Corveda / PHPSandbox

A PHP-based sandboxing library with a full suite of configuration and validation options.
https://phpsandbox.org
Other
220 stars 46 forks source link

How to redefine a internal function #3

Closed forfrt closed 8 years ago

forfrt commented 8 years ago

It says in the introduction that:

Can redefine internal PHP and other functions to make them more secure for sandbox usage.

So I have tried using defineFunc like below:

         $newSandbox=$this->sandbox->defineFunc("phpinfo", function(){
             echo "hellow phpinfo";
         });
         $newSandbox->whitelistFunc('phpinfo');
         #printHello('1\n');
         $newSandbox->execute(function(){
             phpinfo();
         });

But it seems doesn't work fine with eval statement. Furthermore, Could I have any method to inherit internal function other than totally rewrite it.

Best regrads.

fieryprophet commented 8 years ago

You can't pass the sandbox a closure within an eval statement as it's not able to parse the passed closure so it can execute it within the sandbox environment.

This code would work:

$newSandbox->defineFunc("phpinfo", function(){
        echo "hellow phpinfo";
});
$newSandbox->execute('<?php phpinfo(); ');

Also, notice you don't need to whitelist redefined functions, they are valid by default.