# Kriege eine Malwarewarnung

**URL:** <https://forum.shopware.com/t/kriege-eine-malwarewarnung/41371>\
**Category:** Sonstiges\
**Created:** [15. November 2016 um 18:32 UTC](https://forum.shopware.com/t/kriege-eine-malwarewarnung/41371 "2016-11-15T18:32:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![shopwaredummy](https://avatars.discourse-cdn.com/v4/letter/s/b487fb/32.png) [@shopwaredummy](https://forum.shopware.com/u/shopwaredummy)\
**Post date:** [15. November 2016 um 18:32 UTC](https://forum.shopware.com/t/kriege-eine-malwarewarnung/41371/1 "2016-11-15T18:32:32Z")

</div>

```
{HEX}php.exe.globals.402 : /var/www/clients/client3/web5/web/engine/Shopware/Plugins/Community/Backend/SwagImportExport/.githooks/install_hooks.sh
===============================================
Linux Malware Detect v1.5 < proj@rfxn.com >

```

Habe gerade den Server scannen lassen und bekam diese Meldung. Die Datei sieht an sich harmlos aus.

```
#!/usr/bin/env php

```

Wieso meldet sie dann der malwarescanner?

---

<div class="post-metadata">

**Author:** ![useg](https://avatars.discourse-cdn.com/v4/letter/u/df705f/32.png) [@useg](https://forum.shopware.com/u/useg)\
**Post date:** [15. November 2016 um 18:56 UTC](https://forum.shopware.com/t/kriege-eine-malwarewarnung/41371/2 "2016-11-15T18:56:20Z")

</div>

Den Ordner „.githooks“ gibt es nicht in dem Verzeichnis.

![](https://europe1.discourse-cdn.com/flex013/uploads/shopware/original/2X/7/7b47f7fe82787c97b28734dc9cebf61ded819d4c.png)

Schau doch mal wann dieser erstellt wurde, ist es ein anderes Datum wie die anderen Ordner in Verzeichnis /engine/Shopware/Plugins/Community/Backend/SwagImportExport/ ist es nicht mit dem Plugin drauf gekommen, ob es nun eine Mailware ist kann ich dir nicht sagen…

Uwe

---

<div class="post-metadata">

**Author:** ![useg](https://avatars.discourse-cdn.com/v4/letter/u/df705f/32.png) [@useg](https://forum.shopware.com/u/useg)\
**Post date:** [15. November 2016 um 19:07 UTC](https://forum.shopware.com/t/kriege-eine-malwarewarnung/41371/3 "2016-11-15T19:07:41Z")

</div>

Entwarnung auf Github gibt es beim Plugin der Ordner “.githooks”&nbsp;\> [GitHub - shopwareLabs/SwagImportExport](https://github.com/shopwareLabs/SwagImportExport)

---

<div class="post-metadata">

**Author:** ![shopwaredummy](https://avatars.discourse-cdn.com/v4/letter/s/b487fb/32.png) [@shopwaredummy](https://forum.shopware.com/u/shopwaredummy)\
**Post date:** [15. November 2016 um 19:38 UTC](https://forum.shopware.com/t/kriege-eine-malwarewarnung/41371/4 "2016-11-15T19:38:31Z")

</div>

Wird nur als ausführbar gesetzt. Warum der Malwarescanner das beanstandet? Binärcode ist nicht drin.  
Hier mal der Inhalt der pre-commit  
&nbsp;

```
#!/usr/bin/env php
getCommittedFileList();

        if ($this->isRebase()) {
            echo 'Not on branch' . PHP_EOL;
            return (int) 0;
        }

        $beforeRef = $this->getRef();
        $this->stashTree();
        $afterRef = $this->getRef();

        if ($beforeRef == $afterRef) {
            echo 'No Changes' . PHP_EOL;
            return (int) 0;
        }

        echo 'Running PHP lint' . PHP_EOL;
        if (!$this->phpLint($fileList)) {
            echo 'ERROR: There are some PHP syntax errors!' . PHP_EOL;
        }

        if ($this->isPHPCSFixerAvailable()) {
            echo 'Checking code style' . PHP_EOL;
            if (!$this->checkCodeStyle($fileList)) {
                echo "ERROR: Your commit does not comply with Shopware's coding standards." . PHP_EOL;
            }
        } else {
            echo "ERROR: PHP-CS-Fixer is NOT installed. Please install globally (http://cs.sensiolabs.org/)." . PHP_EOL;
            $this->error = true;
        }

        if ($this->error) {
            echo "If you are ABSOLUTELY sure your code is correct, you can use 'git commit --no-verify' to bypass this validation" . PHP_EOL;
        }

        $this->unstashTree();

        exit((int) $this->error);
    }

    /**
     * @return bool
     */
    public function isPHPCSFixerAvailable()
    {
        $output = [];
        $return = 0;
        exec('command -v php-cs-fixer >/dev/null 2>&1', $output, $return);

        return !(bool) $return;
    }

    /**
     * @return string[]
     */
    private function getCommittedFileList()
    {
        $output = [];
        $return = 0;
        exec('git rev-parse --verify HEAD 2> /dev/null', $output, $return);
        // diff against HEAD or an empty tree object
        $against = $return == 0 ? 'HEAD' : '4b825dc642cb6eb9a060e54bf8d69288fbee4904';

        $fileList = [];
        exec("git diff --cached --name-only --diff-filter=ACM {$against} | grep -e '\.php$'", $fileList);

        return $fileList;
    }

    /**
     * @param string[] $files
     * @return bool
     */
    private function checkCodeStyle(array $files)
    {
        $succeed = true;
        $misses = [];

        foreach ($files as $file) {
            $output = [];
            $return = null;
            exec("php-cs-fixer fix -v --dry-run --level=psr2 " . escapeshellarg($file), $output, $return);
            if ($return != 0) {
                $misses[$file] = "php-cs-fixer fix -v --level=psr2 " . escapeshellarg($file);
                $this->error = true;
                $succeed = false;
            }
        }

        if ($succeed === false) {
            echo "Code style error in folling files:" . PHP_EOL . implode(PHP_EOL, array_keys($misses)) . PHP_EOL . PHP_EOL;
            echo "To fix, run: " . PHP_EOL . implode(PHP_EOL, $misses). PHP_EOL;
            echo PHP_EOL;
        }

        return $succeed;
    }

    /**
     * @param string[] $files
     * @return bool
     */
    private function phpLint(array $files)
    {
        $succeed = true;

        foreach ($files as $file) {
            $output = [];
            $return = 0;
            exec("php -l " . escapeshellarg($file), $output, $return);
            if ($return != 0) {
                echo "PHP syntax error at " . $file . ":" . PHP_EOL;
                echo implode(PHP_EOL, $output) . PHP_EOL;
                $this->error = true;
                $succeed = false;
            }
        }

        return $succeed;
    }

    /**
     * @return string
     */
    private function getRef()
    {
        $output = [];
        exec("git rev-parse --verify -q refs/stash", $output);
        $output = implode(PHP_EOL, $output) . PHP_EOL;
        return trim($output);
    }

    /**
     * @return bool
     */
    private function isRebase()
    {
        $output = [];
        exec("git symbolic-ref --short -q HEAD", $output);
        return (empty($output));
    }

    /**
     * Stash any changes to the working tree that are not going to be committed
     */
    private function stashTree()
    {
        exec("git stash save --keep-index --include-untracked -q");
    }

    /**
     * Unstash changes to the working tree that we had stashed
     */
    private function unstashTree()
    {
        exec("git stash pop -q --index");
    }
}

$checks = new PreCommitChecks();
$checks->run();

```

&nbsp;

---

<div class="post-metadata">

**Author:** ![shopwaredummy](https://avatars.discourse-cdn.com/v4/letter/s/b487fb/32.png) [@shopwaredummy](https://forum.shopware.com/u/shopwaredummy)\
**Post date:** [15. November 2016 um 20:31 UTC](https://forum.shopware.com/t/kriege-eine-malwarewarnung/41371/5 "2016-11-15T20:31:39Z")

</div>

Und nun lädt sich der Shop plötzlich tot.  
&nbsp;

```
Ups! Ein Fehler ist aufgetreten!

    
        Die nachfolgenden Hinweise sollten Ihnen weiterhelfen.
    

    Unable to load template snippet 'backend/index/load.tpl|backend/index/view/swag_update_menu.js|backend/swag_import_export/menu_entry.tpl' in engine/Library/Smarty/sysplugins/smarty_internal_templatebase.php on line 127

    Stack trace:
    
        #0 engine/Library/Enlight/View/Default.php(274): Smarty_Internal_TemplateBase->fetch()
#1 engine/Library/Enlight/Controller/Plugins/ViewRenderer/Bootstrap.php(216): Enlight_View_Default->render(Object(Enlight_Template_Default))
#2 engine/Library/Enlight/Controller/Plugins/ViewRenderer/Bootstrap.php(242): Enlight_Controller_Plugins_ViewRenderer_Bootstrap->renderTemplate(Object(Enlight_Template_Default))
#3 engine/Library/Enlight/Controller/Plugins/ViewRenderer/Bootstrap.php(136): Enlight_Controller_Plugins_ViewRenderer_Bootstrap->render()
#4 [internal function]: Enlight_Controller_Plugins_ViewRenderer_Bootstrap->onPostDispatch(Object(Enlight_Controller_ActionEventArgs))
#5 engine/Library/Enlight/Event/Handler/Default.php(91): call_user_func(Array, Object(Enlight_Controller_ActionEventArgs))
#6 engine/Library/Enlight/Event/EventManager.php(214): Enlight_Event_Handler_Default->execute(Object(Enlight_Controller_ActionEventArgs))
#7 engine/Library/Enlight/Controller/Action.php(202): Enlight_Event_EventManager->notify('Enlight_Control...', Object(Enlight_Controller_ActionEventArgs))
#8 engine/Library/Enlight/Controller/Dispatcher/Default.php(523): Enlight_Controller_Action->dispatch('loadAction')
#9 engine/Library/Enlight/Controller/Front.php(223): Enlight_Controller_Dispatcher_Default->dispatch(Object(Enlight_Controller_Request_RequestHttp), Object(Enlight_Controller_Response_ResponseHttp))
#10 engine/Shopware/Kernel.php(177): Enlight_Controller_Front->dispatch()
#11 vendor/symfony/http-kernel/HttpCache/HttpCache.php(487): Shopware\Kernel->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#12 engine/Shopware/Components/HttpCache/AppCache.php(255): Symfony\Component\HttpKernel\HttpCache\HttpCache->forward(Object(Symfony\Component\HttpFoundation\Request), true, NULL)
#13 vendor/symfony/http-kernel/HttpCache/HttpCache.php(258): Shopware\Components\HttpCache\AppCache->forward(Object(Symfony\Component\HttpFoundation\Request), true)
#14 engine/Shopware/Components/HttpCache/AppCache.php(103): Symfony\Component\HttpKernel\HttpCache\HttpCache->pass(Object(Symfony\Component\HttpFoundation\Request), true)
#15 shopware.php(113): Shopware\Components\HttpCache\AppCache->handle(Object(Symfony\Component\HttpFoundation\Request))
#16 {main}

```

&nbsp;

---

<div class="post-metadata">

**Author:** ![shopwaredummy](https://avatars.discourse-cdn.com/v4/letter/s/b487fb/32.png) [@shopwaredummy](https://forum.shopware.com/u/shopwaredummy)\
**Post date:** [15. November 2016 um 22:28 UTC](https://forum.shopware.com/t/kriege-eine-malwarewarnung/41371/6 "2016-11-15T22:28:13Z")

</div>

War der modsecurity  
Wenn in der config

```
/etc/modsecurity/modsecurity.conf

SecRuleEngine On

```

gesetzt wird macht der Shop nicht mehr mit. Muss auf

```
SecRuleEngine DetectionOnly

```

bleiben. Vielleicht hat ja nochmal jemand das Problem wenn die Sicherheit zu hoch angesetzt wird 🙂 Verzeichnisse ausklammern hat bei shopware nicht geklappt.

&nbsp;

&nbsp;