Unknown node error

[BafS]

Some node types are not handle, I tried to run progpilot on some projects using nullable type or group use and I have those errors:

• Unknown Stmt Node Encountered : Stmt_GroupUse
• Unknown Expr Type NullableType

[eric-therond]

Hello @BafS could you share your inputs / files / codes you are trying to analyze if I want to reproduce the bugs

Eric

[BafS]

Unfortunately it's private code but

<?php

function test(): ?int {
    return 1;
}

is enough to trigger Unknown Expr Type NullableType

[eric-therond]

it's a bug in a dependency used by progpilot : https://github.com/ircmaxell/php-cfg

the test cases I have developed with your help to reproduce the bugs : https://github.com/designsecurity/progpilot/blob/master/projects/tests/tests/negative/parser_error2.php https://github.com/designsecurity/progpilot/blob/master/projects/tests/tests/negative/parser_error3.php

cd designsecurity/progpilot/project/tests/
php testphpcfg.php ./tests/negative/parser_error2.php
PHP Fatal error:  Uncaught RuntimeException: Unknown Expr Type NullableType in /home/eric/dev/designsecurity/progpilot/projects/tests/vendor/ircmaxell/php-cfg/lib/PHPCfg/Parser.php:799

Could you submit these issues in the ircmaxell/php-cfg repository ?

[BafS]

Thanks ! I see that someone have the same problem already https://github.com/ircmaxell/php-cfg/issues/49

[NicolasCARPi]

@eric-therond Why isn't progpilot using your fork of php-cfg with the fix you made?

[NicolasCARPi]

Someone asked how to include the fork instead, but deleted their question. So here it is anyway:

diff --git a/composer.json b/composer.json
index 4b77081..b34d0ec 100644
--- a/composer.json
+++ b/composer.json
@@ -8,9 +8,15 @@
             "email": "[email protected]"
         }
     ],
+    "repositories": [
+          {
+              "type": "vcs",
+              "url": "https://github.com/eric-therond/php-cfg"
+          }
+    ],
     "require": {
         "php": "^7.0",
-        "ircmaxell/php-cfg": "^0.5",
+        "ircmaxell/php-cfg": "dev-master",
         "symfony/yaml": ">=3.3.6",
         "symfony/console": ">=3.3.5"
     },

[phackt]

yep it s me because i though i found the solution trying the latest ircmaxwell (@dev) in composer.json because according to me it was fixed in latest release but got another issue. Thanks @NicolasCARPi, gonna test it with the fork.

[phackt]

Still got Unknown Unknown Expr Type NullableType with this root composer.json:

{
    "name": "designsecurity/progpilot",
    "description": "A Static Analyser for security",
    "license": "MIT",
    "authors": [
        {
            "name": "Eric Therond",
            "email": "[email protected]"
        }
    ],
    "repositories": [
        {
            "type": "vcs",
            "url": "https://github.com/eric-therond/php-cfg"
        }
    ],
    "require": {
        "php": "^7.3",
        "ircmaxell/php-cfg": "dev-master",
        "symfony/yaml": ">=3.3.6",
        "symfony/console": ">=3.3.5"
    },
    "require-dev": {
        "phpunit/phpunit": "@dev"
    },
    "bin": ["projects/phar/progpilot"],
    "autoload": {
        "psr-0": {
            "progpilot": "package/src"
        }
    }
}

and last progpilot release 0.6.0. I'm trying to audit a Zend application.

php progpilot_v0.6.0.phar /path/to/app

Unknown Expr Type NullableType

How i installed it:

composer install
wget https://github.com/designsecurity/progpilot/releases/download/v0.6.0/progpilot_v0.6.0.phar

Thanks,

[NicolasCARPi]

Well, if you use the .phar, the custom composer.json has no effect!

[phackt]

My bad i was meaning i tried the released one (failed) and this one:

composer install
php launch.php

With launch.php:

<?php

require_once './vendor/autoload.php';

$context = new \progpilot\Context;
$analyzer = new \progpilot\Analyzer;

$context->inputs->setFolder("/path/to/root/");

$analyzer->run($context);
$results = $context->outputs->getResults();

var_dump($results);

?>

Just got:

PHP Fatal error:  Uncaught Error: Call to a member function getAssignDef() on null in /home/user/Documents/repo/progpilot/package/src/progpilot/Analysis/VisitorAnalysis.php:522
Stack trace:
#0 /home/user/Documents/repo/progpilot/package/src/progpilot/Analyzer.php(116): progpilot\Analysis\VisitorAnalysis->analyze(Object(progpilot\Code\MyCode))
#1 /home/user/Documents/repo/progpilot/package/src/progpilot/Analyzer.php(168): progpilot\Analyzer->runInternalFunction(Object(progpilot\Context), Object(progpilot\Objects\MyFunction))
#2 /home/user/Documents/repo/progpilot/package/src/progpilot/Analyzer.php(225): progpilot\Analyzer->runInternalAnalysis(Object(progpilot\Context), NULL)
#3 /home/user/Documents/repo/progpilot/package/src/progpilot/Analyzer.php(294): progpilot\Analyzer->runInternalPhp(Object(progpilot\Context))
#4 /home/user/Documents/repo/progpilot/package/src/progpilot/Analyzer.php(399): progpilot\Analyzer->runAllInternal(Object(progpilot\Context))
#5 /home/user/Documents/repo/progpilot/launch.php(10): progpilot\Analyzer-> in /home/user/Documents/repo/progpilot/package/src/progpilot/Analysis/VisitorAnalysis.php on line 522

$ php --version
PHP 7.3.7

Pretty weirdo, it works on a simple php test file.

btw thanks for your quick replies @NicolasCARPi

[eric-therond]

@phackt which file are you trying to analyze ? I can't reproduce the bug without this information

[NicolasCARPi]

@eric-therond Any code with a nullable type hint:

a.php:

<?php

function blah(?string $nullable): string
{
    if ($nullable) {
        return 'yep';
    }
    return 'nope';
}

./progpilot_v0.6.0.phar a.php


Unknown Expr Type NullableType

[eric-therond]

yes for this one it's corrected in the v1.0 ircmaxell/php-cfg branch but there is no stable version for the moment and there are other similar bugs like https://github.com/ircmaxell/php-cfg/issues/58

but it seems @phackt has a different issue related to progpilot itself:

PHP Fatal error: Uncaught Error: Call to a member function getAssignDef() on null in /home/user/Documents/repo/progpilot/package/src/progpilot/Analysis/VisitorAnalysis.php:522

I can't reproduce this bug without your inputs

[athanasius-kircher]

I can reproduce the error

PHP Fatal error: Uncaught Error: Call to a member function getAssignDef() on null in /home/user/Documents/repo/progpilot/package/src/progpilot/Analysis/VisitorAnalysis.php:522

with the following code:

$foo = $ba->r() ? $ba->r() : '';

[eric-therond]

I have updated dependency ircmaxell/php-cfg to 1.0.x-dev even if it is not a stable version. It allows to fix some significant bugs. You can test progpilot v0.8.0 and let me know if these errors are still present.

Thanks Eric

[NicolasCARPi]

@eric-therond Looks like it works now :) :+1: