False positives

[robwent]

I'm finding this pretty hard to use. Take a look at this

Pattern #17 - PHP: multiple encoded, most probably obfuscated code found --> found 1 occurence(s) in file ./templates/zenbase/tpls/blocks/fonts.php

Details: "This pattern could be used in highly encoded, malicious code hidden under a loop of code obfuscation function calls. In most cases the decoded hacker code goes through an eval call to execute it. This pattern is also often used for legitimate purposes, e.g. storing configuration information or serialised object data. Please inspect the file manually and compare it with the one in the original extension or Joomla package to verify that this is not a false positive."

Line #: 16
... str_replace(" ", "+", $this->params->get('bodyFont_custom'));
$headingFont = str_replace(" ", "+", $this->params->get('headingFont_custom'));
$navFont = str_replace(" ", "+", $this->params->get('navFo ...
--> ./templates/zenbase/tpls/blocks/fonts.php is a file. It was last accessed: 2014-03-03T21:59:57+01:00, last changed: 2015-10-26T20:19:55+01:00, last modified: 2014-03-03T21:59:57+01:00.
File permissions:0644

What's encoded about that code and why is it being picked up?

[BitPopCoin]

Download a fresh joomla then see if your file is identical, if so, you're fine.

[iv660]

The problem is that pattern #17 has a \w\W character class in reg exp string, which effectively matches any character (i.e., it matches both word and non-word characters):

(?:(?:eval|gzuncompress|gzinflate|base64_decode|str_rot13|strrev|strtr|preg_replace|rawurldecode|str_replace|assert|unpack|urldecode)[\s/\*\w\W\(]*){2,}

This triggers a match for every file containing more than one occurance of the decoding functions names in any order, even following each other without gaps or being one in the beginning of a file and the other in the end, such as 'evaleval' or 'eval($a); eval($b)', which is probably not what it was intended to do.

Obviously, when talking about multiple encoding, it will make much more sense searching for nested function calls, such as 'eval(base64_decode($a));'.

E.g., the following reg exp will do the job:

(?:(?:eval|gzuncompress|gzinflate|base64_decode|str_rot13|strrev|strtr|preg_replace|rawurldecode|str_replace|assert|unpack|urldecode)\s*\([^\)]*){2,}

While the latter pattern is not coping with the problem of false positives for the sequences found within comments or character strings, it will at least search for the nested calls only, not for any occurances of the 'suspicious' function names.