |
| 6158 | 6159 | |
| 6159 | - // Deprecated dynamic function constructor, nearly always malicious in modern code | |
| 6160 | - if ( ! empty( $cf ) && $this->needle_present( $content, $cf ) ) { | |
| 6161 | - // The name alone, for the same reason as the labels above. | |
| 6162 | - return rtrim( $cf, '(' ); | |
| 6160 | + // Deprecated dynamic function constructor, nearly always malicious in | |
| 6161 | + // modern code. It is a call, so it is looked for in the code and not | |
| 6162 | + // in the comments, like the three above: an old call left commented | |
| 6163 | + // out runs nothing, and plugins that are not on WordPress.org keep | |
| 6164 | + // them. Only the files that name it are prepared that way, and the | |
| 6165 | + // search goes straight to the copy without comments, so a comment | |
| 6166 | + // between the name and its parenthesis hides nothing either. | |
| 6167 | + if ( ! empty( $cf ) && false !== stripos( $content, rtrim( $cf, '(' ) ) ) { | |
| 6168 | + if ( null === $code ) { | |
| 6169 | + $code = $this->blank_comments( $content ); | |
| 6170 | + } | |
| 6171 | + | |
| 6172 | + // When PHP cannot be asked what is a comment, the match stands. | |
| 6173 | + if ( $this->needle_present( false === $code ? $content : $code, $cf ) ) { | |
| 6174 | + // The name alone, for the same reason as the labels above. | |
| 6175 | + return rtrim( $cf, '(' ); | |
| 6176 | + } | |
| 6163 | 6177 | } |
| 6164 | 6178 | |
| 6165 | 6179 | // Remote fetch piped into unserialize: a PHP object-injection / supply-chain |
| 6166 | 6180 | // vector seen in trojanized or nulled plugins (download a payload from a |
