Hack to remove another hack

cleanit.py

#!/usr/bin/env python
import re
import sys
import os
path = os.path

CLEAN_RE = re.compile(r"""^\<\?php\s\/\*\*\/\seval\(base64_decode\("[^"]*"\)\);\?>""")

def inspectFile(fullpath):
    try:
        with open(fullpath) as myFile:
            buffer = myFile.read()
    except IOError:
        print fullpath, " cannot open/read"
        return

    if buffer.find("eval(") > -1:
        print fullpath, "is suspect!"
        if CLEAN_RE.match(buffer) is not None:
            cleanAttempt1(fullpath, buffer)




def cleanAttempt1(fullpath, buffer):
    print "\tAttempting type 1(regex replace) cleaning"
    if CLEAN_RE.match(buffer) is not None:
        newBuffer = CLEAN_RE.sub("", buffer )
        if len(newBuffer) != len(buffer):
            print "\tsize is %d / was %d" % (len(newBuffer), len(buffer))

            if len(newBuffer) == 0:
                print "\tAborting, as new size is 0"
            else:
                with open(fullpath, "wb") as myFile:
                    myFile.write(newBuffer)



def walkpath(startPath):
    for root, dirs, files in os.walk(startPath):
        for target in files:
            if target.endswith(".php"):
                inspectFile(path.join(root, target))


if __name__ == '__main__':
    walkpath(sys.argv[1])