Finding PHP scripts that require register_globals

Question

I have inherited a web server filled with code that requires register_globals to be on. Most of it is custom code written by random people who have come and gone over the years. I have fixed the majority of it in scripts that I know about, but my problem is with finding the ones I don't know about.

I am considering writing an application to scan through every directory on the web server to identify PHP scripts that require register_globals. Is there a good strategy for doing this?

One method I have considered involves somehow forcing PHP to report all errors, executing scripts, and checking for undefined variable notices. I could build an application that reads the STDERR stream for this.

Are there any better methods you can think of?

Answer 1

Most IDEs will show you undefined variables, PHPStorm does for example. You can let it scan all your source files and you will be notified about undefined variables in all your code, whiteout actually executing it.

This is probably the most simply and painless variant. Alternatively you could obviously write your own script utilizing the Tokenizer and identify all T_VARIABLEs, which are not previously initialized using a T_VARIABLE '=' expr construct. But this will be more error prone. Using the IDE will probably give you better results with less effort.

Answer 2

Assuming single files are always using register_globals being on or off, you could create a list of all form element names which are submitted to a script and then check this script if it's using $fieldname without containing $_REQUEST['fieldname'] (or the $_POST, $_GET arrays).

Your "check for notices" method would be ok if you can guarantee a very high code coverage while doing those checks (to ensure you didn't miss anything - the uncovered parts then have to be checked manually).