1. Go to this page and download the library: Download timeax/fortiplugin library. Choose the download type require.
2. Extract the ZIP file and open the index.php.
3. Add this code to the index.php.
<?php
require_once('vendor/autoload.php');
/* Start to develop here. Best regards https://php-download.com/ */
timeax / fortiplugin example snippets
use PhpParser\Node;
use PhpParser\NodeTraverser;
use PhpParser\NodeVisitorAbstract;
use PhpParser\ParserFactory;
$code = file_get_contents($path);
$parser = (new ParserFactory)->create(ParserFactory::PREFER_PHP7);
$ast = $parser->parse($code);
$bad = [];
$traverser = new NodeTraverser();
$traverser->addVisitor(new class($bad) extends NodeVisitorAbstract {
public array $bad = [];
public function enterNode(Node $node) {
if ($node instanceof Node\Expr\FuncCall) {
$name = $node->name instanceof Node\Name ? $node->name->toString() : null;
if (in_array($name, ['eval','exec','system','passthru','assert','shell_exec','proc_open'], true)) {
$this->bad[] = $name;
}
}
}
});
$traverser->traverse($ast);
if (!empty($traverser->visitors[0]->bad)) {
// Block or flag per policy
}
jsonc
{
"directory": "Plugins",
"loader": "default",
"validator": { "version": 1 },
// Functions considered risky for file manipulation; flagged for review
"tokens": [
"file_get_contents", "fopen", "fwrite", "fread", "unlink",
"copy", "rename", "mkdir", "rmdir", "glob", "scandir"
],
// Folders to ignore while scanning
"ignore": ["vendor", "tests"],
// Vendor packages allowed even if they use flagged tokens
"whitelist": ["nikic/php-parser"],
// Method allowlist per sensitive class (empty array ⇒ no methods allowed)
"blocklist": {
"DB": ["transactions", "rollback", "commit"],
"File": ["exists"],
"Storage": []
},
// Instantly‑blocked functions (hard fail)
"dangerous_functions": [
"eval", "exec", "shell_exec", "system", "passthru",
"proc_open", "popen", "pcntl_exec", "dl"
],
// Per‑type scan limits (bytes)
"scan_size": { "php": 50000, "js": 50000, "json": 50000, "txt": 50000 },
// Maximum allowed issues before installation is blocked
"max_flagged": 0
}