@anonympins/fingerprint 0.4.6 → 0.5.0

package/src/php/Utils/BigInt.php

@@ -1,145 +1,203 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-class BigInt
-{
-    private static bool $useGmp;
-    /** @var \GMP|string */
-    private $value;
-
-    /**
-     * @param \GMP|string|int $number Le nombre initial.
-     */
-    public function __construct($number)
-    {
-        if (!isset(self::$useGmp)) {
-            self::$useGmp = extension_loaded('gmp');
-        }
-
-        if (self::$useGmp) {
-            if ($number instanceof \GMP) {
-                $this->value = $number;
-            } else {
-                $this->value = gmp_init($number);
-            }
-        } else {
-            if ($number instanceof BigInt) {
-                $this->value = $number->value;
-            } else {
-                $this->value = (string)$number;
-            }
-        }
-    }
-
-    /**
-     * Crée une instance à partir d'une chaîne hexadécimale.
-     */
-    public static function fromHex(string $hex): BigInt
-    {
-        if (self::$useGmp) {
-            return new self(gmp_init($hex, 16));
-        } else {
-            $dec = '0';
-            $len = strlen($hex);
-            for ($i = 0; $i < $len; $i++) {
-                $dec = bcadd(bcmul($dec, '16'), (string)hexdec($hex[$i]));
-            }
-            return new self($dec);
-        }
-    }
-
-    /**
-     * Compare cette instance avec une autre.
-     * @return int < 0 si this < other, 0 si this == other, > 0 si this > other.
-     */
-    public function compareTo(BigInt $other): int
-    {
-        if (self::$useGmp) {
-            return gmp_cmp($this->value, $other->value);
-        } else {
-            return bccomp($this->value, $other->value);
-        }
-    }
-
-    /**
-     * Effectue un décalage de bits vers la gauche (<<).
-     */
-    public function shiftLeft(int $bits): BigInt
-    {
-        if (self::$useGmp) {
-            return new self(gmp_mul($this->value, gmp_pow("2", $bits)));
-        } else {
-            return new self(bcmul($this->value, bcpow("2", (string)$bits)));
-        }
-    }
-
-    /**
-     * Effectue un décalage de bits vers la droite (>>).
-     */
-    public function shiftRight(int $bits): BigInt
-    {
-        if (self::$useGmp) {
-            return new self(gmp_div_q($this->value, gmp_pow("2", $bits)));
-        } else {
-            return new self(bcdiv($this->value, bcpow("2", (string)$bits)));
-        }
-    }
-
-    /**
-     * Retourne la représentation en chaîne de caractères.
-     */
-    public function __toString(): string
-    {
-        if (self::$useGmp) {
-            return gmp_strval($this->value);
-        } else {
-            return $this->value;
-        }
-    }
-
-    /**
-     * Retourne la représentation hexadécimale.
-     */
-    public function toHex(): string
-    {
-        if (self::$useGmp) {
-            return gmp_strval($this->value, 16);
-        } else {
-            $hex = '';
-            $dec = $this->value;
-            while (bccomp($dec, '0') > 0) {
-                $rem = bcmod($dec, '16');
-                $hex = dechex((int)$rem) . $hex;
-                $dec = bcdiv($dec, '16');
-            }
-            return $hex ?: '0';
-        }
-    }
-
-    /**
-     * Crée une instance à partir d'une puissance de 2.
-     */
-    public static function pow(int $base, int $exp): BigInt
-    {
-        if (self::$useGgmp) {
-            return new self(gmp_pow((string)$base, $exp));
-        } else {
-            return new self(bcpow((string)$base, (string)$exp));
-        }
-    }
-
-    /**
-     * Soustrait un autre BigInt.
-     */
-    public function sub(BigInt $other): BigInt
-    {
-        if (self::$useGmp) {
-            return new self(gmp_sub($this->value, $other->value));
-        } else {
-            return new self(bcsub($this->value, $other->value));
-        }
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+class BigInt
+{
+    private static ?bool $useGmp = null;
+    /** @var \GMP|string */
+    private $value;
+
+    private static function useGmp(): bool
+    {
+        if (self::$useGmp === null) {
+            self::$useGmp = extension_loaded('gmp');
+        }
+        return self::$useGmp;
+    }
+
+    /**
+     * @param \GMP|string|int $number Le nombre initial.
+     */
+    public function __construct($number)
+    {
+        if (self::useGmp()) {
+            if ($number instanceof \GMP) {
+                $this->value = $number;
+            } else {
+                $str = (string)$number;
+                if (($dot = strpos($str, '.')) !== false) {
+                    $str = substr($str, 0, $dot);
+                }
+                $this->value = gmp_init($str);
+            }
+        } else {
+            if ($number instanceof BigInt) {
+                $this->value = $number->value;
+            } else {
+                $str = (string)$number;
+                if (($dot = strpos($str, '.')) !== false) {
+                    $str = substr($str, 0, $dot);
+                }
+                $this->value = $str;
+            }
+        }
+    }
+
+    /**
+     * Crée une instance à partir d'une chaîne hexadécimale.
+     */
+    public static function fromHex(string $hex): BigInt
+    {
+        $hex = trim(strtolower($hex));
+        if (substr($hex, 0, 2) === '0x') {
+            $hex = substr($hex, 2);
+        }
+        if (self::useGmp()) {
+            return new self(gmp_init($hex, 16));
+        } else {
+            $dec = '0';
+            $len = strlen($hex);
+            for ($i = 0; $i < $len; $i++) {
+                $dec = bcadd(bcmul($dec, '16', 0), (string)hexdec($hex[$i]), 0);
+            }
+            return new self($dec);
+        }
+    }
+
+    /**
+     * Compare cette instance avec une autre.
+     * @return int < 0 si this < other, 0 si this == other, > 0 si this > other.
+     */
+    public function compareTo(BigInt $other): int
+    {
+        if (self::useGmp()) {
+            return gmp_cmp($this->value, $other->value);
+        } else {
+            return bccomp($this->value, $other->value, 0);
+        }
+    }
+
+    /**
+     * Effectue un décalage de bits vers la gauche (<<).
+     */
+    public function shiftLeft(int $bits): BigInt
+    {
+        if (self::useGmp()) {
+            return new self(gmp_mul($this->value, gmp_pow("2", $bits)));
+        } else {
+            return new self(bcmul($this->value, bcpow("2", (string)$bits, 0), 0));
+        }
+    }
+
+    /**
+     * Effectue un décalage de bits vers la droite (>>).
+     */
+    public function shiftRight(int $bits): BigInt
+    {
+        if (self::useGmp()) {
+            return new self(gmp_div_q($this->value, gmp_pow("2", $bits)));
+        } else {
+            return new self(bcdiv($this->value, bcpow("2", (string)$bits, 0), 0));
+        }
+    }
+
+    /**
+     * Retourne la représentation en chaîne de caractères.
+     */
+    public function __toString(): string
+    {
+        if (self::useGmp()) {
+            return gmp_strval($this->value);
+        } else {
+            return $this->value;
+        }
+    }
+
+    /**
+     * Retourne la représentation hexadécimale.
+     */
+    public function toHex(): string
+    {
+        if (self::useGmp()) {
+            return gmp_strval($this->value, 16);
+        } else {
+            $hex = '';
+            $dec = $this->value;
+            while (bccomp($dec, '0', 0) > 0) {
+                $rem = bcmod($dec, '16', 0);
+                $hex = dechex((int)$rem) . $hex;
+                $dec = bcdiv($dec, '16', 0);
+            }
+            return $hex ?: '0';
+        }
+    }
+
+    /**
+     * Crée une instance à partir d'une puissance de 2.
+     */
+    public static function pow(int $base, int $exp): BigInt
+    {
+        if (self::useGmp()) {
+            return new self(gmp_pow((string)$base, $exp));
+        } else {
+            return new self(bcpow((string)$base, (string)$exp, 0));
+        }
+    }
+
+    /**
+     * Soustrait un autre BigInt.
+     */
+    public function sub(BigInt $other): BigInt
+    {
+        if (self::useGmp()) {
+            return new self(gmp_sub($this->value, $other->value));
+        } else {
+            return new self(bcsub($this->value, $other->value, 0));
+        }
+    }
+
+    /**
+     * Computes ($this ^ $exponent) % $modulus
+     */
+    public function modPow(BigInt $exponent, BigInt $modulus): BigInt
+    {
+        if (self::useGmp()) {
+            return new self(gmp_powm($this->value, $exponent->value, $modulus->value));
+        } else {
+            return new self(bcpowmod((string)$this->value, (string)$exponent->value, (string)$modulus->value, 0));
+        }
+    }
+
+    /**
+     * Computes $this % $modulus
+     */
+    public function mod(BigInt $modulus): BigInt
+    {
+        if (self::useGmp()) {
+            return new self(gmp_mod($this->value, $modulus->value));
+        } else {
+            return new self(bcmod((string)$this->value, (string)$modulus->value, 0));
+        }
+    }
+
+    public function add(BigInt $other): BigInt
+    {
+        if (self::useGmp()) {
+            return new self(gmp_add($this->value, $other->value));
+        } else {
+            return new self(bcadd((string)$this->value, (string)$other->value, 0));
+        }
+    }
+
+    public function mul(BigInt $other): BigInt
+    {
+        if (self::useGmp()) {
+            return new self(gmp_mul($this->value, $other->value));
+        } else {
+            return new self(bcmul((string)$this->value, (string)$other->value, 0));
+        }
+    }
 }

package/src/php/Utils/MaliciousPatterns.php

@@ -1,59 +1,75 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-/**
- * Fournit des fonctions pour détecter les patterns d'injection malveillants.
- */
-class MaliciousPatterns
-{
-    /**
-     * @var array<string, string> Map des patterns malveillants regroupés par type.
-     */
-    private const INJECTION_PATTERNS = [
-        // SQL/NoSQL injections, including time-based attacks
-        'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
-        // Log4Shell (JNDI injection)
-        'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
-        // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
-        'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
-        // XML External Entity (XXE) injection
-        'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
-        // Path Traversal
-        'traversal' => '/(\.\.\/|\.\.)/',
-        // Remote Command Execution (RCE)
-        // The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
-        // Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
-        'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
-    ];
-
-    /**
-     * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
-     * @param string $str La chaîne à vérifier.
-     * @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
-     * @return bool True si un pattern malveillant est détecté, false sinon.
-     */
-    public static function isMalicious(string $str, array $typesToDetect = []): bool
-    {
-        if (empty($typesToDetect)) {
-            $typesToDetect = array_keys(self::INJECTION_PATTERNS);
-        }
-
-        foreach ($typesToDetect as $type) {
-            if (isset(self::INJECTION_PATTERNS[$type])) {
-               try {
-                   if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
-                       return true;
-                   }
-               }catch (\Exception $e){
-                   error_log($type);
-                   error_log($e->getMessage());
-                }
-            }
-        }
-
-        return false;
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+/**
+ * Fournit des fonctions pour détecter les patterns d'injection malveillants.
+ */
+class MaliciousPatterns
+{
+    /**
+     * @var array<string, string> Map des patterns malveillants regroupés par type.
+     */
+    private const INJECTION_PATTERNS = [
+        // SQL/NoSQL injections, including time-based attacks
+        'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
+        // Log4Shell (JNDI injection)
+        'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
+        // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
+        'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
+        // XML External Entity (XXE) injection
+        'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
+        // Path Traversal
+        'traversal' => '/(\.\.\/|\.\.)/',
+        // Remote Command Execution (RCE)
+        // The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
+        // Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
+        'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
+            // Server-Side Request Forgery (SSRF)
+            'ssrf' => '/(?:https?:\/\/)?(?:127\.\d+\.\d+\.\d+|169\.254\.169\.254|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|localhost|0\.0\.0\.0|\[[0:]+1\])\b/i',
+            // Carriage Return Line Feed (CRLF) Injection
+            'crlf' => '/[\r\n]|%0[ad]/i',
+            // Cross-Site Scripting (XSS)
+            'xss' => '/(<script|javascript:|on\w+\s*=|alert\s*\(|confirm\s*\(|prompt\s*\(|<img\s+src[^>]+onerror|<iframe)/i',
+            // Open Redirect
+            'openRedirect' => '/^(https?:)?\/\/(?![^\/]*?(localhost|127\.0\.0\.1))[^\s\/]+/i',
+            // Local/Remote File Inclusion (LFI/RFI)
+            'lfi' => '/(?:etc\/passwd|win\.ini|boot\.ini|php:\/\/filter|data:\/\/|zip:\/\/)/i',
+            // Shellshock (CVE-2014-6271)
+            'shellshock' => '/\(\)\s*\{\s*:\s*;\s*\}\s*/i',
+            // NoSQL Injection (MongoDB query operators)
+            'nosql' => '/\$(?:eq|ne|gt|gte|lt|lte|in|nin|and|or|nor|not|expr|jsonSchema|mod|regex|text|where|elemMatch)/i',
+    ];
+
+    /**
+     * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
+     * @param string $str La chaîne à vérifier.
+     * @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
+     * @return bool True si un pattern malveillant est détecté, false sinon.
+     */
+    public static function isMalicious(string $str, array $typesToDetect = []): bool
+    {
+        if (empty($typesToDetect)) {
+            $typesToDetect = array_filter(array_keys(self::INJECTION_PATTERNS), function ($key) {
+                return $key !== 'openRedirect';
+            });
+        }
+
+        foreach ($typesToDetect as $type) {
+            if (isset(self::INJECTION_PATTERNS[$type])) {
+               try {
+                   if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
+                       return true;
+                   }
+               }catch (\Exception $e){
+                   error_log($type);
+                   error_log($e->getMessage());
+                }
+            }
+        }
+
+        return false;
+    }
 }