Skip to content

Conversation

@zeroSteiner
Copy link
Contributor

Add a new language definition for PHP which will be needed by a Metasploit PR shortly. There doesn't appear to be any keywords that are invalid variable names for PHP, presumably because variables are defined with a $ prefix. This also adds a prefix definition which is different from the first character to suit PHP's need for variables to start with $ and be followed by a letter or underscore where as subsequent characters can include numbers.

@adfoster-r7
Copy link
Contributor

We could probably add some tests in the future; but looks like things are working now 📈

3.3.0 :002 > Rex::RandomIdentifier::Generator.new(language: :php).generate
 => "$e3A" 
3.3.0 :003 > Rex::RandomIdentifier::Generator.new(language: :javascript).generate
 => "qbfVxv6" 

@adfoster-r7 adfoster-r7 merged commit e3d050b into rapid7:master May 14, 2025
20 checks passed
)

PHPOpts = DefaultOpts.merge(
prefix: '$',
Copy link
Contributor

@adfoster-r7 adfoster-r7 May 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have a feeling we might need to come back to this pattern again in the future; as I imagine we'd want to use the same rig for classnames as well as variables, and it wouldn't be possible to use this current approach for that

i.e.

<<~EOF
class #{rig['class']} {
  public function __wake() {
    $#{rig['payload']} = '...';
  }
}
EOF

Also in some scenarios we might want to have the identifier without the $ prefix, such as when accessing params in PHP - such as $_GET['#{rig['injection_param']}']; etc

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well if the $ acts as a namespace, then maybe the language should have been named php-vars or something so we could add php-class because you could have a class named Foobar and a variable named $Foobar with separate values right? So it doesn't necessarily make sense to track them together here. For code readability it'd make sense to not reuse the identifiers, but obfuscation is part of the point here, so all the better if names are reused but still valid.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants