diff --git a/internal/languages/php/detectors/object/object.go b/internal/languages/php/detectors/object/object.go index 2d53d3c0f..627d9fda6 100644 --- a/internal/languages/php/detectors/object/object.go +++ b/internal/languages/php/detectors/object/object.go @@ -6,7 +6,6 @@ import ( "github.com/bearer/bearer/internal/scanner/ast/tree" "github.com/bearer/bearer/internal/scanner/detectors/common" - detectorscommon "github.com/bearer/bearer/internal/scanner/detectors/common" "github.com/bearer/bearer/internal/scanner/detectors/types" "github.com/bearer/bearer/internal/scanner/ruleset" ) @@ -51,9 +50,9 @@ func New(querySet *query.Set) types.Detector { // $user->name; // $user->name(); fieldAccessQuery := querySet.Add(`[ - (member_access_expression object: (_) @object name: (name) @field) @root - (member_call_expression object: (_) @object name: (name) @field) @root - ]`) + (member_access_expression object: (_) @object name: (name) @field) + (member_call_expression object: (_) @object name: (name) @field) + ] @root`) // array('foo' => 'bar'); // [ 'foo' => 'bar' ]; @@ -110,10 +109,10 @@ func (detector *objectDetector) getArrayCreation( return nil, nil } - var properties []detectorscommon.Property + var properties []common.Property for _, result := range results { - pairNode := result["key"] - name := result["value"].Content() + keyNode := result["key"] + name := keyNode.Content() propertyObjects, err := detectorContext.Scan(result["value"], ruleset.BuiltinObjectRule, traversalstrategy.Cursor) if err != nil { @@ -121,24 +120,24 @@ func (detector *objectDetector) getArrayCreation( } if len(propertyObjects) == 0 { - properties = append(properties, detectorscommon.Property{ + properties = append(properties, common.Property{ Name: name, - Node: pairNode, + Node: keyNode, }) continue } for _, propertyObject := range propertyObjects { - properties = append(properties, detectorscommon.Property{ + properties = append(properties, common.Property{ Name: name, - Node: pairNode, + Node: keyNode, Object: propertyObject, }) } } - return []interface{}{detectorscommon.Object{Properties: properties}}, nil + return []interface{}{common.Object{Properties: properties}}, nil } func (detector *objectDetector) getAssignment( diff --git a/internal/languages/php/detectors/object/projection.go b/internal/languages/php/detectors/object/projection.go index fec4e4190..5032177b4 100644 --- a/internal/languages/php/detectors/object/projection.go +++ b/internal/languages/php/detectors/object/projection.go @@ -5,11 +5,10 @@ import ( "github.com/bearer/bearer/internal/util/stringutil" "github.com/bearer/bearer/internal/scanner/detectors/common" - detectorscommon "github.com/bearer/bearer/internal/scanner/detectors/common" "github.com/bearer/bearer/internal/scanner/detectors/types" ) -func (detector *objectDetector) getProjections( // Deal with subscriptExpressionQuery here / Check Ruby +func (detector *objectDetector) getProjections( node *tree.Node, detectorContext types.Context, ) ([]interface{}, error) { @@ -47,7 +46,7 @@ func (detector *objectDetector) getProjections( // Deal with subscriptExpression return nil, nil } - objects, err := detectorscommon.ProjectObject( + objects, err := common.ProjectObject( node, detectorContext, objectNode, @@ -66,15 +65,14 @@ func (detector *objectDetector) getProjections( // Deal with subscriptExpression } func getObjectName(objectNode *tree.Node) string { + switch objectNode.Type() { // $user->name() // $user->name - if objectNode.Type() == "variable_name" { + // user->name + case "variable_name", "name": return objectNode.Content() - } - // $user->foo->name // $user->foo()->name - switch objectNode.Type() { case "member_access_expression", "member_call_expression": return objectNode.ChildByFieldName("name").Content() } diff --git a/internal/util/normalize_key/normalize_key.go b/internal/util/normalize_key/normalize_key.go index 9f8f25747..c68215d13 100644 --- a/internal/util/normalize_key/normalize_key.go +++ b/internal/util/normalize_key/normalize_key.go @@ -2,12 +2,13 @@ package normalize_key import ( "regexp" + "slices" "strings" ) var ( normalizeCaseRegexp = regexp.MustCompile(`[A-Z][A-Z][a-z]|[a-z][A-Z]`) // Matches "AP(INa)me" or "firs(tN)ame" - normalizeSeparatorRegexp = regexp.MustCompile(`[_\-.,\s:0-9]+`) + normalizeSeparatorRegexp = regexp.MustCompile(`[$_\-.,\s:0-9]+`) ) func Normalize(key string) string { @@ -22,6 +23,10 @@ func Normalize(key string) string { pieces = append(pieces, normalizeKeyPiece(key[start:])) + if len(pieces) != 0 && (pieces[0] == "get" || pieces[0] == "set") { + pieces = slices.Delete(pieces, 0, 1) + } + return strings.Join(pieces, " ") }