@anonympins/fingerprint 0.3.7 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +331 -244
- package/README.md +63 -1201
- package/composer.json +38 -38
- package/index.js +4 -4
- package/package.json +103 -103
- package/phpunit.xml +20 -20
- package/public/fp.js +1 -1
- package/public/fp.wasm +0 -0
- package/src/js/build-client.js +1 -1
- package/src/js/fingerprint.client.js +2 -0
- package/src/js/fingerprint.js +4429 -4220
- package/src/js/mongodb-store.js +79 -79
- package/src/js/pow.solver.inline.js +31 -0
- package/src/js/pow.solver.js +31 -0
- package/src/js/tests/fingerprint.builder.test.js +79 -0
- package/src/js/tests/fingerprint.client.init.test.js +120 -0
- package/src/js/tests/fingerprint.client.test.js +105 -0
- package/src/js/tests/fingerprint.engine.test.js +371 -0
- package/src/js/tests/fingerprint.isMalicious.test.js +117 -0
- package/src/js/tests/fingerprint.test.js +2319 -0
- package/src/js/tests/ip-reputation.test.js +132 -0
- package/src/js/tests/ja3AnomalyDetector.test.js +135 -0
- package/src/js/tests/library.test.js +96 -0
- package/src/js/tests/metrics.test.js +104 -0
- package/src/js/tests/pow.solver.test.js +198 -0
- package/src/js/tests/problem-manager.test.js +323 -0
- package/src/js/tests/stores.test.js +118 -0
- package/src/php/Challenge/ChallengeUtils.php +361 -305
- package/src/php/Config/SecurityProfiles.php +271 -266
- package/src/php/FingerprintBuilder.php +185 -185
- package/src/php/FingerprintClient.php +131 -131
- package/src/php/FingerprintEngine.php +1006 -1006
- package/src/php/Ja3AnomalyDetector.php +227 -227
- package/src/php/Optimization/FunctionRegistry.php +62 -62
- package/src/php/Optimization/Optimization.php +255 -255
- package/src/php/Optimization/OptimizationOperators.php +304 -304
- package/src/php/Store/InMemoryStore.php +66 -66
- package/src/php/Store/MongoDbStore.php +104 -104
- package/src/php/Store/RedisStore.php +53 -53
- package/src/php/Tests/ChallengeUtilsTest.php +81 -81
- package/src/php/Tests/FingerprintBuilderTest.php +57 -57
- package/src/php/Tests/FingerprintClientTest.php +71 -0
- package/src/php/Tests/FingerprintEngineTest.php +299 -299
- package/src/php/Tests/IpReputationTest.php +156 -156
- package/src/php/Tests/Ja3AnomalyDetectorTest.php +179 -179
- package/src/php/Tests/MetricsTest.php +45 -45
- package/src/php/Tests/PowTest.php +39 -39
- package/src/php/Tests/ProblemManagerTest.php +296 -296
- package/src/php/Tests/RequestUtilsTest.php +253 -145
- package/src/php/Tests/TLSClientHelloParserTest.php +118 -0
- package/src/php/Tests/problems.config.json +8 -8
- package/src/php/Utils/BigInt.php +144 -144
- package/src/php/Utils/Logger.php +29 -29
- package/src/php/Utils/MaliciousPatterns.php +58 -58
- package/src/php/Utils/MetricsManager.php +166 -166
- package/src/php/Utils/RequestUtils.php +31 -4
- package/src/php/Utils/TLSClientHelloParser.php +117 -0
- package/src/php/bin/auto-tune.php +117 -117
package/src/php/Utils/BigInt.php
CHANGED
|
@@ -1,145 +1,145 @@
|
|
|
1
|
-
<?php
|
|
2
|
-
|
|
3
|
-
declare(strict_types=1);
|
|
4
|
-
|
|
5
|
-
namespace Anonympins\Fingerprint\Utils;
|
|
6
|
-
|
|
7
|
-
class BigInt
|
|
8
|
-
{
|
|
9
|
-
private static bool $useGmp;
|
|
10
|
-
/** @var \GMP|string */
|
|
11
|
-
private $value;
|
|
12
|
-
|
|
13
|
-
/**
|
|
14
|
-
* @param \GMP|string|int $number Le nombre initial.
|
|
15
|
-
*/
|
|
16
|
-
public function __construct($number)
|
|
17
|
-
{
|
|
18
|
-
if (!isset(self::$useGmp)) {
|
|
19
|
-
self::$useGmp = extension_loaded('gmp');
|
|
20
|
-
}
|
|
21
|
-
|
|
22
|
-
if (self::$useGmp) {
|
|
23
|
-
if ($number instanceof \GMP) {
|
|
24
|
-
$this->value = $number;
|
|
25
|
-
} else {
|
|
26
|
-
$this->value = gmp_init($number);
|
|
27
|
-
}
|
|
28
|
-
} else {
|
|
29
|
-
if ($number instanceof BigInt) {
|
|
30
|
-
$this->value = $number->value;
|
|
31
|
-
} else {
|
|
32
|
-
$this->value = (string)$number;
|
|
33
|
-
}
|
|
34
|
-
}
|
|
35
|
-
}
|
|
36
|
-
|
|
37
|
-
/**
|
|
38
|
-
* Crée une instance à partir d'une chaîne hexadécimale.
|
|
39
|
-
*/
|
|
40
|
-
public static function fromHex(string $hex): BigInt
|
|
41
|
-
{
|
|
42
|
-
if (self::$useGmp) {
|
|
43
|
-
return new self(gmp_init($hex, 16));
|
|
44
|
-
} else {
|
|
45
|
-
$dec = '0';
|
|
46
|
-
$len = strlen($hex);
|
|
47
|
-
for ($i = 0; $i < $len; $i++) {
|
|
48
|
-
$dec = bcadd(bcmul($dec, '16'), (string)hexdec($hex[$i]));
|
|
49
|
-
}
|
|
50
|
-
return new self($dec);
|
|
51
|
-
}
|
|
52
|
-
}
|
|
53
|
-
|
|
54
|
-
/**
|
|
55
|
-
* Compare cette instance avec une autre.
|
|
56
|
-
* @return int < 0 si this < other, 0 si this == other, > 0 si this > other.
|
|
57
|
-
*/
|
|
58
|
-
public function compareTo(BigInt $other): int
|
|
59
|
-
{
|
|
60
|
-
if (self::$useGmp) {
|
|
61
|
-
return gmp_cmp($this->value, $other->value);
|
|
62
|
-
} else {
|
|
63
|
-
return bccomp($this->value, $other->value);
|
|
64
|
-
}
|
|
65
|
-
}
|
|
66
|
-
|
|
67
|
-
/**
|
|
68
|
-
* Effectue un décalage de bits vers la gauche (<<).
|
|
69
|
-
*/
|
|
70
|
-
public function shiftLeft(int $bits): BigInt
|
|
71
|
-
{
|
|
72
|
-
if (self::$useGmp) {
|
|
73
|
-
return new self(gmp_mul($this->value, gmp_pow("2", $bits)));
|
|
74
|
-
} else {
|
|
75
|
-
return new self(bcmul($this->value, bcpow("2", (string)$bits)));
|
|
76
|
-
}
|
|
77
|
-
}
|
|
78
|
-
|
|
79
|
-
/**
|
|
80
|
-
* Effectue un décalage de bits vers la droite (>>).
|
|
81
|
-
*/
|
|
82
|
-
public function shiftRight(int $bits): BigInt
|
|
83
|
-
{
|
|
84
|
-
if (self::$useGmp) {
|
|
85
|
-
return new self(gmp_div_q($this->value, gmp_pow("2", $bits)));
|
|
86
|
-
} else {
|
|
87
|
-
return new self(bcdiv($this->value, bcpow("2", (string)$bits)));
|
|
88
|
-
}
|
|
89
|
-
}
|
|
90
|
-
|
|
91
|
-
/**
|
|
92
|
-
* Retourne la représentation en chaîne de caractères.
|
|
93
|
-
*/
|
|
94
|
-
public function __toString(): string
|
|
95
|
-
{
|
|
96
|
-
if (self::$useGmp) {
|
|
97
|
-
return gmp_strval($this->value);
|
|
98
|
-
} else {
|
|
99
|
-
return $this->value;
|
|
100
|
-
}
|
|
101
|
-
}
|
|
102
|
-
|
|
103
|
-
/**
|
|
104
|
-
* Retourne la représentation hexadécimale.
|
|
105
|
-
*/
|
|
106
|
-
public function toHex(): string
|
|
107
|
-
{
|
|
108
|
-
if (self::$useGmp) {
|
|
109
|
-
return gmp_strval($this->value, 16);
|
|
110
|
-
} else {
|
|
111
|
-
$hex = '';
|
|
112
|
-
$dec = $this->value;
|
|
113
|
-
while (bccomp($dec, '0') > 0) {
|
|
114
|
-
$rem = bcmod($dec, '16');
|
|
115
|
-
$hex = dechex((int)$rem) . $hex;
|
|
116
|
-
$dec = bcdiv($dec, '16');
|
|
117
|
-
}
|
|
118
|
-
return $hex ?: '0';
|
|
119
|
-
}
|
|
120
|
-
}
|
|
121
|
-
|
|
122
|
-
/**
|
|
123
|
-
* Crée une instance à partir d'une puissance de 2.
|
|
124
|
-
*/
|
|
125
|
-
public static function pow(int $base, int $exp): BigInt
|
|
126
|
-
{
|
|
127
|
-
if (self::$useGgmp) {
|
|
128
|
-
return new self(gmp_pow((string)$base, $exp));
|
|
129
|
-
} else {
|
|
130
|
-
return new self(bcpow((string)$base, (string)$exp));
|
|
131
|
-
}
|
|
132
|
-
}
|
|
133
|
-
|
|
134
|
-
/**
|
|
135
|
-
* Soustrait un autre BigInt.
|
|
136
|
-
*/
|
|
137
|
-
public function sub(BigInt $other): BigInt
|
|
138
|
-
{
|
|
139
|
-
if (self::$useGmp) {
|
|
140
|
-
return new self(gmp_sub($this->value, $other->value));
|
|
141
|
-
} else {
|
|
142
|
-
return new self(bcsub($this->value, $other->value));
|
|
143
|
-
}
|
|
144
|
-
}
|
|
1
|
+
<?php
|
|
2
|
+
|
|
3
|
+
declare(strict_types=1);
|
|
4
|
+
|
|
5
|
+
namespace Anonympins\Fingerprint\Utils;
|
|
6
|
+
|
|
7
|
+
class BigInt
|
|
8
|
+
{
|
|
9
|
+
private static bool $useGmp;
|
|
10
|
+
/** @var \GMP|string */
|
|
11
|
+
private $value;
|
|
12
|
+
|
|
13
|
+
/**
|
|
14
|
+
* @param \GMP|string|int $number Le nombre initial.
|
|
15
|
+
*/
|
|
16
|
+
public function __construct($number)
|
|
17
|
+
{
|
|
18
|
+
if (!isset(self::$useGmp)) {
|
|
19
|
+
self::$useGmp = extension_loaded('gmp');
|
|
20
|
+
}
|
|
21
|
+
|
|
22
|
+
if (self::$useGmp) {
|
|
23
|
+
if ($number instanceof \GMP) {
|
|
24
|
+
$this->value = $number;
|
|
25
|
+
} else {
|
|
26
|
+
$this->value = gmp_init($number);
|
|
27
|
+
}
|
|
28
|
+
} else {
|
|
29
|
+
if ($number instanceof BigInt) {
|
|
30
|
+
$this->value = $number->value;
|
|
31
|
+
} else {
|
|
32
|
+
$this->value = (string)$number;
|
|
33
|
+
}
|
|
34
|
+
}
|
|
35
|
+
}
|
|
36
|
+
|
|
37
|
+
/**
|
|
38
|
+
* Crée une instance à partir d'une chaîne hexadécimale.
|
|
39
|
+
*/
|
|
40
|
+
public static function fromHex(string $hex): BigInt
|
|
41
|
+
{
|
|
42
|
+
if (self::$useGmp) {
|
|
43
|
+
return new self(gmp_init($hex, 16));
|
|
44
|
+
} else {
|
|
45
|
+
$dec = '0';
|
|
46
|
+
$len = strlen($hex);
|
|
47
|
+
for ($i = 0; $i < $len; $i++) {
|
|
48
|
+
$dec = bcadd(bcmul($dec, '16'), (string)hexdec($hex[$i]));
|
|
49
|
+
}
|
|
50
|
+
return new self($dec);
|
|
51
|
+
}
|
|
52
|
+
}
|
|
53
|
+
|
|
54
|
+
/**
|
|
55
|
+
* Compare cette instance avec une autre.
|
|
56
|
+
* @return int < 0 si this < other, 0 si this == other, > 0 si this > other.
|
|
57
|
+
*/
|
|
58
|
+
public function compareTo(BigInt $other): int
|
|
59
|
+
{
|
|
60
|
+
if (self::$useGmp) {
|
|
61
|
+
return gmp_cmp($this->value, $other->value);
|
|
62
|
+
} else {
|
|
63
|
+
return bccomp($this->value, $other->value);
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
|
|
67
|
+
/**
|
|
68
|
+
* Effectue un décalage de bits vers la gauche (<<).
|
|
69
|
+
*/
|
|
70
|
+
public function shiftLeft(int $bits): BigInt
|
|
71
|
+
{
|
|
72
|
+
if (self::$useGmp) {
|
|
73
|
+
return new self(gmp_mul($this->value, gmp_pow("2", $bits)));
|
|
74
|
+
} else {
|
|
75
|
+
return new self(bcmul($this->value, bcpow("2", (string)$bits)));
|
|
76
|
+
}
|
|
77
|
+
}
|
|
78
|
+
|
|
79
|
+
/**
|
|
80
|
+
* Effectue un décalage de bits vers la droite (>>).
|
|
81
|
+
*/
|
|
82
|
+
public function shiftRight(int $bits): BigInt
|
|
83
|
+
{
|
|
84
|
+
if (self::$useGmp) {
|
|
85
|
+
return new self(gmp_div_q($this->value, gmp_pow("2", $bits)));
|
|
86
|
+
} else {
|
|
87
|
+
return new self(bcdiv($this->value, bcpow("2", (string)$bits)));
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
|
|
91
|
+
/**
|
|
92
|
+
* Retourne la représentation en chaîne de caractères.
|
|
93
|
+
*/
|
|
94
|
+
public function __toString(): string
|
|
95
|
+
{
|
|
96
|
+
if (self::$useGmp) {
|
|
97
|
+
return gmp_strval($this->value);
|
|
98
|
+
} else {
|
|
99
|
+
return $this->value;
|
|
100
|
+
}
|
|
101
|
+
}
|
|
102
|
+
|
|
103
|
+
/**
|
|
104
|
+
* Retourne la représentation hexadécimale.
|
|
105
|
+
*/
|
|
106
|
+
public function toHex(): string
|
|
107
|
+
{
|
|
108
|
+
if (self::$useGmp) {
|
|
109
|
+
return gmp_strval($this->value, 16);
|
|
110
|
+
} else {
|
|
111
|
+
$hex = '';
|
|
112
|
+
$dec = $this->value;
|
|
113
|
+
while (bccomp($dec, '0') > 0) {
|
|
114
|
+
$rem = bcmod($dec, '16');
|
|
115
|
+
$hex = dechex((int)$rem) . $hex;
|
|
116
|
+
$dec = bcdiv($dec, '16');
|
|
117
|
+
}
|
|
118
|
+
return $hex ?: '0';
|
|
119
|
+
}
|
|
120
|
+
}
|
|
121
|
+
|
|
122
|
+
/**
|
|
123
|
+
* Crée une instance à partir d'une puissance de 2.
|
|
124
|
+
*/
|
|
125
|
+
public static function pow(int $base, int $exp): BigInt
|
|
126
|
+
{
|
|
127
|
+
if (self::$useGgmp) {
|
|
128
|
+
return new self(gmp_pow((string)$base, $exp));
|
|
129
|
+
} else {
|
|
130
|
+
return new self(bcpow((string)$base, (string)$exp));
|
|
131
|
+
}
|
|
132
|
+
}
|
|
133
|
+
|
|
134
|
+
/**
|
|
135
|
+
* Soustrait un autre BigInt.
|
|
136
|
+
*/
|
|
137
|
+
public function sub(BigInt $other): BigInt
|
|
138
|
+
{
|
|
139
|
+
if (self::$useGmp) {
|
|
140
|
+
return new self(gmp_sub($this->value, $other->value));
|
|
141
|
+
} else {
|
|
142
|
+
return new self(bcsub($this->value, $other->value));
|
|
143
|
+
}
|
|
144
|
+
}
|
|
145
145
|
}
|
package/src/php/Utils/Logger.php
CHANGED
|
@@ -1,30 +1,30 @@
|
|
|
1
|
-
<?php
|
|
2
|
-
|
|
3
|
-
declare(strict_types=1);
|
|
4
|
-
|
|
5
|
-
namespace Anonympins\Fingerprint\Utils;
|
|
6
|
-
|
|
7
|
-
/**
|
|
8
|
-
* Un simple wrapper de logger pour passer les données à une fonction de rappel.
|
|
9
|
-
*/
|
|
10
|
-
class Logger
|
|
11
|
-
{
|
|
12
|
-
/**
|
|
13
|
-
* @var callable
|
|
14
|
-
*/
|
|
15
|
-
private $callback;
|
|
16
|
-
|
|
17
|
-
public function __construct(callable $callback)
|
|
18
|
-
{
|
|
19
|
-
$this->callback = $callback;
|
|
20
|
-
}
|
|
21
|
-
|
|
22
|
-
public function log(string $level, string $type, array $data): void
|
|
23
|
-
{
|
|
24
|
-
$logEntry = array_merge($data, [
|
|
25
|
-
'type' => $type,
|
|
26
|
-
'timestamp' => (int)floor(microtime(true) * 1000),
|
|
27
|
-
]);
|
|
28
|
-
($this->callback)($logEntry);
|
|
29
|
-
}
|
|
1
|
+
<?php
|
|
2
|
+
|
|
3
|
+
declare(strict_types=1);
|
|
4
|
+
|
|
5
|
+
namespace Anonympins\Fingerprint\Utils;
|
|
6
|
+
|
|
7
|
+
/**
|
|
8
|
+
* Un simple wrapper de logger pour passer les données à une fonction de rappel.
|
|
9
|
+
*/
|
|
10
|
+
class Logger
|
|
11
|
+
{
|
|
12
|
+
/**
|
|
13
|
+
* @var callable
|
|
14
|
+
*/
|
|
15
|
+
private $callback;
|
|
16
|
+
|
|
17
|
+
public function __construct(callable $callback)
|
|
18
|
+
{
|
|
19
|
+
$this->callback = $callback;
|
|
20
|
+
}
|
|
21
|
+
|
|
22
|
+
public function log(string $level, string $type, array $data): void
|
|
23
|
+
{
|
|
24
|
+
$logEntry = array_merge($data, [
|
|
25
|
+
'type' => $type,
|
|
26
|
+
'timestamp' => (int)floor(microtime(true) * 1000),
|
|
27
|
+
]);
|
|
28
|
+
($this->callback)($logEntry);
|
|
29
|
+
}
|
|
30
30
|
}
|
|
@@ -1,59 +1,59 @@
|
|
|
1
|
-
<?php
|
|
2
|
-
|
|
3
|
-
declare(strict_types=1);
|
|
4
|
-
|
|
5
|
-
namespace Anonympins\Fingerprint\Utils;
|
|
6
|
-
|
|
7
|
-
/**
|
|
8
|
-
* Fournit des fonctions pour détecter les patterns d'injection malveillants.
|
|
9
|
-
*/
|
|
10
|
-
class MaliciousPatterns
|
|
11
|
-
{
|
|
12
|
-
/**
|
|
13
|
-
* @var array<string, string> Map des patterns malveillants regroupés par type.
|
|
14
|
-
*/
|
|
15
|
-
private const INJECTION_PATTERNS = [
|
|
16
|
-
// SQL/NoSQL injections, including time-based attacks
|
|
17
|
-
'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
|
|
18
|
-
// Log4Shell (JNDI injection)
|
|
19
|
-
'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
|
|
20
|
-
// Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
|
|
21
|
-
'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
|
|
22
|
-
// XML External Entity (XXE) injection
|
|
23
|
-
'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
|
|
24
|
-
// Path Traversal
|
|
25
|
-
'traversal' => '/(\.\.\/|\.\.)/',
|
|
26
|
-
// Remote Command Execution (RCE)
|
|
27
|
-
// The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
|
|
28
|
-
// Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
|
|
29
|
-
'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
|
|
30
|
-
];
|
|
31
|
-
|
|
32
|
-
/**
|
|
33
|
-
* Vérifie si une chaîne de caractères contient des patterns d'injection connus.
|
|
34
|
-
* @param string $str La chaîne à vérifier.
|
|
35
|
-
* @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
|
|
36
|
-
* @return bool True si un pattern malveillant est détecté, false sinon.
|
|
37
|
-
*/
|
|
38
|
-
public static function isMalicious(string $str, array $typesToDetect = []): bool
|
|
39
|
-
{
|
|
40
|
-
if (empty($typesToDetect)) {
|
|
41
|
-
$typesToDetect = array_keys(self::INJECTION_PATTERNS);
|
|
42
|
-
}
|
|
43
|
-
|
|
44
|
-
foreach ($typesToDetect as $type) {
|
|
45
|
-
if (isset(self::INJECTION_PATTERNS[$type])) {
|
|
46
|
-
try {
|
|
47
|
-
if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
|
|
48
|
-
return true;
|
|
49
|
-
}
|
|
50
|
-
}catch (\Exception $e){
|
|
51
|
-
error_log($type);
|
|
52
|
-
error_log($e->getMessage());
|
|
53
|
-
}
|
|
54
|
-
}
|
|
55
|
-
}
|
|
56
|
-
|
|
57
|
-
return false;
|
|
58
|
-
}
|
|
1
|
+
<?php
|
|
2
|
+
|
|
3
|
+
declare(strict_types=1);
|
|
4
|
+
|
|
5
|
+
namespace Anonympins\Fingerprint\Utils;
|
|
6
|
+
|
|
7
|
+
/**
|
|
8
|
+
* Fournit des fonctions pour détecter les patterns d'injection malveillants.
|
|
9
|
+
*/
|
|
10
|
+
class MaliciousPatterns
|
|
11
|
+
{
|
|
12
|
+
/**
|
|
13
|
+
* @var array<string, string> Map des patterns malveillants regroupés par type.
|
|
14
|
+
*/
|
|
15
|
+
private const INJECTION_PATTERNS = [
|
|
16
|
+
// SQL/NoSQL injections, including time-based attacks
|
|
17
|
+
'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
|
|
18
|
+
// Log4Shell (JNDI injection)
|
|
19
|
+
'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
|
|
20
|
+
// Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
|
|
21
|
+
'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
|
|
22
|
+
// XML External Entity (XXE) injection
|
|
23
|
+
'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
|
|
24
|
+
// Path Traversal
|
|
25
|
+
'traversal' => '/(\.\.\/|\.\.)/',
|
|
26
|
+
// Remote Command Execution (RCE)
|
|
27
|
+
// The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
|
|
28
|
+
// Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
|
|
29
|
+
'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
|
|
30
|
+
];
|
|
31
|
+
|
|
32
|
+
/**
|
|
33
|
+
* Vérifie si une chaîne de caractères contient des patterns d'injection connus.
|
|
34
|
+
* @param string $str La chaîne à vérifier.
|
|
35
|
+
* @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
|
|
36
|
+
* @return bool True si un pattern malveillant est détecté, false sinon.
|
|
37
|
+
*/
|
|
38
|
+
public static function isMalicious(string $str, array $typesToDetect = []): bool
|
|
39
|
+
{
|
|
40
|
+
if (empty($typesToDetect)) {
|
|
41
|
+
$typesToDetect = array_keys(self::INJECTION_PATTERNS);
|
|
42
|
+
}
|
|
43
|
+
|
|
44
|
+
foreach ($typesToDetect as $type) {
|
|
45
|
+
if (isset(self::INJECTION_PATTERNS[$type])) {
|
|
46
|
+
try {
|
|
47
|
+
if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
|
|
48
|
+
return true;
|
|
49
|
+
}
|
|
50
|
+
}catch (\Exception $e){
|
|
51
|
+
error_log($type);
|
|
52
|
+
error_log($e->getMessage());
|
|
53
|
+
}
|
|
54
|
+
}
|
|
55
|
+
}
|
|
56
|
+
|
|
57
|
+
return false;
|
|
58
|
+
}
|
|
59
59
|
}
|