Skip to content

Commit 4510d8b

Browse files
MaikuolanMaikuolan
committedOct 15, 2024··
Switch file patch.
·
v3.6.1v3.5.2
1 parent 85afb42 commit 4510d8b

File tree

3 files changed

+85
-73
lines changed

3 files changed

+85
-73
lines changed
 

‎Changelog.md

+1
Original file line numberDiff line numberDiff line change
@@ -152,3 +152,4 @@ __*Why "v3.0.0" instead of "v1.0.0?"*__ Prior to phpMussel v3, the "phpMussel Co
152152
- [2024.10.15]: Added support to optionally disable adding new hash cache entries when a specific instance cache flag is used.
153153
- [2024.10.15]: Added support to inform the user via an optional instance cache flag which flags were set by the switch file during the scan when scanning via CLI.
154154
- [2024.10.15]: Added MP4 file type detection and modified PHP file type detection to reduce the risk of false positives (e.g., see phpMussel/phpMussel#241).
155+
- [2024.10.15]: Improved the phpMussel switch file.

‎assets/switch.dat

+69-47
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,69 @@
1-
Switch file for phpMussel.
2-
3-
== Sets flags for ignoring some certain ClamAV signature files ==
4-
FD-RX:377f068[23]002de218:A:8;infectable=false
5-
FD:252150532d41646f62652d:A:11;infectable=false
6-
FD:28546869732066696c65206d75737420626520636f6e76657274656420776974682042696e48657820342e3029:A:45;infectable=false
7-
FD:2e524d46:A:4;infectable=false
8-
FD:2f5247420a49440affffffffffffffffffffffffffffffffffffffffffffffff:0:128;infectable=false
9-
FD:494433:A:3;infectable=false
10-
FD:4f676753:A:4;infectable=false
11-
FD:5349502d48495420285349502f48:A:14;infectable=false
12-
FD:53514c69746520666f726d6174203300:A:16;infectable=false
13-
FD:53594d430100:A:6;infectable=false
14-
FD:d9d505f920a163d7:A:8;infectable=false
15-
FD:fffb90:A:3;infectable=false
16-
17-
== Assists with determining potential file content ==
18-
$fileswitch:unassigned;FN:\.[Mm][Pp]?4.?$;FD-RX:63(686170|6c6970|72676e|746162)|66726565|66747970|696d6170|6a7032|6b6d6174|6c6f6164|6d(617474|646174|6f6f66|6f6f76)|70696374|706e6f74|73(637074|6b6970|737263|796e63)|746d6364|75647461|75756964|77696465:4:4;fileswitch=mp4
19-
$fileswitch:unassigned;FD:4d5a:A:2;fileswitch=pefile
20-
$fileswitch:unassigned;FD-RX:(cafebabe|cafed00d|cefaedfe|cffaedfe|feedface|feedfacf):A:4;fileswitch=java
21-
$fileswitch:unassigned;FD-RX:494433|fffb90:A:3;fileswitch=mp3
22-
$fileswitch:unassigned;FD-NORM-RX:23212f7573722f(6c6f63616c2f)?62696e2f(656e76)?7065726c:A:24;fileswitch=perl
23-
$fileswitch:unassigned;FD:43723234:A:4;fileswitch=chrome
24-
$fileswitch:unassigned;FD:4c00000001140200:A:8;fileswitch=lnk
25-
$fileswitch:unassigned;FD:d0cf11:A:3;fileswitch=docfile
26-
$fileswitch:unassigned;FD-NORM-RX:23212f7573722f(6c6f63616c2f)?62696e2f(656e76)?707974686f6e:A:26;fileswitch=py
27-
$fileswitch:unassigned;FD-NORM:6372656174656f626a656374;fileswitch=vb
28-
$fileswitch:unassigned;FD-NORM:406563686f;fileswitch=bat
29-
$fileswitch:unassigned;FD-NORM-RX:3c736372697074.{0,128}(6c616e67756167653d2[27]76627363726970742[27]|747970653d2[27]746578742f76627363726970742[27]);fileswitch=vb
30-
$fileswitch:unassigned;FD-NORM-RX:3c736372697074.{0,128}(6c616e67756167653d2[27]6a6176617363726970742[27]|747970653d2[27]746578742f6a6176617363726970742[27]);fileswitch=js
31-
$fileswitch:unassigned;FD-NORM-RX:3c25406c616e67756167653d(2[27])?76627363726970742e656e636f6465;fileswitch=vb
32-
$fileswitch:unassigned;FD-NORM-RX:23212f7573722f(6c6f63616c2f)?62696e2f(656e76)?72756279:A:24;fileswitch=ruby
33-
$fileswitch:unassigned;FN:\.([Bb][Aa][Tt]|[Cc][Mm][Dd]|[Bb][Tt][Mm])$;fileswitch=bat
34-
$fileswitch:unassigned;FN:\.([Vv][Bb].{0,3}|[Ww][Ss][CcFf]|[Hh][Tt][Aa]?[Mm]?[Ll]?)$;fileswitch=vb
35-
$fileswitch:unassigned;FN:\.[Mm][Pp].$;fileswitch=mp3
36-
$fileswitch:unassigned;FD:3c25:A:2;fileswitch=asp
37-
$fileswitch:unassigned;FN:\.([Aa][Uu][Tt][Oo][Rr][Uu][Nn]|[Ii][Nn][Ff]|[Ii][Nn][Ii]|[Cc][Ff][Gg])$;fileswitch=inf
38-
$fileswitch:unassigned;FN:\.[Aa][Ss][Pp].?$;fileswitch=asp
39-
$fileswitch:unassigned;FN:\.[Jj][Ss]([Pp][Xx]?|[Oo][Nn])?$;fileswitch=js
40-
$fileswitch:unassigned;FN:\.[Pp][Yy].?$;fileswitch=py
41-
$fileswitch:unassigned;FN:\.[Jj][Aa]([Vv][Aa]|[Rr])$;fileswitch=java
42-
$fileswitch:unassigned;FN:\.[Pp]([Ee][Rr])?[Ll]$;fileswitch=perl
43-
$fileswitch:unassigned;FN:\.[Cc][Gg][Ii]$;fileswitch=cgi
44-
$fileswitch:unassigned;FN:\.([Rr][Uu]?[Bb][WwYy]?|[Gg][Ee][Mm])$;fileswitch=ruby
45-
$fileswitch:unassigned;FN:\.([Cc][Vv][Dd]|[Ii][Nn][Cc]|[Mm][Dd]|[Tt][Xx][Tt])$;fileswitch=ignore
46-
$fileswitch:unassigned;FD-RX:(1f8b|425a68|504b|52617221|7f454c46):A:4;fileswitch=vt_interest
47-
$fileswitch:unassigned;FD:7801:A:2;FD:6b6f6c79:-512;fileswitch=vt_interest
1+
# Switch file for phpMussel.
2+
3+
4+
5+
# Used by the ClamAV General and the ClamAV ASCII signature files to ignore certain signatures
6+
# ---
7+
!ISSET:infectable;FD-RX:377f068[23]002de218:A:8;infectable=false
8+
!ISSET:infectable;FD:252150532d41646f62652d:A:11;infectable=false
9+
!ISSET:infectable;FD:28546869732066696c65206d75737420626520636f6e76657274656420776974682042696e48657820342e3029:A:45;infectable=false
10+
!ISSET:infectable;FD:2e524d46:A:4;infectable=false
11+
!ISSET:infectable;FD:2f5247420a49440affffffffffffffffffffffffffffffffffffffffffffffff:0:128;infectable=false
12+
!ISSET:infectable;FD:494433:A:3;infectable=false
13+
!ISSET:infectable;FD:4f676753:A:4;infectable=false
14+
!ISSET:infectable;FD:5349502d48495420285349502f48:A:14;infectable=false
15+
!ISSET:infectable;FD:53514c69746520666f726d6174203300:A:16;infectable=false
16+
!ISSET:infectable;FD:53594d430100:A:6;infectable=false
17+
!ISSET:infectable;FD:d9d505f920a163d7:A:8;infectable=false
18+
!ISSET:infectable;FD:fffb90:A:3;infectable=false
19+
!ISSET:infectable;infectable=true
20+
21+
22+
23+
# Assists with determining most probably file format, and thus, probable types of content.
24+
# ---
25+
FD-RX:435753|465753|5a5753:A:3;is_swf=true
26+
!ISSET:is_swf;FN:\.[Ss][Ww][FfTt]$;is_swf=true
27+
!ISSET:is_swf;is_swf=false
28+
29+
FD:25504446:A:4;pdf_magic=true
30+
!ISSET:pdf_magic;pdf_magic=false
31+
$pdf_magic:true;is_pdf=true
32+
FN:\.[Pp][Dd][Ff]$;is_pdf=true
33+
!ISSET:is_pdf;is_pdf=false
34+
35+
!ISSET:fileswitch;FN:\.[Mm][Pp]?4.?$;FD-RX:63(?:686170|6c6970|72676e|746162)|66726565|66747970|696d6170|6a7032|6b6d6174|6c6f6164|6d(?:617474|646174|6f6f66|6f6f76)|70696374|706e6f74|73(?:637074|6b6970|737263|796e63)|746d6364|75647461|75756964|77696465:4:4;fileswitch=mp4
36+
!ISSET:fileswitch;FD:4d5a:A:2;fileswitch=pefile
37+
FD-RX:cafe(?:babe|d00d)|c[ef]faedfe|feedfac[ef]:A:4;is_macho=true
38+
!ISSET:is_macho;is_macho=false
39+
!ISSET:fileswitch;$is_macho:true;fileswitch=java
40+
!ISSET:fileswitch;FD-RX:494433|fffb90:A:3;fileswitch=mp3
41+
!ISSET:fileswitch;FD-NORM-RX:23212f7573722f(?:6c6f63616c2f)?62696e2f(?:656e76)?7065726c:A:24;fileswitch=perl
42+
!ISSET:fileswitch;FD:43723234:A:4;fileswitch=chrome
43+
!ISSET:fileswitch;FD:4c00000001140200:A:8;fileswitch=lnk
44+
!ISSET:fileswitch;FD:d0cf11:A:3;fileswitch=docfile
45+
!ISSET:fileswitch;FD-NORM-RX:23212f7573722f(?:6c6f63616c2f)?62696e2f(?:656e76)?707974686f6e:A:26;fileswitch=py
46+
!ISSET:fileswitch;FD-NORM:6372656174656f626a656374;fileswitch=vb
47+
!ISSET:fileswitch;FD-NORM:406563686f;fileswitch=bat
48+
!ISSET:fileswitch;FD-NORM-RX:3c736372697074.{0,128}(?:6c616e67756167653d2[27]76627363726970742[27]|747970653d2[27]746578742f76627363726970742[27]);fileswitch=vb
49+
!ISSET:fileswitch;FD-NORM-RX:3c736372697074.{0,128}(?:6c616e67756167653d2[27]6a6176617363726970742[27]|747970653d2[27]746578742f6a6176617363726970742[27]);fileswitch=js
50+
!ISSET:fileswitch;FD-NORM-RX:3c25406c616e67756167653d(?:2[27])?76627363726970742e656e636f6465;fileswitch=vb
51+
!ISSET:fileswitch;FD-NORM-RX:23212f7573722f(?:6c6f63616c2f)?62696e2f(?:656e76)?72756279:A:24;fileswitch=ruby
52+
!ISSET:fileswitch;FN:\.(?:[Bb][Aa][Tt]|[Cc][Mm][Dd]|[Bb][Tt][Mm])$;fileswitch=bat
53+
!ISSET:fileswitch;FN:\.(?:[Vv][Bb].{0,3}|[Ww][Ss][CcFf]|[Hh][Tt][Aa]?[Mm]?[Ll]?)$;fileswitch=vb
54+
!ISSET:fileswitch;FN:\.[Mm][Pp].$;fileswitch=mp3
55+
!ISSET:fileswitch;FD:3c25:A:2;fileswitch=asp
56+
!ISSET:fileswitch;FN:\.(?:[Aa][Uu][Tt][Oo][Rr][Uu][Nn]|[Ii][Nn][Ff]|[Ii][Nn][Ii]|[Cc][Ff][Gg])$;fileswitch=inf
57+
!ISSET:fileswitch;FN:\.[Aa][Ss][Pp].?$;fileswitch=asp
58+
!ISSET:fileswitch;FN:\.[Jj][Ss](?:[Pp][Xx]?|[Oo][Nn])?$;fileswitch=js
59+
!ISSET:fileswitch;FN:\.[Pp][Yy].?$;fileswitch=py
60+
!ISSET:fileswitch;FN:\.[Jj][Aa](?:[Vv][Aa]|[Rr])$;fileswitch=java
61+
!ISSET:fileswitch;FN:\.[Pp](?:[Ee][Rr])?[Ll]$;fileswitch=perl
62+
!ISSET:fileswitch;FN:\.[Cc][Gg][Ii]$;fileswitch=cgi
63+
!ISSET:fileswitch;FN:\.(?:[Rr][Uu]?[Bb][WwYy]?|[Gg][Ee][Mm])$;fileswitch=ruby
64+
!ISSET:fileswitch;$is_swf:true;fileswitch=swf
65+
!ISSET:fileswitch;$is_pdf:true;fileswitch=pdf
66+
!ISSET:fileswitch;FN:\.(?:[Cc][Vv][Dd]|[Ii][Nn][Cc]|[Mm][Dd]|[Tt][Xx][Tt])$;fileswitch=ignore
67+
!ISSET:fileswitch;FD-RX:(?:1f8b|425a68|504b|52617221|7f454c46):A:4;fileswitch=vt_interest
68+
!ISSET:fileswitch;FD:7801:A:2;FD:6b6f6c79:-512;fileswitch=vt_interest
69+
!ISSET:fileswitch;fileswitch=unassigned

‎src/Scanner.php

+15-26
Original file line numberDiff line numberDiff line change
@@ -1269,7 +1269,6 @@ private function dataHandler(string $str = '', int $Depth = 0, string $OriginalF
12691269
$len_hgb = ($StringLength > 536870912) ? 1 : 0;
12701270
$phase = $this->Loader->InstanceCache['phase'];
12711271
$container = $this->Loader->InstanceCache['container'];
1272-
$pdf_magic = ($fourcc === '25504446');
12731272

12741273
/** CoEx flags for configuration directives related to signatures. */
12751274
foreach ([
@@ -1341,21 +1340,6 @@ private function dataHandler(string $str = '', int $Depth = 0, string $OriginalF
13411340
$str_hex
13421341
) || preg_match('/0a2d2d.{32}(?:2d2d)?(?:0d)?0a/i', $str_hex));
13431342

1344-
/** Look for potential Mach-O indicators. */
1345-
$is_macho = preg_match('/^(?:cafe(?:babe|d00d)|c[ef]faedfe|feedfac[ef])$/', $fourcc);
1346-
1347-
/** Look for potential PDF indicators. */
1348-
$is_pdf = ($pdf_magic || $xt === 'pdf');
1349-
1350-
/** Look for potential Shockwave/SWF indicators. */
1351-
$is_swf = (
1352-
strpos(',435753,465753,5a5753,', ',' . substr($str_hex, 0, 6) . ',') !== false ||
1353-
strpos(',swf,swt,', ',' . $xt . ',') !== false
1354-
);
1355-
1356-
/** "Infectable"? Used by ClamAV General and ClamAV ASCII signatures. */
1357-
$infectable = true;
1358-
13591343
/** "Asciiable"? Used by all ASCII signatures. */
13601344
$asciiable = (bool)$str_hex_norm_len;
13611345

@@ -1365,33 +1349,36 @@ private function dataHandler(string $str = '', int $Depth = 0, string $OriginalF
13651349
strpos(',bin,ole,xml,rels,', ',' . $xt . ',') !== false
13661350
);
13671351

1368-
/** Worked by the switch file. */
1369-
$fileswitch = 'unassigned';
13701352
if (!empty($this->Loader->InstanceCache['sf'])) {
13711353
if (!isset($this->Loader->InstanceCache['Print after CLI scan'])) {
13721354
$this->Loader->InstanceCache['Print after CLI scan'] = '';
13731355
}
13741356
$this->Loader->InstanceCache['Print after CLI scan'] .= sprintf($this->Loader->L10N->getString('label.Flags set by the switch file while scanning %s'), $OriginalFilename) . "\n";
13751357
}
1358+
1359+
/** Process the switch file. */
13761360
if (!isset($this->Loader->InstanceCache['switch.dat'])) {
13771361
$this->Loader->InstanceCache['switch.dat'] = $this->Loader->readFileAsArray($this->AssetsPath . 'switch.dat', FILE_IGNORE_NEW_LINES);
13781362
}
13791363
foreach ($this->Loader->InstanceCache['switch.dat'] as $ThisRule) {
1364+
if ($ThisRule === '' || substr($ThisRule, 0, 1) === '#') {
1365+
continue;
1366+
}
13801367
$Switch = (strpos($ThisRule, ';') === false) ? $ThisRule : $this->Loader->substrAfterLast($ThisRule, ';');
13811368
if (strpos($Switch, '=') === false) {
13821369
continue;
13831370
}
1384-
$Switch = explode('=', preg_replace('/[^\x20-\xFF]/', '', $Switch));
1371+
$Switch = explode('=', preg_replace('/[^\x20-\xFF]/', '', $Switch), 2);
13851372
if (empty($Switch[0])) {
13861373
continue;
13871374
}
13881375
if (empty($Switch[1])) {
13891376
$Switch[1] = false;
13901377
}
13911378
$theSwitch = $Switch[0];
1392-
$ThisRule = (strpos($ThisRule, ';') === false) ? [$ThisRule] : explode(';', $this->Loader->substrBeforeLast($ThisRule, ';'));
1379+
$ThisRule = (strpos($ThisRule, ';') === false) ? [] : explode(';', $this->Loader->substrBeforeLast($ThisRule, ';'));
13931380
foreach ($ThisRule as $Fragment) {
1394-
$Fragment = (strpos($Fragment, ':') === false) ? false : $this->splitSigParts($Fragment, 7);
1381+
$Fragment = (strpos($Fragment, ':') === false) ? [] : $this->splitSigParts($Fragment, 7);
13951382
if (empty($Fragment[0])) {
13961383
continue 2;
13971384
}
@@ -1489,15 +1476,17 @@ private function dataHandler(string $str = '', int $Depth = 0, string $OriginalF
14891476
continue 2;
14901477
}
14911478
}
1492-
} elseif (
1479+
} elseif (isset($Fragment[1]) && (
14931480
($Fragment[0] === 'FN' && !preg_match('/(?:' . $Fragment[1] . ')/i', $OriginalFilename)) ||
14941481
($Fragment[0] === 'FS-MIN' && $StringLength < $Fragment[1]) ||
14951482
($Fragment[0] === 'FS-MAX' && $StringLength > $Fragment[1]) ||
14961483
($Fragment[0] === 'FD' && strpos($str_hex, $Fragment[1]) === false) ||
14971484
($Fragment[0] === 'FD-RX' && !preg_match('/(?:' . $Fragment[1] . ')/i', $str_hex)) ||
14981485
($Fragment[0] === 'FD-NORM' && strpos($str_hex_norm, $Fragment[1]) === false) ||
1499-
($Fragment[0] === 'FD-NORM-RX' && !preg_match('/(?:' . $Fragment[1] . ')/i', $str_hex_norm))
1500-
) {
1486+
($Fragment[0] === 'FD-NORM-RX' && !preg_match('/(?:' . $Fragment[1] . ')/i', $str_hex_norm)) ||
1487+
($Fragment[0] === 'ISSET' && !isset(${$Fragment[1]})) ||
1488+
($Fragment[0] === '!ISSET' && isset(${$Fragment[1]}))
1489+
)) {
15011490
continue 2;
15021491
} elseif (substr($Fragment[0], 0, 1) === '$') {
15031492
$VarInSigFile = substr($Fragment[0], 1);
@@ -1506,10 +1495,10 @@ private function dataHandler(string $str = '', int $Depth = 0, string $OriginalF
15061495
}
15071496
} elseif (substr($Fragment[0], 0, 2) === '!$') {
15081497
$VarInSigFile = substr($Fragment[0], 2);
1509-
if (!isset($$VarInSigFile) || is_array($$VarInSigFile) || $$VarInSigFile == $Fragment[1]) {
1498+
if (isset($$VarInSigFile) && !is_array($$VarInSigFile) && $$VarInSigFile == $Fragment[1]) {
15101499
continue 2;
15111500
}
1512-
} elseif (strpos(',FN,FS-MIN,FS-MAX,FD,FD-RX,FD-NORM,FD-NORM-RX,', ',' . $Fragment[0] . ',') === false) {
1501+
} elseif (strpos(',FN,FS-MIN,FS-MAX,FD,FD-RX,FD-NORM,FD-NORM-RX,ISSET,!ISSET,', ',' . $Fragment[0] . ',') === false) {
15131502
continue 2;
15141503
}
15151504
}

0 commit comments

Comments
 (0)
Please sign in to comment.