From b2f8c2ec849064f04ce68f8895253117da14dc84 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Fri, 9 May 2025 16:10:29 -0400
Subject: [PATCH 1/2] Add the new PHP language generator

---
 lib/rex/random_identifier/generator.rb | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/rex/random_identifier/generator.rb b/lib/rex/random_identifier/generator.rb
index 5452207..16f4836 100644
--- a/lib/rex/random_identifier/generator.rb
+++ b/lib/rex/random_identifier/generator.rb
@@ -34,7 +34,8 @@ class ExhaustedSpaceError < StandardError; end
     # This should be pretty universal for identifier rules
     :char_set => Rex::Text::AlphaNumeric+"_",
     :first_char_set => Rex::Text::LowerAlpha,
-    :forbidden => [].freeze
+    :forbidden => [].freeze,
+    :prefix => ''
   }
 
   JavaOpts = DefaultOpts.merge(
@@ -111,11 +112,19 @@ class ExhaustedSpaceError < StandardError; end
     ).freeze
   )
 
+  PHPOpts = DefaultOpts.merge(
+    prefix: '$',
+    first_char_set: Rex::Text::Alpha + '_'
+    # nothing seems to be forbidden because everything is prefixed with '$'
+    # see: https://www.php.net/manual/en/reserved.php
+  )
+
   Opts = {
     default: DefaultOpts,
     java: JavaOpts,
     jsp: JSPOpts,
     javascript: JavaScriptOpts,
+    php: PHPOpts,
     python: PythonOpts
   }
 
@@ -248,6 +257,7 @@ def generate(len = nil)
     len ||= rand(@opts[:min_length] .. (@opts[:max_length]))
 
     ident = ""
+    ident << @opts[:prefix]
 
     # XXX: Infinite loop if block returns only values we've already
     # generated.

From 5d1cfa0d3a73814fec33a5cae7b3562ab97afb71 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Tue, 13 May 2025 09:26:13 -0400
Subject: [PATCH 2/2] Add PHP reserved variables as forbidden

---
 lib/rex/random_identifier/generator.rb | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/lib/rex/random_identifier/generator.rb b/lib/rex/random_identifier/generator.rb
index 16f4836..aed2cde 100644
--- a/lib/rex/random_identifier/generator.rb
+++ b/lib/rex/random_identifier/generator.rb
@@ -114,9 +114,17 @@ class ExhaustedSpaceError < StandardError; end
 
   PHPOpts = DefaultOpts.merge(
     prefix: '$',
-    first_char_set: Rex::Text::Alpha + '_'
-    # nothing seems to be forbidden because everything is prefixed with '$'
+    first_char_set: Rex::Text::Alpha + '_',
     # see: https://www.php.net/manual/en/reserved.php
+    # see: https://www.php.net/manual/en/reserved.variables.php
+    forbidden: (
+      %w[
+        $GLOBALS $_SERVER $_GET $_POST $_FILES $_REQUEST $_SESSION $_ENV $_COOKIE
+        $HTTP_GET_VARS $HTTP_POST_VARS $HTTP_COOKIE_VARS $HTTP_SERVER_VARS
+        $HTTP_ENV_VARS $HTTP_SESSION_VARS $HTTP_POST_FILES $HTTP_RAW_POST_DATA
+        $php_errormsg $http_response_header $argc $argv $this
+      ]
+    )
   )
 
   Opts = {
@@ -256,13 +264,14 @@ def generate(len = nil)
     # pick a random length within the limits
     len ||= rand(@opts[:min_length] .. (@opts[:max_length]))
 
-    ident = ""
-    ident << @opts[:prefix]
+    ident = ''
 
     # XXX: Infinite loop if block returns only values we've already
     # generated.
     loop do
-      ident  = Rex::Text.rand_base(1, "", @opts[:first_char_set])
+      ident  = +''
+      ident << @opts[:prefix]
+      ident << Rex::Text.rand_base(1, "", @opts[:first_char_set])
       ident << Rex::Text.rand_base(len-1, "", @opts[:char_set])
       if block_given?
         ident = yield ident