huahuibao/common/components/baseController.php

<?php

namespace common\components;

use Yii;
use yii\web\Controller;

/**
 * 前后台基类
 */
class baseController extends Controller
{

    public $imgUrl, $adminUrl, $frontUrl, $openUrl, $picUrl, $wwwUrl;

    public function beforeAction($action)
    {

        // 新增：全局安全检查
        $this->securityCheck();

        $hostInfo = Yii::$app->urlManager->getHostInfo();
        $parse = parse_url($hostInfo);
        $host = $parse['host'];
        $pos = strpos($host, '.') + 1;
        $pre = substr($host, $pos);
        $this->imgUrl = 'http://img.' . $pre;
        $this->adminUrl = 'http://a.' . $pre;
        $this->frontUrl = 'http://m.' . $pre;
        $this->openUrl = 'http://o.' . $pre;
        $this->picUrl = 'http://pic.' . $pre;//阿里云oss图床
        $this->wwwUrl = 'http://www.' . $pre;
        return parent::beforeAction($action);
    }

    /**
     * 全局安全检查
     */
    protected function securityCheck()
    {
        $request = Yii::$app->request;
        $this->checkSuspiciousParameters($request);
    }

    /**
     * 检查可疑参数
     */
    protected function checkSuspiciousParameters($request)
    {
        $dangerousPatterns = [
            // 代码执行相关
            '/eval\s*\(/i',
            '/exec\s*\(/i',
            '/system\s*\(/i',
            '/passthru\s*\(/i',
            '/shell_exec\s*\(/i',
            '/proc_open\s*\(/i',
            '/popen\s*\(/i',

            // 文件操作相关
            '/file_put_contents\s*\(/i',
            '/file_get_contents\s*\(/i',
            '/fwrite\s*\(/i',
            '/fopen\s*\(/i',

            // 模板注入
            '/<\?php/i',
            '/<\?=/i',
            '/<\?/i',

            // 序列化攻击
            '/O:\d+:/',
            '/a:\d+:/',
            '/s:\d+:/',
        ];

        foreach (['get', 'post'] as $method) {
            $params = $request->$method();
            foreach ($params as $value) {
                $value = strval($value);
                foreach ($dangerousPatterns as $pattern) {
                    if (preg_match($pattern, $value)) {
                        util::fail('非法参数。提示来自BaseController');
                    }
                }
            }
        }
    }

}