2019/03/17 at hachioji.pm #75 LT
PHPͷ༷ʑͳΤϥʔhachiojipm #752019/03/16@uzulla
View Slide
લఏ» ඞͣ͠·͠ΐ͏ɻerror_reporting(E_ALL);
PHPͷΤϥʔ» ࣗ༝ͳՕॴͰͷΩϟον͔ͳΓࠔ͕ͩɺϋϯυϥΛઃఆͰ͖Δ» PHP 7ʹͳΓɺେମ͕ʮErrorʯͱ͍͏Exceptionʹͳͬͨ» Ωϟον͠ͳ͍ͱ(ຊͷ)Errorʹม͞ΕΔ» ʢঘɺྫ֎Ωϟον͠ͳ͚Ε͍ͣΕʹͤΑࢮ͵ʣ» શ෦͕ྫ֎Ͱͳ͍͕ɺେମThrowableΛΩϟον͢ΕΑ͍» ͔͠͠Թނ৽ɺൿͷλϨΛ͔͖ճͧ͢ɻ
Τϥʔͷେ·͔ͳྨʢཁग़యʣ» ແ༻Ͱࢮ͵ͭ» Fatal Errors» Parse Error» ࢮ͵͚Ͳख͢Εࢮͳͳ͍ͭ» Recoverable Fatal Error» ख͠ͳͯ͘ࢮͳͳ͍ͭ» Warning» Noticeʢ
recoverable ͱ…» Τϥʔʢྫ֎Έ͍ͨͳͷʣΛΩϟονͯ͠ѲΓͭͿͤࢮͳͳ͍» ޙड़
ྨΛ͞Βʹࡉʹ
Fatal, Parse(Syntax) Error» E_ERROR» E_CORE_ERROR» E_COMPILE_ERROR» E_USER_ERROR» E_PARSE
Recoverable Fatal Error» E_RECOVERABLE_ERROR
Warning» E_WARNING» E_CORE_WARNING» E_COMPILE_WARNING» E_USER_WARNING
Notice ͳͲ» E_DEPRECATED» E_USER_DEPRECATED» E_NOTICE» E_USER_NOTICE» (E_STRICT)
E_ERROR (1<<0L) 1E_WARNING (1<<1L) 2E_PARSE (1<<2L) 4E_NOTICE (1<<3L) 8E_CORE_ERROR (1<<4L) 16E_CORE_WARNING (1<<5L) 32E_COMPILE_ERROR (1<<6L) 64E_COMPILE_WARNING (1<<7L) 128E_USER_ERROR (1<<8L) 256E_USER_WARNING (1<<9L) 512E_USER_NOTICE (1<<10L) 1024E_STRICT (1<<11L) 2048E_RECOVERABLE_ERROR (1<<12L) 4096E_DEPRECATED (1<<13L) 8192E_USER_DEPRECATED (1<<14L) 16384
ͰҾ͖ى͜͠·͠ΐ͏
E_ERROR» DateTimeInterfaceΛΠϯϓϦ͠Α͏ͱ͢ΔͳͲclass b implements DateTimeInterface {}new b();
ଈࢮ͢ΔͷͰ» ʢޙड़ͷʣset_error_handerݺΕͳ͍» ͳʹͰ͖ͳ͍ɺඞͣࢮ͵» ͔͠͠ɺΤϥʔͷऔΓ͘Β͍Ͱ͖Δ
Δʹregister_shutdown_function(function () {$error = error_get_last();if ( !is_array($error) ||!( $error['type'] &(E_ERROR | E_CORE_ERROR | E_COMPILE_ERROR |E_PARSE | E_USER_ERROR))) { return; // set_error_handelerͰर͍͑ͯΔͣͳͷͰແࢹ }// र͑ͳ͔ͬͨFATALͳΤϥʔecho "{$error['type']}:{$error['message']}"." in {$error['file']}:{$error['line']}";});
۩ମྫregister_shutdown_function(function () {$error = error_get_last();if ( !is_array($error) ||!( $error['type'] &(E_ERROR | E_CORE_ERROR | E_COMPILE_ERROR |E_PARSE | E_USER_ERROR))) { return; }error_log("Fatal Error:{$error['type']}:{$error['message']}"." in {$error['file']}:{$error['line']}");});class b implements DateTimeInterface {}new b();
» Կݴ͏͚Ͳɺٹ͑ΔΘ͚Ͱͳ͍» ۤͷϩάͨ͠ΓɺΤϥʔը໘Λग़ͨ͠Γఔ» ૹ৴ͨ͠σʔλ͕ͲΔΘ͚Ͱͳ͍ͷͰɺΰϛͷͳ͍ΩϨΠͳΤϥʔը໘Λग़ͨ͢Ίʹग़ྗͳͲΛOutput bufferingͯ͠ૹ৴͠ͳ͍Ͱ͓͘͜ͱ» https://uzulla.hateblo.jp/entry/2019/03/13/200820» ͋·Γڽͬͨࣄ͠ͳ͍΄͏͕ແʢ͢Ͱʹ͓͔͍͠ঢ়ଶ͔ͩΒͶʂʣ
E_CORE_ERROR» vmपΓͷΤϥʔ…ൃੜͤ͞Δํ๏͕Θ͔ΒΜ» odbcʹ͋Γͦ͏ʢ͔͠͠odbcΛ͏ࣄͳͲ͋Δͷ͔…ʁ» (ྑ͍αϯϓϧίʔυͭ͘Εͳ͔ͬͨ!)
E_COMPILE_ERROR» ఆٛࡁΈͷΫϥεΛએݴ͢ΕΑ͍class DateTime{}
E_USER_ERROR» ࣗͰ͛ΒΕΔ» trigger_errortrigger_error("test error", E_USER_ERROR);
E_PARSE» จ๏ؒҧ͑ΔͳͲ» ࢮ͵͠ɺ࠷ॳͷϑΝΠϧͩͱregister_shutdown_functionݺΕͳ͍require("bad.php"); // register_shutdown_functionݺΕΔ...if if (1){} // ͳʹͰ͖ͣଈࢮ
ҙɺEvalʹ͍ͭͯ» evalE_PARSE͕ൃੜ͢Δͷ͕ͩɺྫ֎ͷΩϟονΛ͠ͳ͍߹ͷΈੜ·ΕΔ» ͳ͓ɺྫ֎ΛΩϟον͠ͳ͍ͱFatal Errorѻ͍ʹͳΓɺࢮ͵ɻ» PHPϜζΧγΠωʔ// ࢮͳͳ͍ʢ͠ɺѲΓ௵ͤΤϥʔͳ͍ʣtry{ eval("if if(1){};"); }catch(\Throwable $e){ }// Uncaught ExceptionͰ͝ͱࢮ͵eval("if if(1){};");
E_RECOVERABLE_ERROR» ΦϒδΣΫτΛແͳΩϟετ͢ΔͳͲͯ͠ൃੜͰ͖Δ» ࢮ͵…͕ɺ෮׆Ͱ͖Δecho function() {};
ͨͱ͑͜ΕΛೖΕΔͱɺऴྃ͠ͳ͍» NoticeؚΊɺ͋ΒΏΔΤϥʔʢFatalআ͘ʣ͕ඈͼࠐΉ» Notice͘ΔͷͰɺ͜͜ͰExit͢ΔͱNoticeڐ͞ͳ͍ࣄ͕Ͱ͖Δʢ෭࡞༻తϝϦοτʢओ؍ʣʣset_error_handler(function ($type, $message, $file, $line) {error_log("Error: {$type}:{$message} in {$file}:{$line}");// ͜͜Ͱ exit͠ͳ͍ͱɺ࣮ͬͯߦ͕ଓ͘// ྫ֎ͷѲΓͭͿ͠ͷΑ͏ͳͷ});
E_WARNING» ͢ͰʹϘσΟ͕ૹ৴։࢝͞Ε͍ͯΔͷʹɺϔομʔΛ͓͘Ζ͏ͱͨ࣌͠ͳͲ» ࢮͳͳ͍ɺͷ͕ࠔΔɻʢͷͰɺલड़ͷςΫΛ͏ͱΑ͍ࣄʣheader("X-MY-HEADER: hoge");echo "hoge";session_start();
E_CORE_WARNING» ଘࡏ͠ͳ͍֦ுΛphp.iniͰࢦఆ͢Δ » Γαϯϓϧίʔυ͕͍͍ײ͡ͷ͕ͳ͔ͬͨͷͰলུ
E_COMPILE_WARNING» /*Λด͡ͳ͍ͳͲ» ιʔείʔυͷจࣈίʔυΛ͓͔͘͢͠ΔͳͲ» ͜ΕɺWarnͱ͍͏͔Syntax ErrorͰͳ͍ͷ͔ͱ…/*
E_USER_WARNING» ࣗͰtrigger͢Δtrigger_error("test error", E_USER_WARNING);
E_DEPRECATED» ඇਪͷؔʢڍಈʣΛͤ͞Δ» error_reporting(E_ALL)ͯ͠ͳ͍ͱͰͳ͍error_reporting(E_ALL);define("SomeThing", "is", true);
E_USER_DEPRECATED» ࣗͰ͛Δ» error_reporting(E_ALL)ͯ͠ͳ͍ͱͰͳ͍trigger_error("test error", E_USER_DEPRECATED);
E_NOTICE» ະఆٛมʹ৮Δɺଘࡏ͠ͳ͍ൣғͷྻʹ৮Δ» error_reporting(E_ALL)ͯ͠ͳ͍ͱͰͳ͍echo $undefined;
E_USER_NOTICE» ࣗͰ͛Δ» error_reporting(E_ALL)ͯ͠ͳ͍ͱͰͳ͍trigger_error("test error", E_USER_DEPRECATED);
(E_STRICT)» PHP5·Ͱ͔͠ͳ͍ɺ7Ͱͳ͘ͳͬͨ(ଞʹҠಈ͞Εͨ)» ܧঝͨ͠ΫϥεϝιουͷϑΟϯΨʔϓϦϯτ͕ҧ͏ͱ͔ʢҾ͕มΘΔͱ͔ʣ
·ͱΊ» Ή͔͍ͣ͠» ൿͷλϨ͕Δʢόʔδϣϯ্͕͕Δͱඍົʹʣ» ωοτʹʢࣗΛؚΊͯʣӕ͕ଟ͍ͷͰɺݕূͨ͠Γɺͨ·ʹλϨΛ͔͖·ͥͳ͍ͱ͍͚ͳ͍ʢࠓ͔͖ࠞͥͨΒؒҧͬͯͨ…ʣ» ϏοτͷฒͼΛͳ͕Ί͍ͯΔͱɺ૿ઃͷྺ࢙Λײ͡ΒΕΔ» ·͋PHPͳͷͰͶʂ
༨ஊ@ʹ͍ͭͯ» @Λ͚ͭͨࣜͷΤϥʔΛʮग़ྗ͠ͳ͍ʯʢ͚ͩʣ// $aม͕ແ͍࣌php > echo @$a; // ΤϥʔͰͳ͍ɺNULLʹͳΔphp > echo $a;PHP Notice: Undefined variable: a in php shell code on line 1
» @ͳΒFatalͰࢮͳͳ͍Θ͚Ͱͳ͘ʢࠂͳ͘ࢮ͵͕ʣ» @ݟ͚ͭͨΒʢཧ༝͕ͳ͚Εʣফ͠·͠ΐ͏// ݹɺ͜͏͍͏ॻ͖ํ͋ͬͨͳ$id = @$_POST['id'];// ͍·ͳΒ͜͏͔$id = $_POST['id'] ?? null;» ͳ͓ɺࣗલͰset_error_handlerͨ͠Βແࢹ͞Εͳ͍ͷͰɺ@׆༻͢Δݹ͍ϥΠϒϥϦΛ͏࣌ҙʂ
uzulla
veronikapj
tanakahisateru
atinfinity
prof18
k9i
pocopota
antyadev
cmnakamurashogo
niftycorp
always_allokay
chriscoyier
jonyablonski
holman
sachag
cromwellryan
edds
jcasabona
productmarketing
revolveconf
caitiem20
mojombo
3n