PHP function name bypasses

_Issue originally created by user lifeforms on date 2018-12-30 20:59:58. Link to original issue: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1274._

In PHP code, functions are called like system('uname') which triggers our PHP function names blacklist. However, PHP functions can also be called as follows:

# as made famous by https://www.secjuice.com/php-rce-bypass-filters-sanitization-waf/
(system)('uname')         # triggers 942370 by accident
(sy.(st).em)('uname')
(string)"system"('uname')

# some others
define('x', 'sys' . 'tem');
(x)/* comment */('uname');

$y = 'sys'.'tem';
($y)('uname')

define('z', [['sys' .'tem']]);
(z)[0][0]('uname');

Can we block these patterns, for instance with a regular expression? Probably would be in a higher paranoia level.

[CRS-migration-bot]

User spartantri commented on date 2019-01-02 13:25:13:

We will catch it as excessive non word chars and things like that not properly classify it as php injection bypass attempt, do somebody knows how to write transforms? it would be really nice to have the php equivalent t:phpdecode functionality to that of t:cmdline for bash as there will be a lot of possible combinations of this.

[CRS-migration-bot]

User dune73 commented on date 2019-03-08 15:41:50:

Yes, theMiddleBlue covered this in #1294. So this is done. Closing now. Please reopen if I’m wrong.