fix bug for ternaryop bug

LoRexxar · Jan 5, 2022 · a1f3fa7 · a1f3fa7
1 parent 3cdde8e
commit a1f3fa7
Showing 1 changed file with 19 additions and 2 deletions.
diff --git a/core/core_engine/php/parser.py b/core/core_engine/php/parser.py
@@ -819,8 +819,25 @@ def parameters_back(param, nodes, function_params=None, lineno=0,
                 code = "{}={}?{}:{}".format(param_name, param_ex, terna1, terna2)
                 scan_chain.append(('TernaryOp', code, file_path, node.lineno))
 
-                param = node.expr
-                is_co = 3
+                # 没办法判断这种三元条件的结果
+                # 如果1是可控，则1，如果2是可控则2
+                # 如果1和2中有-1，则选另一个
+                # 否则选1
+
+                is_co, cp = is_controllable(terna1)
+                if is_co == 1:
+                    param = terna1
+                else:
+                    is_co2, cp = is_controllable(terna2)
+
+                    if is_co2 == 1:
+                        param = terna2
+
+                    else:
+                        if is_co == -1:
+                            param = terna2
+                        else:
+                            param = terna1
 
             if param_name == param_node and isinstance(node.expr, php.FunctionCall):  # 当变量来源是函数时，处理函数内容
                 function_name = node.expr.name