fix #64 globals variable state

Author: eric-therond

.gitignore

@@ -12,3 +12,4 @@ projects/phar/composer.lock
 vendor/
 composer.lock
 indent.sh
+.DS_Store

package/src/progpilot/Analysis/VisitorAnalysis.php

@@ -154,8 +154,12 @@ public static function mergeDefsBlockIdStates($defs, $concatValues, $block)
 
         foreach ($defs as $def) {
             if ($def->isType(MyDefinition::TYPE_ARRAY_ELEMENT)
-                || $def->isType(MyDefinition::TYPE_PROPERTY)) {
+                || $def->isType(MyDefinition::TYPE_PROPERTY)
+                || $def->isType(MyDefinition::TYPE_REFERENCE)) {
                 $state = $def->getState($blockId);
+                if (is_null($state)) { 
+                    $state = $def->getCurrentState();
+                }
             } else {
                 $state = $def->getCurrentState();
             }

package/src/progpilot/Helpers/State.php

@@ -43,6 +43,7 @@
                 ],
                 [
                     "./tests/real/incallstack/",
-                        [["\$rtrim_return", "77", "xss"]]
+                        [["\$rtrim_return", "77", "xss"],
+                        ["\$localfile", "610", "path_traversal"]]
                 ]
             ];

projects/tests/foldertest.php

@@ -334,6 +334,12 @@
                         [["\$_POST[\"form_id\"]", "6", "sql_injection"]]
                 ],
 
+                [
+                    "./tests/generic/global5.php",
+                        [["\$query", "8", "sql_injection"],
+                        ["\$row[1]", "17", "xss"]]
+                ],
+
                 [
                     "./tests/generic/namespace1.php",
                         [["\$_GET[\"p\"]", "9", "xss"]]

projects/tests/generictest.php

@@ -68,7 +68,7 @@
                 ],// a corriger
                 [
                     "./tests/phpwander/test13.php",
-                        []
+                        [["\$value", "11", "xss"]]
                 ],
                 [
                     "./tests/phpwander/test14.php",

projects/tests/phpwandertest.php

@@ -0,0 +1,20 @@
+<?php
+$tainted = 'Constant';
+
+function test() {
+    $GLOBALS['tainted'] = $_POST["tainted"];
+    $db = mysqli_connect("127.0.0.1", "root", "123456");
+    mysqli_select_db($db, "testcasesqli");
+    $query = "select * from users where id=".$GLOBALS["tainted"];
+    $result = mysqli_query($db, $query);
+    if ($result == false) {
+        exit("Database error !<br />");
+    }
+    $row = mysqli_fetch_array($result);
+    if ($row == null) {
+        exit("Error ID or password.<br />");
+    }
+    print("Login successfully!<br />welcome,".$row[1]."<br />");
+}
+
+test();