From fa5eb52dd6c5ab34cdfb697cfd5b1c8c2e966ee2 Mon Sep 17 00:00:00 2001 From: Denis Ryabov Date: Sun, 24 Jan 2021 20:37:57 +0300 Subject: [PATCH] Don't warn on str_replace and preg_replace Both `str_replace` and `preg_replace` (deprecated /e modifier is checked in another rule) are widely used and shouldn't be considered as a marker of malicious code --- .../components/com_jedchecker/libraries/rules/jamss.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/administrator/components/com_jedchecker/libraries/rules/jamss.php b/administrator/components/com_jedchecker/libraries/rules/jamss.php index bc9ebf3..f3a3d5a 100644 --- a/administrator/components/com_jedchecker/libraries/rules/jamss.php +++ b/administrator/components/com_jedchecker/libraries/rules/jamss.php @@ -188,8 +188,8 @@ class JedcheckerRulesJamss extends JEDcheckerRule 'Probably malicious PHP script that "calls home"', '16', 'Detected script variations often used to inform the attackers about found vulnerable website.',), - array('(?:(?:eval|gzuncompress|gzinflate|base64_decode|str_rot13|strrev|strtr|preg_replace|rawurldecode|' . - 'str_replace|assert|unpack|urldecode)[\s/\*\w\W\(]*){2,}', + array('(?:(?:eval|gzuncompress|gzinflate|base64_decode|str_rot13|strrev|strtr|rawurldecode|' . + 'assert|unpack|urldecode)[\s/\*\w\W\(]*){2,}', 'PHP: multiple encoded, most probably obfuscated code found', '17', 'This pattern could be used in highly encoded, malicious code hidden under a loop of code obfuscation function ' .