php-malware-finder icon indicating copy to clipboard operation
php-malware-finder copied to clipboard

Published 20 hours ago • verified publisher icon jvoisin

Rule $concat_with_spaces causes a lot of false positives

Open scottcwilson opened this issue 6 years ago • 3 comments

I wonder if there's a better way of doing this.

scottcwilson avatar Jul 04 '19 15:07 scottcwilson

Feel free to issue a PR if you come up with a better solution :)

jvoisin avatar Jul 04 '19 20:07 jvoisin

Can you show me some true positives that this catches? I would need something to verify my work.

scottcwilson avatar Jul 04 '19 20:07 scottcwilson

Something like "s". "y" ."st"."e"."m(". I guess, or $a.$b.$c.$d. $cd, or "sy" . $s . "em(" . $BinA_ry .")"

jvoisin avatar Jul 04 '19 20:07 jvoisin