diff --git a/vip-scanner/checks/VIPRestrictedPatternsCheck.php b/vip-scanner/checks/VIPRestrictedPatternsCheck.php index 3c3a70a..c5dfc3d 100644 --- a/vip-scanner/checks/VIPRestrictedPatternsCheck.php +++ b/vip-scanner/checks/VIPRestrictedPatternsCheck.php @@ -17,6 +17,7 @@ function check( $files ) { "/(echo|print|\<\?\=)+.+(\\\$GLOBALS|\\\$_SERVER|\\\$_GET|\\\$_REQUEST|\\\$_POST)+/msiU" => array( "level" => "Warning", "note" => "Possible output of restricted variables" ), "/(echo|print|\<\?\=)+.+(get_search_query)+/msiU" => array( "level" => "Warning", "note" => "Output of search query" ), "/(\\\$GLOBALS|\\\$_SERVER|\\\$_GET|\\\$_REQUEST|\\\$_POST)+/msiU" => array( "level" => "Note", "note" => "Working with superglobals" ), + "/(\\\$_SERVER\[(?!('|\"REQUEST_URI|SCRIPT_FILENAME|HTTP_HOST'|\"))([^]]+|)\])+/msiU" => array( "level" => "Blocker", "note" => 'Non whitelisted $_SERVER superglobals found in this file' ), ); foreach ( $this->filter_files( $files, 'php' ) as $file_path => $file_content ) {