Use PEAR coding standard

phpcs.xml

 <?xml version="1.0"?>
 <ruleset name="PHP_CodeSniffer">
- <description>The coding standard for our project.</description>
- <file>src</file>
- <file>tests</file>
- <exclude-pattern>/tests/res/*</exclude-pattern>
- <arg value="np"/>
- <rule ref="PSR2"/>
+    <description>The coding standard for our project.</description>
+    <file>src</file>
+    <file>tests</file>
+    <exclude-pattern>/tests/res/*</exclude-pattern>
+    <arg value="np"/>
+    <rule ref="PEAR"/>
 </ruleset>

src/ExeAnalyzer.php

@@ -20,6 +20,7 @@ class ExeAnalyzer implements Analyzer
 
     /**
      * //FIXME kill properly
+     *
      * @param string $message
      */
     private function kill($message)
@@ -29,6 +30,7 @@ class ExeAnalyzer implements Analyzer
 
     /**
      * Basic. Searches dangerous function names allowing to execute commands
+     *
      * @return boolean. True if dangerous functions are found.
      */
     private function searchExecCmdFunctions()
@@ -47,6 +49,7 @@ class ExeAnalyzer implements Analyzer
 
     /**
      * Searches for non-ASCII characters, often used in obfuscated files
+     *
      * @return number
      */
     private function searchNonASCIIChars()
@@ -62,7 +65,8 @@ class ExeAnalyzer implements Analyzer
 
     /**
      * Wrapper for tests
-     * @param $func
+     *
+     * @param  $func
      * @return ? value of the called function
      */
     public function testMe($func)

src/SignaturesAnalyzer.php

@@ -20,7 +20,8 @@ class SignaturesAnalyzer implements Analyzer
 
     /**
      * TEST: comes from PHP-Webshell Detector, will be updated. Only for testing
-     * @param string $pFileContent
+     *
+     * @param  string $pFileContent
      * @return NULL|NULL|array|mixed
      */
     public function scanFile($pFileContent)
@@ -107,6 +108,7 @@ class SignaturesAnalyzer implements Analyzer
 
     /**
      * Reads the file containing signatures
+     *
      * @return array|mixed
      */
     private function getFingerprints()
@@ -124,8 +126,9 @@ class SignaturesAnalyzer implements Analyzer
         $varState = '';
         for ($i = 0; $i < $position; $i++) {
             $token = $tokens[$i];
-            if (is_array($token) && $token[0] === T_VARIABLE && $token[1] === $varName && $i < count($tokens)-2 &&
-                is_array($tokens[$i+2]) && $tokens[$i+2][0] === T_CONSTANT_ENCAPSED_STRING) {
+            if (is_array($token) && $token[0] === T_VARIABLE && $token[1] === $varName && $i < count($tokens)-2 
+                && is_array($tokens[$i+2]) && $tokens[$i+2][0] === T_CONSTANT_ENCAPSED_STRING
+            ) {
                 if ($tokens[$i+1] === "=") {
                     $varState=substr($tokens[$i+2][1], 0, strlen($tokens[$i+2][1])-1);
                 } elseif (is_array($tokens[$i+1]) && $tokens[$i+1][0] === T_CONCAT_EQUAL) {
@@ -138,7 +141,8 @@ class SignaturesAnalyzer implements Analyzer
 
     /**
      * Anonymous call
-     * @param string $func name
+     *
+     * @param  string $func name
      * @return mixed return value of the routine
      */
     public function testMe($func)

src/Util.php

@@ -19,8 +19,9 @@ class Util
     }
     /**
      * Apply the strpos function with an array of parameters
-     * @param string $haystack
-     * @param array $arrayOfWords words to search in the haystack
+     *
+     * @param  string $haystack
+     * @param  array  $arrayOfWords words to search in the haystack
      * @return int|boolean
      */
     public static function strposOnArray($haystack, $arrayOfWords)
@@ -39,7 +40,8 @@ class Util
 
     /**
      * Removes all carriage returns and/or line feeds
-     * @param $string
+     *
+     * @param  $string
      * @return NULL|$string
      */
     public static function removeCRLF($string)
@@ -48,10 +50,11 @@ class Util
     }
 
     /**
-    * Removes whites spaces if the are repeateds
-    * @param $string
-    * @return NULL|string without repeated white spaces
-    */
+     * Removes whites spaces if the are repeateds
+     *
+     * @param  $string
+     * @return NULL|string without repeated white spaces
+     */
     public static function removeMultiWhiteSpaces($string)
     {
         return $string ? preg_replace('/\s{2,}/', ' ', $string) : null;
@@ -59,7 +62,8 @@ class Util
 
     /**
      * Removes all whites spaces
-     * @param $string
+     *
+     * @param  $string
      * @return NULL|string whitout any white spaces
      */
     public static function removeAllWhiteSpaces($string)
@@ -69,7 +73,8 @@ class Util
 
     /**
      * Removew white spaces outside strings
-     * @param $string
+     *
+     * @param  $string
      * @return NULL|string
      */
     public static function removeWhiteSpacesOutsideString($tokens)

tests/SignaturesAnalyzerTest.php

@@ -10,11 +10,13 @@ class SignaturesAnalyzerTest extends TestCase
     public function testScanFile()
     {
         $analyzer = new SignaturesAnalyzer();
-        file_put_contents(__DIR__."/res/enc_c.php", "<?php
+        file_put_contents(
+            __DIR__."/res/enc_c.php", "<?php
         \$a=\"".base64_encode(file_get_contents(__DIR__."/res/c_str.txt"))."\";
         \$a.=\"===\";
         \$b=base64_decode(\$a);
-        echo \$b;");
+        echo \$b;"
+        );
         //file_put_contents(__DIR__."/res/enc_c.php", "<?php\n\$a=base64_decode(gzuncompress( base64_decode(\"".base64_encode(gzcompress(base64_encode(file_get_contents(__DIR__."/res/c_str.txt"))))."\".\"===\")));");
         $flag1 = $analyzer->analyze(__DIR__."/res/c.php");
         $flag2 = $analyzer->analyze(__DIR__."/res/enc_c.php");

tests/bootstrap.php

@@ -11,34 +11,36 @@ require_once __DIR__ . "/../vendor/autoload.php";
  *
  *      new \Foo\Bar\Baz\Qux;
  *
- * @param string $class The fully-qualified class name.
+ * @param  string $class The fully-qualified class name.
  * @return void
  */
-spl_autoload_register(function ($class) {
-
-    // project-specific namespace prefix
-    $prefix = 'RUCD\\WebshellDetector';
-
-    // base directory for the namespace prefix
-    $base_dir = __DIR__ . '/../src/';
-
-    // does the class use the namespace prefix?
-    $len = strlen($prefix);
-    if (strncmp($prefix, $class, $len) !== 0) {
-        // no, move to the next registered autoloader
-        return;
-    }
-
-    // get the relative class name
-    $relative_class = substr($class, $len);
-
-    // replace the namespace prefix with the base directory, replace namespace
-    // separators with directory separators in the relative class name, append
-    // with .php
-    $file = $base_dir . str_replace('\\', '/', $relative_class) . '.php';
-
-    // if the file exists, require it
-    if (file_exists($file)) {
-        require $file;
+spl_autoload_register(
+    function ($class) {
+
+        // project-specific namespace prefix
+        $prefix = 'RUCD\\WebshellDetector';
+
+        // base directory for the namespace prefix
+        $base_dir = __DIR__ . '/../src/';
+
+        // does the class use the namespace prefix?
+        $len = strlen($prefix);
+        if (strncmp($prefix, $class, $len) !== 0) {
+            // no, move to the next registered autoloader
+            return;
+        }
+
+        // get the relative class name
+        $relative_class = substr($class, $len);
+
+        // replace the namespace prefix with the base directory, replace namespace
+        // separators with directory separators in the relative class name, append
+        // with .php
+        $file = $base_dir . str_replace('\\', '/', $relative_class) . '.php';
+
+        // if the file exists, require it
+        if (file_exists($file)) {
+            include $file;
+        }
     }
-});
+);