firewall-php/lib/php-extension/HandleQueries.cpp at 1dad4a1ef1994c3c1fab2ff858999d61bd6c1a7e · AikidoSec/firewall-php · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
#include "Includes.h"

AIKIDO_HANDLER_FUNCTION(handle_pre_pdo_query) {
    scopedTimer.SetSink(sink, "sql_op");

    zend_string *query = NULL;

    ZEND_PARSE_PARAMETERS_START(0, -1)
        Z_PARAM_OPTIONAL
        Z_PARAM_STR(query)
    ZEND_PARSE_PARAMETERS_END();

    if (!query) {
        return;
    }

    /*
        Get the current pdo object for which the query function was called, using the "getThis" PHP helper function.
        https://github.com/php/php-src/blob/5dd8bb0fa884efba40117a83d198f3847922c0a3/Zend/zend_API.h#L526
    */
    zval *pdo_object = getThis();
    if (!pdo_object) {
        return;
    }

    eventId = EVENT_PRE_SQL_QUERY_EXECUTED;
    auto& eventCacheStack = AIKIDO_GLOBAL(eventCacheStack);
    eventCacheStack.Top().moduleName = "PDO";
    eventCacheStack.Top().sqlQuery = std::string(ZSTR_VAL(query), ZSTR_LEN(query));
    eventCacheStack.Top().sqlDialect = GetSqlDialectFromPdo(pdo_object);
}

AIKIDO_HANDLER_FUNCTION(handle_pre_pdo_exec) {
    scopedTimer.SetSink(sink, "sql_op");
    zend_string *query = NULL;

    ZEND_PARSE_PARAMETERS_START(1, 1)
        Z_PARAM_STR(query)
    ZEND_PARSE_PARAMETERS_END();

    if (!query) {
        return;
    }

    zval *pdo_object = getThis();
    if (!pdo_object) {
        return;
    }

    eventId = EVENT_PRE_SQL_QUERY_EXECUTED;
    auto& eventCacheStack = AIKIDO_GLOBAL(eventCacheStack);
    eventCacheStack.Top().moduleName = "PDO";
    eventCacheStack.Top().sqlQuery = std::string(ZSTR_VAL(query), ZSTR_LEN(query));
    eventCacheStack.Top().sqlDialect = GetSqlDialectFromPdo(pdo_object);
}

AIKIDO_HANDLER_FUNCTION(handle_pre_pdostatement_execute) {
    scopedTimer.SetSink(sink, "sql_op");

    zval *pdo_statement_object = getThis();
    if (!pdo_statement_object) {
        return;
    }

    pdo_stmt_t *stmt = Z_PDO_STMT_P(pdo_statement_object);
    if (!stmt->dbh) { // object is not initialized
        return;
    }

    if (!stmt->query_string) {
        return;
    }

    eventId = EVENT_PRE_SQL_QUERY_EXECUTED;
    auto& eventCacheStack = AIKIDO_GLOBAL(eventCacheStack);
    eventCacheStack.Top().moduleName = "PDOStatement";

#if PHP_VERSION_ID >= 80100
    eventCacheStack.Top().sqlQuery = std::string(ZSTR_VAL(stmt->query_string), ZSTR_LEN(stmt->query_string));
#else
    eventCacheStack.Top().sqlQuery = std::string((char*)stmt->query_string);
#endif

#if PHP_VERSION_ID >= 80500
    if (!stmt->database_object_handle) {
        eventCacheStack.Top().sqlDialect = "unknown";
        return;
    }
    eventCacheStack.Top().sqlDialect = GetSqlDialectFromPdo(stmt->database_object_handle);
#else
    eventCacheStack.Top().sqlDialect = GetSqlDialectFromPdo(&stmt->database_object_handle);
#endif
}

zend_class_entry* helper_load_mysqli_link_class_entry() {
    /* Static variable initialization ensures that the class entry is loaded only once and is thread-safe */
    static zend_class_entry* mysqliLinkClassEntry = (zend_class_entry*)zend_hash_str_find_ptr(EG(class_table), "mysqli", sizeof("mysqli") - 1);
    return mysqliLinkClassEntry;
}

AIKIDO_HANDLER_FUNCTION(handle_pre_mysqli_query){
	zval*     mysqliLinkObject = nullptr;
	char*	  query = nullptr;
	size_t 	  queryLength;
    zend_long resultMode;

    zend_class_entry* mysqliLinkClassEntry = helper_load_mysqli_link_class_entry();
    if (!mysqliLinkClassEntry) {
        AIKIDO_LOG_WARN("handle_pre_mysqli_query: did not find mysqli link class!\n");
        return;
    }

	if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os|l", &mysqliLinkObject, mysqliLinkClassEntry, &query, &queryLength, &resultMode) == FAILURE) {
		AIKIDO_LOG_WARN("handle_pre_mysqli_query: failed to parse parameters!\n");
        return;
	}

	if (!queryLength) {
        AIKIDO_LOG_WARN("handle_pre_mysqli_query: query length is 0!\n");
		return;
	}

    if (!mysqliLinkObject) {
        AIKIDO_LOG_WARN("handle_pre_mysqli_query: mysqli link object is null!\n");
        return;
    }

    scopedTimer.SetSink(sink, "sql_op");

    eventId = EVENT_PRE_SQL_QUERY_EXECUTED;
    auto& eventCacheStack = AIKIDO_GLOBAL(eventCacheStack);
    eventCacheStack.Top().moduleName = "mysqli";
    eventCacheStack.Top().sqlQuery = std::string(query, queryLength);
    eventCacheStack.Top().sqlDialect = "mysql";
}