From 141d0279521a46c7e642b59812126b2ce1d71f2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Krzysztof=20Zaj=C4=85c?= <krzysztof.zajac2@gmail.com>
Date: Sat, 31 Aug 2024 16:41:24 +0200
Subject: [PATCH 1/3] Detecting phpinfo

---
 crash_detector.py           | 1 +
 test/test_crash_detector.py | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/crash_detector.py b/crash_detector.py
index 9aad597..7f36104 100644
--- a/crash_detector.py
+++ b/crash_detector.py
@@ -27,6 +27,7 @@ def get_matchers(
         re.compile("__GARLIC_CALL__ srand\\(\\) __ENDGARLIC__", flags),
         re.compile("function '.{0,30}GARLIC.{0,30}' not found", flags),
         re.compile("SQL syntax.{0,2048}GARLIC", flags),
+        re.compile(":/bin", flags),
         re.compile("<GARLIC", flags),
         # Forgot quotes that allow xss?
         re.compile("\\s[A-Za-z_0-9-]+\\s*=\\s*[^\\s\"']*GARLIC GARLIC", flags),
diff --git a/test/test_crash_detector.py b/test/test_crash_detector.py
index 47a7c55..0e89a2c 100644
--- a/test/test_crash_detector.py
+++ b/test/test_crash_detector.py
@@ -46,6 +46,10 @@ def test_weridly_escaped_payloads_are_detected(self):
         output = run_in_container_and_get_output(["php", "-r", "echo 'GARLIC\\\\\\\\\\\\\\\\\\'\\\\\\\\\\\\\\\\\"';"])
         self.assertAnyMatcherWouldDetect(output)
 
+    def test_phpinfo_or_env_is_detected(self):
+        output = run_in_container_and_get_output(["php", "-r", 'phpinfo();'])
+        self.assertAnyMatcherWouldDetect(output)
+
     def test_libxml_crashes_are_detected(self):
         output = run_in_container_and_get_output(["php", "-r", 'simplexml_load_string("BAD XML");'])
         self.assertAnyMatcherWouldDetect(output)

From 9f829e7758a2a29e8a06cfcf13b6cac64198d85f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Krzysztof=20Zaj=C4=85c?= <krzysztof.zajac2@gmail.com>
Date: Sat, 31 Aug 2024 16:43:14 +0200
Subject: [PATCH 2/3] .

---
 test/test_crash_detector.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/test_crash_detector.py b/test/test_crash_detector.py
index 0e89a2c..ff630a0 100644
--- a/test/test_crash_detector.py
+++ b/test/test_crash_detector.py
@@ -47,7 +47,7 @@ def test_weridly_escaped_payloads_are_detected(self):
         self.assertAnyMatcherWouldDetect(output)
 
     def test_phpinfo_or_env_is_detected(self):
-        output = run_in_container_and_get_output(["php", "-r", 'phpinfo();'])
+        output = run_in_container_and_get_output(["php", "-r", "phpinfo();"])
         self.assertAnyMatcherWouldDetect(output)
 
     def test_libxml_crashes_are_detected(self):

From c394236e933f800dbda67a716f7d95ffd24f58da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Krzysztof=20Zaj=C4=85c?= <krzysztof.zajac2@gmail.com>
Date: Sat, 31 Aug 2024 16:44:13 +0200
Subject: [PATCH 3/3] More test fixing

---
 docker_image/strip_php_array_annotations.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docker_image/strip_php_array_annotations.py b/docker_image/strip_php_array_annotations.py
index 64e55ef..8835463 100644
--- a/docker_image/strip_php_array_annotations.py
+++ b/docker_image/strip_php_array_annotations.py
@@ -5,6 +5,8 @@
     with open(file, "r", encoding="utf-8", errors="ignore") as f:
         data = f.read()
     with open(file, "w") as f:
+        for i in range(10):
+            data = re.sub(r"(function[^(]*\([^)]*)\? *array (\$[^)]*\))", r"\1\2", data, re.MULTILINE)
         for i in range(10):
             data = re.sub(r"(function[^(]*\([^)]*)array (\$[^)]*\))", r"\1\2", data, re.MULTILINE)
         f.write(data)