PHP 可变函数名安全性详解

目录

• PHP 可变函数名安全性详解
• • 一、可变函数名的本质与风险
  • • 1.1 可变函数/方法的多种形式
    • 1.2 实际攻击场景
  • 二、安全解决方案
  • • 2.1 白名单验证模式
    • 2.2 映射表与路由器模式
    • 2.3 闭包包装与沙箱模式
    • 2.4 类型安全与反射检查
  • 三、框架级别的防护
  • • 3.1 Laravel风格的路由保护
    • 3.2 Symfony风格的事件调度器
  • 四、安全最佳实践
  • • 4.1 安全配置检查器
    • 4.2 安全编码规范
  • 五、总结与建议
  • • 5.1 安全等级划分
    • 5.2 安全加固清单
    • 5.3 应急响应计划

PHP 可变函数名安全性详解

一、可变函数名的本质与风险

1.1 可变函数/方法的多种形式

class DynamicCallRisks {
// 1. 变量函数调用
public function variableFunctionCall(): void {
$func = 'system';
$func('ls -la'); // 直接执行系统命令！

// 从用户输入获取
$userInput = $_GET['action'] ?? 'default';
$userInput(); // 如果用户传入'system'…
}

// 2. 变量方法调用
public function variableMethodCall(): void {
$method = 'deleteUser';
$this->$method(123); // 动态调用方法

// 可能被利用
$userMethod = $_POST['method'] ?? 'save';
$this->$userMethod($_POST['data']); // 危险！
}

// 3. call_user_func / call_user_func_array
public function callUserFunc(): void {
// 直接调用
call_user_func('system', 'rm -rf /'); // 极其危险！

// 数组形式调用方法
$callable = [$this, 'processData'];
call_user_func($callable, $_GET);

// 可能被注入
$class = $_POST['class'] ?? 'App\\\\Controller';
$method = $_POST['method'] ?? 'index';
call_user_func([$class, $method], $_POST); // 类名和方法都可控！
}

// 4. 可变静态方法调用
public function variableStaticMethod(): void {
$class = 'Database';
$method = 'query';
$result = $class::$method('SELECT * FROM users'); // 动态静态调用
}

// 5. __call 和 __callStatic 魔术方法
public function __call(string $name, array $arguments) {
// 所有未定义的方法调用都会到这里
// 如果 $name 来自用户输入…
return $this->handleDynamicMethod($name, $arguments);
}

public static function __callStatic(string $name, array $arguments) {
// 静态方法同理
return self::handleDynamicStaticMethod($name, $arguments);
}

// 6. 可变对象创建
public function variableObjectCreation(): void {
$className = $_GET['type'] ?? 'stdClass';
$object = new $className(); // 如果用户传入恶意类名…
}
}

1.2 实际攻击场景

// 场景1：CMS中的插件系统漏洞
class VulnerableCMS {
public function executePlugin(string $pluginName, array $data) {
// 假设插件名来自URL: /?plugin=myPlugin
$functionName = $pluginName . '_execute';

if (function_exists($functionName)) {
return $functionName($data); // 攻击者可传入'system_execute'
}
}

// 攻击载荷：/?plugin=system&data=rm+-rf+/
// 实际调用：system_execute('rm -rf /')
}

// 场景2：API路由系统漏洞
class VulnerableAPIRouter {
private $controllers = ['UserController', 'AdminController'];

public function route(string $controller, string $action) {
// 来自URL: /api.php?controller=User&action=delete
$controllerClass = $controller . 'Controller';
$actionMethod = $action . 'Action';

if (in_array($controllerClass, $this->controllers)) {
$instance = new $controllerClass();
return $instance->$actionMethod(); // 可以调用任意方法
}
}

// 攻击：/api.php?controller=User&action=__destruct
// 可能触发意外的析构方法
}

// 场景3：模板引擎漏洞
class VulnerableTemplateEngine {
public function render(string $template, array $data) {
// 用户控制的模板名
$templateFile = 'templates/' . $template . '.php';

// 提取变量到当前作用域
extract($data);

// 包含模板文件
include $templateFile; // 如果template包含路径遍历…
}

// 攻击：template=../../../etc/passwd%00
}

二、安全解决方案

2.1 白名单验证模式

class WhitelistValidator {
// 允许的函数白名单
private const ALLOWED_FUNCTIONS = [
'date', 'strlen', 'trim', 'substr', 'explode', 'implode',
'json_encode', 'json_decode', 'htmlspecialchars', 'filter_var'
];

// 允许的方法白名单
private const ALLOWED_METHODS = [
'getData', 'saveData', 'deleteData', 'updateData',
'findById', 'findAll', 'validate'
];

// 允许的类白名单
private const ALLOWED_CLASSES = [
'App\\\\Models\\\\User',
'App\\\\Models\\\\Product',
'App\\\\Services\\\\Validator',
'DateTime'
];

/**
* 安全的可变函数调用
*/
public static function callFunction(string $functionName, …$args) {
if (!in_array($functionName, self::ALLOWED_FUNCTIONS, true)) {
throw new SecurityException("函数不在白名单中: {$functionName}");
}

if (!function_exists($functionName)) {
throw new RuntimeException("函数不存在: {$functionName}");
}

// 验证参数类型（可选）
self::validateFunctionArgs($functionName, $args);

return $functionName(…$args);
}

/**
* 安全的可变方法调用
*/
public static function callMethod(
object $object,
string $methodName,
array $args = []
) {
if (!in_array($methodName, self::ALLOWED_METHODS, true)) {
throw new SecurityException("方法不在白名单中: {$methodName}");
}

if (!method_exists($object, $methodName)) {
throw new RuntimeException("方法不存在: {$methodName}");
}

// 检查方法可见性
$reflection = new ReflectionMethod($object, $methodName);
if (!$reflection->isPublic()) {
throw new SecurityException("方法不可访问: {$methodName}");
}

return $object->$methodName(…$args);
}

/**
* 安全的可变静态方法调用
*/
public static function callStaticMethod(
string $className,
string $methodName,
array $args = []
) {
// 验证类名
if (!in_array($className, self::ALLOWED_CLASSES, true)) {
throw new SecurityException("类不在白名单中: {$className}");
}

// 验证方法名
$allowedStaticMethods = self::getStaticMethodsWhitelist();
if (!in_array($methodName, $allowedStaticMethods, true)) {
throw new SecurityException("静态方法不在白名单中: {$methodName}");
}

if (!method_exists($className, $methodName)) {
throw new RuntimeException("静态方法不存在: {$className}::{$methodName}");
}

// 反射检查
$reflection = new ReflectionMethod($className, $methodName);
if (!$reflection->isPublic() || !$reflection->isStatic()) {
throw new SecurityException("静态方法不可访问: {$className}::{$methodName}");
}

return $className::$methodName(…$args);
}

/**
* 安全的对象实例化
*/
public static function createInstance(string $className, array $args = []) {
if (!in_array($className, self::ALLOWED_CLASSES, true)) {
throw new SecurityException("类不在白名单中: {$className}");
}

// 检查类是否存在
if (!class_exists($className)) {
throw new RuntimeException("类不存在: {$className}");
}

// 检查构造函数可见性
$reflection = new ReflectionClass($className);
$constructor = $reflection->getConstructor();

if ($constructor && !$constructor->isPublic()) {
throw new SecurityException("类的构造函数不可访问: {$className}");
}

// 安全地实例化
if (empty($args)) {
return new $className();
} else {
return new $className(…$args);
}
}

/**
* 获取静态方法白名单（可从配置加载）
*/
private static function getStaticMethodsWhitelist(): array {
return [
'getInstance', 'create', 'validate', 'format',
'parse', 'encode', 'decode'
];
}

/**
* 验证函数参数
*/
private static function validateFunctionArgs(string $functionName, array $args): void {
$validators = [
'system' => fn($args) => throw new SecurityException('系统函数被禁止'),
'exec' => fn($args) => throw new SecurityException('执行函数被禁止'),
'passthru' => fn($args) => throw new SecurityException('passthru被禁止'),
'shell_exec' => fn($args) => throw new SecurityException('shell_exec被禁止'),
];

if (isset($validators[$functionName])) {
$validators[$functionName]($args);
}
}
}

2.2 映射表与路由器模式

class RouterPattern {
// 路由映射表
private const ROUTE_MAP = [
// 格式: 'route_name' => ['class', 'method']
'user.create' => ['App\\\\Controllers\\\\UserController', 'create'],
'user.update' => ['App\\\\Controllers\\\\UserController', 'update'],
'user.delete' => ['App\\\\Controllers\\\\UserController', 'delete'],
'product.list' => ['App\\\\Controllers\\\\ProductController', 'list'],
'product.detail' => ['App\\\\Controllers\\\\ProductController', 'detail'],
'auth.login' => ['App\\\\Controllers\\\\AuthController', 'login'],
'auth.logout' => ['App\\\\Controllers\\\\AuthController', 'logout'],
];

// 函数映射表
private const FUNCTION_MAP = [
'format_date' => 'App\\\\Formatters::formatDate',
'sanitize_html' => 'App\\\\Sanitizers::html',
'validate_email' => 'App\\\\Validators::email',
'encrypt_data' => 'App\\\\Cryptography::encrypt',
'decrypt_data' => 'App\\\\Cryptography::decrypt',
];

/**
* 安全的路由分发
*/
public function dispatch(string $route, array $params = []) {
if (!isset(self::ROUTE_MAP[$route])) {
throw new NotFoundException("路由未找到: {$route}");
}

list($className, $methodName) = self::ROUTE_MAP[$route];

// 验证类和方法
$this->validateRoute($className, $methodName);

// 实例化控制器
$controller = new $className();

// 调用方法
return $controller->$methodName($params);
}

/**
* 安全的函数调用
*/
public function callMappedFunction(string $functionKey, …$args) {
if (!isset(self::FUNCTION_MAP[$functionKey])) {
throw new SecurityException("函数映射未找到: {$functionKey}");
}

$callable = self::FUNCTION_MAP[$functionKey];

// 支持多种格式
if (is_string($callable) && strpos($callable, '::') !== false) {
// 静态方法
list($class, $method) = explode('::', $callable);
return $class::$method(…$args);
} elseif (is_string($callable)) {
// 普通函数
return $callable(…$args);
} elseif (is_array($callable)) {
// 数组形式
return $callable(…$args);
} else {
throw new RuntimeException("无效的可调用对象");
}
}

/**
* 动态注册路由（仅限开发环境）
*/
public function registerRoute(string $name, array $handler, bool $secure = true): void {
if ($secure) {
// 安全检查
$this->validateRoute($handler[0], $handler[1]);
}

// 添加到路由表
self::ROUTE_MAP[$name] = $handler;
}

/**
* 验证路由
*/
private function validateRoute(string $className, string $methodName): void {
// 检查类是否存在
if (!class_exists($className)) {
throw new RuntimeException("类不存在: {$className}");
}

// 检查方法是否存在
if (!method_exists($className, $methodName)) {
throw new RuntimeException("方法不存在: {$className}::{$methodName}");
}

// 反射检查
$reflection = new ReflectionMethod($className, $methodName);

// 必须是公共方法
if (!$reflection->isPublic()) {
throw new SecurityException("方法不可访问: {$methodName}");
}

// 禁止调用魔术方法（除了特殊允许的）
$forbiddenMethods = [
'__construct', '__destruct', '__call', '__callStatic',
'__get', '__set', '__isset', '__unset', '__invoke'
];

if (in_array($methodName, $forbiddenMethods, true)) {
throw new SecurityException("禁止调用魔术方法: {$methodName}");
}

// 检查注解（可选）
$docComment = $reflection->getDocComment();
if ($docComment && strpos($docComment, '@internal') !== false) {
throw new SecurityException("禁止调用内部方法: {$methodName}");
}
}

/**
* 中间件支持的安全路由
*/
public function dispatchWithMiddleware(
string $route,
array $params = [],
array $middlewares = []
) {
if (!isset(self::ROUTE_MAP[$route])) {
throw new NotFoundException("路由未找到: {$route}");
}

list($className, $methodName) = self::ROUTE_MAP[$route];

// 执行前置中间件
foreach ($middlewares as $middleware) {
if (!$middleware->before($route, $params)) {
throw new SecurityException("中间件拒绝访问");
}
}

// 执行路由
$controller = new $className();
$result = $controller->$methodName($params);

// 执行后置中间件
foreach (array_reverse($middlewares) as $middleware) {
$result = $middleware->after($route, $result);
}

return $result;
}
}

// 中间件接口
interface Middleware {
public function before(string $route, array &$params): bool;
public function after(string $route, $result);
}

// 安全检查中间件
class SecurityMiddleware implements Middleware {
private array $allowedRoutes = ['user.create', 'auth.login'];

public function before(string $route, array &$params): bool {
// 检查路由权限
if (!in_array($route, $this->allowedRoutes, true)) {
return false;
}

// 清理参数
foreach ($params as &$param) {
if (is_string($param)) {
$param = htmlspecialchars($param, ENT_QUOTES, 'UTF-8');
}
}

return true;
}

public function after(string $route, $result) {
// 记录日志
error_log("Route executed: {$route}");
return $result;
}
}

2.3 闭包包装与沙箱模式

class ClosureWrapper {
/**
* 安全的闭包执行器
*/
class SafeExecutor {
private array $allowedFunctions = [];
private array $blacklist = [
'system', 'exec', 'passthru', 'shell_exec', 'proc_open',
'popen', 'pcntl_exec', 'eval', 'assert', 'create_function',
'include', 'include_once', 'require', 'require_once'
];

public function __construct(array $allowedFunctions = []) {
$this->allowedFunctions = $allowedFunctions;
}

/**
* 执行闭包，限制可用的函数
*/
public function execute(Closure $closure, array $args = []) {
// 备份原始函数处理器
$originalHandler = set_error_handler([$this, 'errorHandler']);

try {
// 设置执行时间限制
set_time_limit(5);

// 限制内存
ini_set('memory_limit', '32M');

// 执行闭包
$result = $closure(…$args);

// 恢复错误处理器
restore_error_handler();

return $result;
} catch (Throwable $e) {
restore_error_handler();
throw new SecurityException("执行失败: " . $e->getMessage());
}
}

/**
* 创建受限的闭包环境
*/
public function createRestrictedClosure(callable $callable): Closure {
return function(…$args) use ($callable) {
// 禁止的函数调用检查
$backtrace = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS, 2);

if (isset($backtrace[1]['function'])) {
$callingFunction = $backtrace[1]['function'];
if (in_array($callingFunction, $this->blacklist, true)) {
throw new SecurityException("禁止调用函数: {$callingFunction}");
}
}

return $callable(…$args);
};
}

/**
* 错误处理器
*/
public function errorHandler(int $errno, string $errstr, string $errfile, int $errline): bool {
// 拦截特定错误
if (strpos($errstr, 'system()') !== false ||
strpos($errstr, 'exec()') !== false) {
throw new SecurityException("检测到危险函数调用: {$errstr}");
}

// 继续传递其他错误
return false;
}
}

/**
* 沙箱执行环境
*/
class Sandbox {
private array $allowedClasses = [];
private array $allowedFunctions = [];
private bool $strictMode = true;

public function __construct(array $config = []) {
$this->allowedClasses = $config['allowed_classes'] ?? [
'DateTime', 'DateTimeImmutable', 'DateInterval',
'ArrayObject', 'SplFixedArray'
];

$this->allowedFunctions = $config['allowed_functions'] ?? [
'count', 'sizeof', 'strlen', 'substr', 'explode',
'implode', 'trim', 'ltrim', 'rtrim', 'strtolower',
'strtoupper', 'ucfirst', 'lcfirst', 'json_encode',
'json_decode', 'filter_var'
];
}

/**
* 执行不受信任的代码
*/
public function executeUntrusted(string $code, array $context = []) {
// 创建隔离环境
$sandboxFunction = $this->createSandboxFunction($code);

// 绑定上下文
$boundFunction = Closure::bind($sandboxFunction, null, $this);

try {
return $boundFunction($context);
} catch (Throwable $e) {
throw new SecurityException("沙箱执行失败: " . $e->getMessage());
}
}

/**
* 创建沙箱函数
*/
private function createSandboxFunction(string $code): Closure {
// 解析代码，检查安全性
$this->validateCode($code);

// 创建安全的闭包
return function(array $context) use ($code) {
// 提取变量到局部作用域
extract($context, EXTR_SKIP);

// 执行代码
return eval($code);
};
}

/**
* 验证代码安全性
*/
private function validateCode(string $code): void {
// 检查危险函数
$dangerousPatterns = [
'/\\b(eval|assert|create_function)\\s*\\(/i',
'/\\b(include|require)(_once)?\\s*\\(/i',
'/\\b(system|exec|passthru|shell_exec)\\s*\\(/i',
'/`.*`/', // 反引号执行
'/\\$_(GET|POST|REQUEST|COOKIE|SERVER)/', // 直接访问超全局数组
];

foreach ($dangerousPatterns as $pattern) {
if (preg_match($pattern, $code)) {
throw new SecurityException("代码包含危险模式");
}
}

// 检查类实例化
if (preg_match('/new\\s+(\\w+)/', $code, $matches)) {
$className = $matches[1];
if (!in_array($className, $this->allowedClasses, true)) {
throw new SecurityException("禁止实例化类: {$className}");
}
}

// 检查函数调用
if (preg_match_all('/(\\w+)\\s*\\(/', $code, $matches)) {
foreach ($matches[1] as $function) {
if (!in_array($function, $this->allowedFunctions, true) &&
function_exists($function)) {
throw new SecurityException("禁止调用函数: {$function}");
}
}
}
}
}
}

2.4 类型安全与反射检查

class TypeSafeInvoker {
/**
* 类型安全的调用器
*/
class SafeInvoker {
private ReflectionClass $reflection;
private object $instance;

public function __construct(string $className) {
// 验证类名
if (!class_exists($className)) {
throw new RuntimeException("类不存在: {$className}");
}

$this->reflection = new ReflectionClass($className);

// 安全检查：不能是内部类或特殊类
if ($this->reflection->isInternal()) {
throw new SecurityException("不能操作PHP内部类");
}

// 实例化
$this->instance = $this->reflection->newInstance();
}

/**
* 安全调用方法
*/
public function invoke(string $methodName, array $args = []) {
// 检查方法是否存在
if (!$this->reflection->hasMethod($methodName)) {
throw new RuntimeException("方法不存在: {$methodName}");
}

$method = $this->reflection->getMethod($methodName);

// 安全检查
$this->validateMethod($method);

// 参数验证
$validatedArgs = $this->validateArguments($method, $args);

// 调用方法
return $method->invokeArgs($this->instance, $validatedArgs);
}

/**
* 安全调用静态方法
*/
public static function invokeStatic(string $className, string $methodName, array $args = []) {
$reflection = new ReflectionClass($className);

if (!$reflection->hasMethod($methodName)) {
throw new RuntimeException("静态方法不存在: {$className}::{$methodName}");
}

$method = $reflection->getMethod($methodName);

if (!$method->isStatic()) {
throw new RuntimeException("方法不是静态的: {$className}::{$methodName}");
}

// 安全检查
self::validateStaticMethod($method);

// 参数验证
$validatedArgs = self::validateStaticArguments($method, $args);

return $method->invokeArgs(null, $validatedArgs);
}

/**
* 方法验证
*/
private function validateMethod(ReflectionMethod $method): void {
// 必须是公共方法
if (!$method->isPublic()) {
throw new SecurityException("方法不可访问");
}

// 禁止魔术方法（除了构造和析构）
$forbiddenMagicMethods = [
'__call', '__callStatic', '__get', '__set',
'__isset', '__unset', '__invoke', '__sleep',
'__wakeup', '__toString', '__clone'
];

if (in_array($method->getName(), $forbiddenMagicMethods, true)) {
throw new SecurityException("禁止调用魔术方法: {$method->getName()}");
}

// 检查注解
$docComment = $method->getDocComment();
if ($docComment) {
if (strpos($docComment, '@internal') !== false) {
throw new SecurityException("禁止调用内部方法");
}

if (strpos($docComment, '@deprecated') !== false) {
throw new SecurityException("禁止调用已弃用的方法");
}
}
}

/**
* 静态方法验证
*/
private static function validateStaticMethod(ReflectionMethod $method): void {
if (!$method->isPublic()) {
throw new SecurityException("静态方法不可访问");
}

// 同样的魔术方法检查
$forbiddenMagicMethods = ['__callStatic'];

if (in_array($method->getName(), $forbiddenMagicMethods, true)) {
throw new SecurityException("禁止调用魔术静态方法");
}
}

/**
* 参数验证
*/
private function validateArguments(ReflectionMethod $method, array $args): array {
$parameters = $method->getParameters();
$validatedArgs = [];

foreach ($parameters as $index => $parameter) {
$paramName = $parameter->getName();

// 检查是否提供了参数
if (!array_key_exists($index, $args) && !$parameter->isDefaultValueAvailable()) {
throw new RuntimeException("缺少必需参数: {$paramName}");
}

$value = $args[$index] ?? $parameter->getDefaultValue();

// 类型检查
if ($parameter->hasType()) {
$type = $parameter->getType();
$value = $this->validateType($value, $type, $paramName);
}

$validatedArgs[] = $value;
}

return $validatedArgs;
}

/**
* 静态方法参数验证
*/
private static function validateStaticArguments(ReflectionMethod $method, array $args): array {
$parameters = $method->getParameters();
$validatedArgs = [];

foreach ($parameters as $index => $parameter) {
$value = $args[$index] ?? $parameter->getDefaultValue();

// 类型检查
if ($parameter->hasType()) {
$type = $parameter->getType();
$typeName = $type->getName();

if ($typeName !== 'mixed') {
$value = self::castToType($value, $typeName);
}
}

$validatedArgs[] = $value;
}

return $validatedArgs;
}

/**
* 类型验证和转换
*/
private function validateType($value, ReflectionType $type, string $paramName) {
$typeName = $type->getName();

// 基本类型检查
switch ($typeName) {
case 'int':
if (!is_numeric($value)) {
throw new TypeError("参数 {$paramName} 必须是整数");
}
return (int)$value;

case 'float':
if (!is_numeric($value)) {
throw new TypeError("参数 {$paramName} 必须是浮点数");
}
return (float)$value;

case 'string':
if (!is_scalar($value)) {
throw new TypeError("参数 {$paramName} 必须是字符串");
}
return (string)$value;

case 'bool':
return (bool)$value;

case 'array':
if (!is_array($value)) {
throw new TypeError("参数 {$paramName} 必须是数组");
}
return $value;

default:
// 对象类型检查
if (!($value instanceof $typeName)) {
throw new TypeError("参数 {$paramName} 必须是 {$typeName} 的实例");
}
return $value;
}
}

/**
* 类型转换
*/
private static function castToType($value, string $typeName) {
settype($value, $typeName);
return $value;
}
}
}

三、框架级别的防护

3.1 Laravel风格的路由保护

class LaravelStyleProtection {
// 路由服务
class Router {
private array $routes = [];
private array $middleware = [];

/**
* 注册GET路由
*/
public function get(string $uri, $action, array $middleware = []): self {
return $this->addRoute('GET', $uri, $action, $middleware);
}

/**
* 注册POST路由
*/
public function post(string $uri, $action, array $middleware = []): self {
return $this->addRoute('POST', $uri, $action, $middleware);
}

/**
* 添加路由
*/
private function addRoute(string $method, string $uri, $action, array $middleware): self {
$this->routes[] = [
'method' => $method,
'uri' => $uri,
'action' => $this->parseAction($action),
'middleware' => $middleware,
'name' => null
];

return $this;
}

/**
* 解析动作
*/
private function parseAction($action): array {
if (is_string($action)) {
// 字符串格式: 'Controller@method'
if (strpos($action, '@') === false) {
throw new InvalidArgumentException('动作格式不正确');
}

list($controller, $method) = explode('@', $action, 2);

return [
'type' => 'controller',
'controller' => $controller,
'method' => $method
];
} elseif (is_array($action)) {
// 数组格式: [Controller::class, 'method']
return [
'type' => 'controller',
'controller' => $action[0],
'method' => $action[1]
];
} elseif ($action instanceof Closure) {
// 闭包
return [
'type' => 'closure',
'closure' => $action
];
} else {
throw new InvalidArgumentException('不支持的Action类型');
}
}

/**
* 分发请求
*/
public function dispatch(string $method, string $uri) {
$route = $this->findRoute($method, $uri);

if (!$route) {
throw new NotFoundException('路由未找到');
}

// 执行中间件
foreach ($route['middleware'] as $middlewareClass) {
$middleware = new $middlewareClass();
if (!$middleware->handle()) {
throw new SecurityException('中间件拒绝访问');
}
}

// 执行动作
return $this->executeAction($route['action']);
}

/**
* 查找路由
*/
private function findRoute(string $method, string $uri): ?array {
foreach ($this->routes as $route) {
if ($route['method'] === $method && $this->matchUri($route['uri'], $uri)) {
return $route;
}
}

return null;
}

/**
* URI匹配
*/
private function matchUri(string $pattern, string $uri): bool {
// 简单实现，实际应该支持参数
return $pattern === $uri;
}

/**
* 执行动作
*/
private function executeAction(array $action) {
switch ($action['type']) {
case 'controller':
return $this->executeController($action);
case 'closure':
return $this->executeClosure($action);
default:
throw new RuntimeException('未知的动作类型');
}
}

/**
* 执行控制器
*/
private function executeController(array $action) {
$controllerClass = $action['controller'];
$method = $action['method'];

// 检查控制器类是否存在
if (!class_exists($controllerClass)) {
throw new RuntimeException("控制器不存在: {$controllerClass}");
}

// 实例化控制器
$controller = new $controllerClass();

// 检查方法是否存在
if (!method_exists($controller, $method)) {
throw new RuntimeException("方法不存在: {$controllerClass}@{$method}");
}

// 安全检查：不能调用魔术方法
if (strpos($method, '__') === 0) {
throw new SecurityException('禁止调用魔术方法');
}

// 调用方法
return $controller->$method();
}

/**
* 执行闭包
*/
private function executeClosure(array $action) {
$closure = $action['closure'];

// 安全检查：闭包不能包含危险函数
$reflection = new ReflectionFunction($closure);
$filename = $reflection->getFileName();

// 可以添加更多安全检查…

return $closure();
}
}

// 中间件示例
class AuthenticateMiddleware {
public function handle(): bool {
// 检查用户是否登录
return isset($_SESSION['user_id']);
}
}

class CSRFMiddleware {
public function handle(): bool {
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$token = $_POST['_token'] ?? '';
return $this->validateToken($token);
}
return true;
}

private function validateToken(string $token): bool {
return $token === ($_SESSION['csrf_token'] ?? '');
}
}

// 使用示例
public function setupRouter(): Router {
$router = new Router();

$router->get('/users', 'UserController@index', [AuthenticateMiddleware::class]);
$router->post('/users', 'UserController@store', [AuthenticateMiddleware::class, CSRFMiddleware::class]);
$router->get('/profile', [ProfileController::class, 'show'], [AuthenticateMiddleware::class]);

return $router;
}
}

3.2 Symfony风格的事件调度器

class SymfonyStyleEventDispatcher {
// 事件系统
class EventDispatcher {
private array $listeners = [];
private array $subscribers = [];

/**
* 添加事件监听器
*/
public function addListener(string $eventName, callable $listener, int $priority = 0): void {
$this->listeners[$eventName][$priority][] = $listener;
krsort($this->listeners[$eventName]);
}

/**
* 移除事件监听器
*/
public function removeListener(string $eventName, callable $listener): void {
if (!isset($this->listeners[$eventName])) {
return;
}

foreach ($this->listeners[$eventName] as $priority => $listeners) {
foreach ($listeners as $key => $l) {
if ($l === $listener) {
unset($this->listeners[$eventName][$priority][$key]);
}
}
}
}

/**
* 添加事件订阅者
*/
public function addSubscriber(EventSubscriberInterface $subscriber): void {
foreach ($subscriber->getSubscribedEvents() as $eventName => $params) {
if (is_string($params)) {
$this->addListener($eventName, [$subscriber, $params]);
} elseif (is_array($params)) {
if (is_string($params[0])) {
$this->addListener($eventName, [$subscriber, $params[0]], $params[1] ?? 0);
}
}
}

$this->subscribers[] = $subscriber;
}

/**
* 分发事件
*/
public function dispatch(object $event, string $eventName = null): object {
$eventName = $eventName ?? get_class($event);

if (isset($this->listeners[$eventName])) {
$this->callListeners($this->listeners[$eventName], $event, $eventName);
}

return $event;
}

/**
* 调用监听器
*/
private function callListeners(array $listeners, object $event, string $eventName): void {
foreach ($listeners as $priority => $listenerGroup) {
foreach ($listenerGroup as $listener) {
$this->callListener($listener, $event, $eventName);
}
}
}

/**
* 安全调用监听器
*/
private function callListener(callable $listener, object $event, string $eventName): void {
try {
// 安全检查
$this->validateListener($listener);

// 调用监听器
$listener($event, $eventName, $this);
} catch (SecurityException $e) {
error_log("安全异常: {$e->getMessage()}");
} catch (Throwable $e) {
error_log("监听器执行失败: {$e->getMessage()}");
}
}

/**
* 验证监听器
*/
private function validateListener(callable $listener): void {
// 如果是数组形式 [object, method]
if (is_array($listener)) {
list($object, $method) = $listener;

// 检查方法名
if (!is_string($method)) {
throw new SecurityException('监听器方法名必须是字符串');
}

// 禁止调用魔术方法
if (strpos($method, '__') === 0) {
throw new SecurityException('禁止调用魔术方法');
}

// 检查方法是否存在
if (!method_exists($object, $method)) {
throw new SecurityException('监听器方法不存在');
}

// 反射检查可见性
$reflection = new ReflectionMethod($object, $method);
if (!$reflection->isPublic()) {
throw new SecurityException('监听器方法不可访问');
}
}
}
}

// 事件订阅者接口
interface EventSubscriberInterface {
public static function getSubscribedEvents(): array;
}

// 示例事件
class UserRegisteredEvent {
public function __construct(
public readonly string $username,
public readonly string $email
) {}
}

class UserLoggedInEvent {
public function __construct(
public readonly int $userId
) {}
}

// 示例订阅者
class UserEventSubscriber implements EventSubscriberInterface {
public static function getSubscribedEvents(): array {
return [
UserRegisteredEvent::class => [
['sendWelcomeEmail', 10],
['notifyAdmins', 5],
],
UserLoggedInEvent::class => 'updateLastLogin',
];
}

public function sendWelcomeEmail(UserRegisteredEvent $event): void {
// 发送欢迎邮件
echo "Sending welcome email to {$event->email}\\n";
}

public function notifyAdmins(UserRegisteredEvent $event): void {
// 通知管理员
echo "Notifying admins about new user: {$event->username}\\n";
}

public function updateLastLogin(UserLoggedInEvent $event): void {
// 更新最后登录时间
echo "Updating last login for user ID: {$event->userId}\\n";
}
}

// 使用示例
public function setupEventSystem(): EventDispatcher {
$dispatcher = new EventDispatcher();

// 添加订阅者
$dispatcher->addSubscriber(new UserEventSubscriber());

// 添加直接监听器
$dispatcher->addListener(
UserRegisteredEvent::class,
function(UserRegisteredEvent $event) {
echo "Anonymous listener: User {$event->username} registered\\n";
}
);

return $dispatcher;
}
}

四、安全最佳实践

4.1 安全配置检查器

class SecurityConfiguration {
/**
* 安全检查器
*/
class SecurityChecker {
// 危险函数列表
private const DANGEROUS_FUNCTIONS = [
'system', 'exec', 'passthru', 'shell_exec', 'proc_open',
'popen', 'pcntl_exec', 'eval', 'assert', 'create_function',
'include', 'include_once', 'require', 'require_once',
'file_get_contents', 'file_put_contents', 'fopen', 'fwrite',
'unlink', 'rmdir', 'mkdir', 'chmod', 'chown', 'symlink',
'dbmopen', 'dbminit', 'ftp_connect', 'ftp_login',
'mysql_connect', 'mysqli_connect', 'pg_connect',
'mail', 'imap_open', 'ldap_connect'
];

// 危险类列表
private const DANGEROUS_CLASSES = [
'ReflectionFunction', 'ReflectionMethod', 'ReflectionClass',
'SplFileObject', 'DirectoryIterator', 'FilesystemIterator',
'Phar', 'ZipArchive', 'SoapClient'
];

/**
* 扫描代码中的可变函数调用
*/
public function scanFile(string $filename): array {
if (!file_exists($filename)) {
throw new RuntimeException("文件不存在: {$filename}");
}

$content = file_get_contents($filename);
$tokens = token_get_all($content);

$issues = [];

foreach ($tokens as $i => $token) {
if (is_array($token)) {
list($id, $text, $line) = $token;

// 检测变量函数调用: $func()
if ($id === T_VARIABLE && isset($tokens[$i + 1]) &&
$tokens[$i + 1] === '(') {
$issues[] = [
'line' => $line,
'type' => 'variable_function',
'variable' => $text,
'severity' => 'high'
];
}

// 检测call_user_func
if ($id === T_STRING && in_array($text, ['call_user_func', 'call_user_func_array'])) {
$issues[] = [
'line' => $line,
'type' => 'call_user_func',
'function' => $text,
'severity' => 'medium'
];
}

// 检测动态类实例化
if ($id === T_NEW && isset($tokens[$i + 1]) &&
is_array($tokens[$i + 1]) && $tokens[$i + 1][0] === T_VARIABLE) {
$issues[] = [
'line' => $line,
'type' => 'variable_class',
'severity' => 'high'
];
}
}
}

return $issues;
}

/**
* 扫描目录
*/
public function scanDirectory(string $directory): array {
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($directory)
);

$allIssues = [];

foreach ($iterator as $file) {
if ($file->isFile() && $file->getExtension() === 'php') {
$issues = $this->scanFile($file->getPathname());

if (!empty($issues)) {
$allIssues[$file->getPathname()] = $issues;
}
}
}

return $allIssues;
}

/**
* 生成安全报告
*/
public function generateReport(array $scanResults): string {
$report = "PHP安全扫描报告\\n";
$report .= "生成时间: " . date('Y-m-d H:i:s') . "\\n";
$report .= str_repeat('=', 60) . "\\n\\n";

$totalIssues = 0;
$bySeverity = ['high' => 0, 'medium' => 0, 'low' => 0];

foreach ($scanResults as $file => $issues) {
$report .= "文件: {$file}\\n";

foreach ($issues as $issue) {
$totalIssues++;
$bySeverity[$issue['severity']]++;

$report .= sprintf(
" 行 %d: [%s] %s\\n",
$issue['line'],
strtoupper($issue['severity']),
$this->getIssueDescription($issue)
);
}

$report .= "\\n";
}

$report .= str_repeat('-', 60) . "\\n";
$report .= "总结:\\n";
$report .= sprintf("总问题数: %d\\n", $totalIssues);
$report .= sprintf("高危: %d, 中危: %d, 低危: %d\\n",
$bySeverity['high'], $bySeverity['medium'], $bySeverity['low']);

return $report;
}

/**
* 获取问题描述
*/
private function getIssueDescription(array $issue): string {
return match($issue['type']) {
'variable_function' => "变量函数调用: {$issue['variable']}()",
'call_user_func' => "动态函数调用: {$issue['function']}()",
'variable_class' => "动态类实例化",
default => "未知问题类型"
};
}

/**
* 检查PHP配置
*/
public function checkPhpConfiguration(): array {
$checks = [];

// 检查disable_functions
$disabledFunctions = ini_get('disable_functions');
$requiredDisabled = ['system', 'exec', 'passthru', 'shell_exec'];

foreach ($requiredDisabled as $func) {
if (strpos($disabledFunctions, $func) === false) {
$checks[] = [
'check' => "disable_functions",
'status' => 'fail',
'message' => "应禁用函数: {$func}"
];
} else {
$checks[] = [
'check' => "disable_functions",
'status' => 'pass',
'message' => "已禁用函数: {$func}"
];
}
}

// 检查allow_url_fopen
if (ini_get('allow_url_fopen')) {
$checks[] = [
'check' => 'allow_url_fopen',
'status' => 'fail',
'message' => '应禁用allow_url_fopen'
];
} else {
$checks[] = [
'check' => 'allow_url_fopen',
'status' => 'pass',
'message' => '已禁用allow_url_fopen'
];
}

// 检查display_errors
if (ini_get('display_errors')) {
$checks[] = [
'check' => 'display_errors',
'status' => 'fail',
'message' => '应禁用display_errors'
];
} else {
$checks[] = [
'check' => 'display_errors',
'status' => 'pass',
'message' => '已禁用display_errors'
];
}

return $checks;
}
}
}

4.2 安全编码规范

// ✅ 安全编码规范
class SecureCodingStandards {
// 1. 永远不要信任用户输入
public function safeDynamicCall(string $userInput, array $allowedFunctions): mixed {
// 白名单验证
if (!in_array($userInput, $allowedFunctions, true)) {
throw new SecurityException("禁止的函数调用");
}

// 参数清理
$args = array_map([$this, 'sanitizeInput'], array_slice(func_get_args(), 2));

return $userInput(…$args);
}

private function sanitizeInput($input) {
if (is_string($input)) {
return htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
}
return $input;
}

// 2. 使用类型安全的方法
public function typeSafeMethodCall(object $obj, string $method): mixed {
// 使用反射验证
$reflection = new ReflectionObject($obj);

if (!$reflection->hasMethod($method)) {
throw new RuntimeException("方法不存在");
}

$methodReflection = $reflection->getMethod($method);

// 检查可见性
if (!$methodReflection->isPublic()) {
throw new SecurityException("方法不可访问");
}

// 禁止魔术方法
if (strpos($method, '__') === 0) {
throw new SecurityException("禁止调用魔术方法");
}

return $obj->$method();
}

// 3. 使用工厂模式代替动态实例化
public function safeObjectCreation(string $type): object {
return match($type) {
'user' => new User(),
'product' => new Product(),
'order' => new Order(),
default => throw new SecurityException("未知的对象类型")
};
}

// 4. 使用闭包包装
public function createSafeClosure(callable $callable): Closure {
return function(…$args) use ($callable) {
// 记录调用
$this->logCall($callable, $args);

// 执行调用
return $callable(…$args);
};
}

private function logCall(callable $callable, array $args): void {
$backtrace = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS, 3);
$caller = $backtrace[2] ?? ['file' => 'unknown', 'line' => 0];

error_log(sprintf(
"安全闭包调用: %s from %s:%d",
$this->getCallableName($callable),
$caller['file'],
$caller['line']
));
}

private function getCallableName(callable $callable): string {
if (is_string($callable)) {
return $callable;
} elseif (is_array($callable)) {
return (is_object($callable[0]) ? get_class($callable[0]) : $callable[0]) .
'::' . $callable[1];
} elseif ($callable instanceof Closure) {
return 'closure';
}
return 'unknown';
}

// 5. 配置驱动的安全策略
class SecurityPolicy {
private array $whitelist = [];
private array $blacklist = [];
private bool $strictMode = true;

public function __construct(array $config) {
$this->whitelist = $config['whitelist'] ?? [];
$this->blacklist = $config['blacklist'] ?? [];
$this->strictMode = $config['strict_mode'] ?? true;
}

public function isAllowed(string $function): bool {
// 黑名单检查
if (in_array($function, $this->blacklist, true)) {
return false;
}

// 严格模式下的白名单检查
if ($this->strictMode && !in_array($function, $this->whitelist, true)) {
return false;
}

return true;
}

public function validateCallable(callable $callable): void {
if (is_string($callable) && !$this->isAllowed($callable)) {
throw new SecurityException("函数不在白名单中: {$callable}");
}
}
}
}

// ❌ 危险的编码实践
class DangerousPractices {
// 1. 直接使用用户输入
public function dangerous1(string $userInput): void {
$userInput(); // 极其危险！
}

// 2. 未验证的动态包含
public function dangerous2(string $page): void {
include "pages/{$page}.php"; // 路径遍历攻击
}