如何用 & && || 分割命令;和 |在 php 中可以使用引号

Question

我有这个函数来验证 php 中的命令？

public function validate_command($command) {
    if (isset($this->config->settings->guest_commands)) {
        $commands = $this->config->settings->guest_commands;
    } else {
        $commands = array('echo', 'cat', 'ls', 'find', 'cd', 'grep', 'test', 'xargs');
    }
    $cmd_re = "(" . implode("|", array_diff($commands, array("xargs"))) . ")";
    if (in_array("xargs", $commands)) {
        $re = "/^\s*($cmd_re|xargs\s*$cmd_re)/";
    } else {
        $re = "/^\s*$cmd_re/";
    }
    $separators = "/(&&|\|\||\||;)/";
    $parts = preg_split($separators, $command, null, PREG_SPLIT_DELIM_CAPTURE);
    $result = array();
    foreach ($parts as $part) {
        if (!preg_match($re, trim($part)) && !preg_match($separators, $part)) {
            $last = array_pop($commands);
            $message = "guest user can only execute: " .
                     implode(", ", $commands) . " and " . $last;
            throw new Exception($message);
        } else if (preg_match('/(>|`|\$\()/', $part)) {
            throw new Exception("guest user can't use redirect to write to files" .
                                " or execute subshell");
        } else {
            $result[] = $part;
        }
    }
    return implode($result);
}

它使用以下命令拆分命令：

    $separators = "/(&&|\|\||\||;)/";
    $parts = preg_split($separators, $command, null, PREG_SPLIT_DELIM_CAPTURE);

如何使它适用于echo "©" 之类的命令？它应该返回相同的命令，但会抛出异常。

我可以在后面使用单个正则表达式吗？它应该是什么样子？它应该适用于这样的情况：

echo "©\"©" && echo "©"

$parts 应该有array('echo "©\"©"', '&&', 'echo "©"')（可以包含 && 或命令周围的空格）

我尝试了$separators = "/(?<![\"'](?:[^\"']|\\[\"'])*)(&&|\|\||\||;)/";，但出现异常：

preg_split(): Compilation failed: lookbehind assertion is not fixed length at offset 24

遍历字符串是唯一的选择吗？

Answer 1

您应该匹配引号之间的所有内容，然后将它们从结果集中排除：

$re = <<< 'RE'
~(?:"[^"\\]*(\\.[^"\\]*)*"|'[^'\\]*(\\.[^'\\]*)*')\K|(&&|\|\||\||;)~
RE;

$str = <<< 'STR'
echo '"&co\"py;"'
STR;

var_dump(preg_split($re, $str, -1, PREG_SPLIT_NO_EMPTY));

输出：

array(1) {
  [0]=>
  string(17) "echo '"&co\"py;"'"
}