@anonympins/fingerprint 0.7.0 → 0.7.1

package/src/php/Tests/TLSClientHelloParserTest.php

@@ -1,178 +1,178 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\Utils\TLSClientHelloParser;
-use PHPUnit\Framework\TestCase;
-
-/**
- * Tests unitaires pour le décodeur binaire TLS Client Hello.
- */
-class TLSClientHelloParserTest extends TestCase
-{
-    /**
-     * Helper pour construire un paquet TLS Client Hello binaire valide et réaliste.
-     *
-     * @param int $sslVersion Version TLS (ex: 0x0303 pour TLS 1.2)
-     * @param array<int> $ciphers Liste des Cipher Suites
-     * @param array<array{type: int, data: string}> $extensions Liste des extensions
-     * @return string Paquet binaire brut
-     */
-    private function buildMockClientHello(int $sslVersion = 0x0303, array $ciphers = [4865, 2570], array $extensions = []): string
-    {
-        $recordType = pack('C', 0x16); // Handshake Record (22)
-        $recordVersion = pack('n', 0x0301); // TLS 1.0 record layer version
-        $recordLength = pack('n', 120); // Dummy length
-
-        $handshakeType = pack('C', 0x01); // Client Hello (1)
-        $handshakeLength = pack('C3', 0, 0, 110); // Dummy length
-
-        $clientVersion = pack('n', $sslVersion);
-        $random = str_repeat("\x00", 32); // Random de 32 octets
-        $sessionId = pack('C', 0x00); // Session ID vide (longueur 0)
-
-        // Construction des Cipher Suites
-        $ciphersBinary = '';
-        foreach ($ciphers as $cipher) {
-            $ciphersBinary .= pack('n', $cipher);
-        }
-        $ciphersPayload = pack('n', strlen($ciphersBinary)) . $ciphersBinary;
-
-        // Compression Methods (Standard: 1 méthode, valeur 0x00 = null)
-        $compression = pack('C2', 1, 0);
-
-        // Construction des Extensions
-        $extensionsBinary = '';
-        foreach ($extensions as $ext) {
-            $extensionsBinary .= pack('n', $ext['type']) . pack('n', strlen($ext['data'])) . $ext['data'];
-        }
-        $extensionsPayload = pack('n', strlen($extensionsBinary)) . $extensionsBinary;
-
-        return $recordType . $recordVersion . $recordLength . $handshakeType . $handshakeLength . $clientVersion . $random . $sessionId . $ciphersPayload . $compression . $extensionsPayload;
-    }
-
-    public function testParseValidClientHelloWithGreaseAndExtensions(): void
-    {
-        // On injecte l'extension 10 (Supported Groups / Curves)
-        // Data: 4 octets de longueur de liste + 29 (X25519) + 2570 (GREASE)
-        $extCurves = [
-            'type' => 10,
-            'data' => pack('n', 4) . pack('n2', 29, 2570)
-        ];
-
-        // On injecte l'extension 11 (EC Point Formats)
-        // Data: 1 octet de longueur de liste + 0 (uncompressed)
-        $extPoints = [
-            'type' => 11,
-            'data' => pack('C2', 1, 0)
-        ];
-
-        // On build le paquet binaire de test
-        $binary = $this->buildMockClientHello(
-            0x0303, // SSL Version: 771 (TLS 1.2)
-            [4865, 2570], // Ciphers (2570 est une valeur GREASE)
-            [$extCurves, $extPoints]
-        );
-
-        $result = TLSClientHelloParser::parse($binary);
-
-        $this->assertNotNull($result);
-        
-        // Vérifications des filtrages GREASE et de la construction de la chaîne JA3
-        // Chaîne JA3 attendue: "Version,Ciphers,Extensions,Curves,Points"
-        // - Version: 771
-        // - Ciphers: 4865 (2570 a été nettoyé car GREASE)
-        // - Extensions: 10-11
-        // - Curves: 29 (2570 a été nettoyé car GREASE)
-        // - Points: 0
-        $expectedJa3String = '771,4865,10-11,29,0';
-        $this->assertSame($expectedJa3String, $result['ja3_string']);
-        $this->assertSame(md5($expectedJa3String), $result['ja3_hash']);
-    }
-
-        public function testParseValidClientHelloWithJa4(): void
-        {
-            // On injecte l'extension 0 (SNI) avec données vides
-            $extSni = [
-                'type' => 0,
-                'data' => pack('n', 0)
-            ];
-
-            // On injecte l'extension 16 (ALPN)
-            // Data: list len (3) + str len (2) + "h2"
-            $extAlpn = [
-                'type' => 16,
-                'data' => pack('n', 3) . pack('C', 2) . 'h2'
-            ];
-
-            // On injecte l'extension 13 (Signature Algorithms)
-            // Data: list len (4) + 2 sig algs (0x0401, 0x0804)
-            $extSigAlgs = [
-                'type' => 13,
-                'data' => pack('n', 4) . pack('n2', 0x0401, 0x0804)
-            ];
-
-            // On injecte l'extension 43 (Supported Versions) pour forcer la version TLS 1.3 (0x0304)
-            // Data: list len (4) + 2 versions (0x0304, 0x0303)
-            $extSupportedVersions = [
-                'type' => 43,
-                'data' => pack('C', 4) . pack('n2', 0x0304, 0x0303)
-            ];
-
-            // On build le paquet binaire de test
-            $binary = $this->buildMockClientHello(
-                0x0303, // Version de base
-                [4865, 2570], // Ciphers (2570 est GREASE, sera ignoré dans les comptes)
-                [$extSni, $extAlpn, $extSigAlgs, $extSupportedVersions]
-            );
-
-            $result = TLSClientHelloParser::parse($binary);
-
-            $this->assertNotNull($result);
-            $this->assertArrayHasKey('ja4_raw', $result);
-
-            // Version la plus haute: 0x0304 -> "13"
-            // SNI présent: "d"
-            // Nombre de ciphers (hors GREASE): 4865 (0x1301) -> 1 -> "01"
-            // Nombre d'extensions (hors GREASE): 0, 13, 16, 43 -> 4 -> "04"
-            // ALPN: "h2"
-            // Partie A attendue: "t13d0104h2"
-            $this->assertStringStartsWith('t13d0104h2', $result['ja4_raw']);
-
-            // Partie B: hash sha256 de "1301" haché en hexadécimal et tronqué à 12 caractères
-            $expectedJa4b = substr(hash('sha256', '1301'), 0, 12);
-            $this->assertStringContainsString($expectedJa4b, $result['ja4_raw']);
-
-            // Partie C: extensions triées et hachées: "0000,000d,0010,002b_0401,0804"
-            $extensionsString = '0000,000d,0010,002b';
-            $sigAlgsString = '0401,0804';
-            $expectedJa4c = substr(hash('sha256', $extensionsString . '_' . $sigAlgsString), 0, 12);
-            $this->assertStringEndsWith($expectedJa4c, $result['ja4_raw']);
-        }
-
-    public function testParseReturnsNullWhenPacketTooShort(): void
-    {
-        $shortBinary = str_repeat("\x16", 40);
-        $this->assertNull(TLSClientHelloParser::parse($shortBinary));
-    }
-
-    public function testParseReturnsNullOnInvalidRecordType(): void
-    {
-        // 0x17 au lieu de 0x16 (Application data au lieu de Handshake)
-        $invalidRecord = $this->buildMockClientHello();
-        $invalidRecord[0] = chr(0x17);
-
-        $this->assertNull(TLSClientHelloParser::parse($invalidRecord));
-    }
-
-    public function testParseReturnsNullOnInvalidHandshakeType(): void
-    {
-        // 0x02 au lieu de 0x01 (Server Hello au lieu de Client Hello)
-        $invalidHandshake = $this->buildMockClientHello();
-        $invalidHandshake[5] = chr(0x02);
-
-        $this->assertNull(TLSClientHelloParser::parse($invalidHandshake));
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Utils\TLSClientHelloParser;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Tests unitaires pour le décodeur binaire TLS Client Hello.
+ */
+class TLSClientHelloParserTest extends TestCase
+{
+    /**
+     * Helper pour construire un paquet TLS Client Hello binaire valide et réaliste.
+     *
+     * @param int $sslVersion Version TLS (ex: 0x0303 pour TLS 1.2)
+     * @param array<int> $ciphers Liste des Cipher Suites
+     * @param array<array{type: int, data: string}> $extensions Liste des extensions
+     * @return string Paquet binaire brut
+     */
+    private function buildMockClientHello(int $sslVersion = 0x0303, array $ciphers = [4865, 2570], array $extensions = []): string
+    {
+        $recordType = pack('C', 0x16); // Handshake Record (22)
+        $recordVersion = pack('n', 0x0301); // TLS 1.0 record layer version
+        $recordLength = pack('n', 120); // Dummy length
+
+        $handshakeType = pack('C', 0x01); // Client Hello (1)
+        $handshakeLength = pack('C3', 0, 0, 110); // Dummy length
+
+        $clientVersion = pack('n', $sslVersion);
+        $random = str_repeat("\x00", 32); // Random de 32 octets
+        $sessionId = pack('C', 0x00); // Session ID vide (longueur 0)
+
+        // Construction des Cipher Suites
+        $ciphersBinary = '';
+        foreach ($ciphers as $cipher) {
+            $ciphersBinary .= pack('n', $cipher);
+        }
+        $ciphersPayload = pack('n', strlen($ciphersBinary)) . $ciphersBinary;
+
+        // Compression Methods (Standard: 1 méthode, valeur 0x00 = null)
+        $compression = pack('C2', 1, 0);
+
+        // Construction des Extensions
+        $extensionsBinary = '';
+        foreach ($extensions as $ext) {
+            $extensionsBinary .= pack('n', $ext['type']) . pack('n', strlen($ext['data'])) . $ext['data'];
+        }
+        $extensionsPayload = pack('n', strlen($extensionsBinary)) . $extensionsBinary;
+
+        return $recordType . $recordVersion . $recordLength . $handshakeType . $handshakeLength . $clientVersion . $random . $sessionId . $ciphersPayload . $compression . $extensionsPayload;
+    }
+
+    public function testParseValidClientHelloWithGreaseAndExtensions(): void
+    {
+        // On injecte l'extension 10 (Supported Groups / Curves)
+        // Data: 4 octets de longueur de liste + 29 (X25519) + 2570 (GREASE)
+        $extCurves = [
+            'type' => 10,
+            'data' => pack('n', 4) . pack('n2', 29, 2570)
+        ];
+
+        // On injecte l'extension 11 (EC Point Formats)
+        // Data: 1 octet de longueur de liste + 0 (uncompressed)
+        $extPoints = [
+            'type' => 11,
+            'data' => pack('C2', 1, 0)
+        ];
+
+        // On build le paquet binaire de test
+        $binary = $this->buildMockClientHello(
+            0x0303, // SSL Version: 771 (TLS 1.2)
+            [4865, 2570], // Ciphers (2570 est une valeur GREASE)
+            [$extCurves, $extPoints]
+        );
+
+        $result = TLSClientHelloParser::parse($binary);
+
+        $this->assertNotNull($result);
+        
+        // Vérifications des filtrages GREASE et de la construction de la chaîne JA3
+        // Chaîne JA3 attendue: "Version,Ciphers,Extensions,Curves,Points"
+        // - Version: 771
+        // - Ciphers: 4865 (2570 a été nettoyé car GREASE)
+        // - Extensions: 10-11
+        // - Curves: 29 (2570 a été nettoyé car GREASE)
+        // - Points: 0
+        $expectedJa3String = '771,4865,10-11,29,0';
+        $this->assertSame($expectedJa3String, $result['ja3_string']);
+        $this->assertSame(md5($expectedJa3String), $result['ja3_hash']);
+    }
+
+        public function testParseValidClientHelloWithJa4(): void
+        {
+            // On injecte l'extension 0 (SNI) avec données vides
+            $extSni = [
+                'type' => 0,
+                'data' => pack('n', 0)
+            ];
+
+            // On injecte l'extension 16 (ALPN)
+            // Data: list len (3) + str len (2) + "h2"
+            $extAlpn = [
+                'type' => 16,
+                'data' => pack('n', 3) . pack('C', 2) . 'h2'
+            ];
+
+            // On injecte l'extension 13 (Signature Algorithms)
+            // Data: list len (4) + 2 sig algs (0x0401, 0x0804)
+            $extSigAlgs = [
+                'type' => 13,
+                'data' => pack('n', 4) . pack('n2', 0x0401, 0x0804)
+            ];
+
+            // On injecte l'extension 43 (Supported Versions) pour forcer la version TLS 1.3 (0x0304)
+            // Data: list len (4) + 2 versions (0x0304, 0x0303)
+            $extSupportedVersions = [
+                'type' => 43,
+                'data' => pack('C', 4) . pack('n2', 0x0304, 0x0303)
+            ];
+
+            // On build le paquet binaire de test
+            $binary = $this->buildMockClientHello(
+                0x0303, // Version de base
+                [4865, 2570], // Ciphers (2570 est GREASE, sera ignoré dans les comptes)
+                [$extSni, $extAlpn, $extSigAlgs, $extSupportedVersions]
+            );
+
+            $result = TLSClientHelloParser::parse($binary);
+
+            $this->assertNotNull($result);
+            $this->assertArrayHasKey('ja4_raw', $result);
+
+            // Version la plus haute: 0x0304 -> "13"
+            // SNI présent: "d"
+            // Nombre de ciphers (hors GREASE): 4865 (0x1301) -> 1 -> "01"
+            // Nombre d'extensions (hors GREASE): 0, 13, 16, 43 -> 4 -> "04"
+            // ALPN: "h2"
+            // Partie A attendue: "t13d0104h2"
+            $this->assertStringStartsWith('t13d0104h2', $result['ja4_raw']);
+
+            // Partie B: hash sha256 de "1301" haché en hexadécimal et tronqué à 12 caractères
+            $expectedJa4b = substr(hash('sha256', '1301'), 0, 12);
+            $this->assertStringContainsString($expectedJa4b, $result['ja4_raw']);
+
+            // Partie C: extensions triées et hachées: "0000,000d,0010,002b_0401,0804"
+            $extensionsString = '0000,000d,0010,002b';
+            $sigAlgsString = '0401,0804';
+            $expectedJa4c = substr(hash('sha256', $extensionsString . '_' . $sigAlgsString), 0, 12);
+            $this->assertStringEndsWith($expectedJa4c, $result['ja4_raw']);
+        }
+
+    public function testParseReturnsNullWhenPacketTooShort(): void
+    {
+        $shortBinary = str_repeat("\x16", 40);
+        $this->assertNull(TLSClientHelloParser::parse($shortBinary));
+    }
+
+    public function testParseReturnsNullOnInvalidRecordType(): void
+    {
+        // 0x17 au lieu de 0x16 (Application data au lieu de Handshake)
+        $invalidRecord = $this->buildMockClientHello();
+        $invalidRecord[0] = chr(0x17);
+
+        $this->assertNull(TLSClientHelloParser::parse($invalidRecord));
+    }
+
+    public function testParseReturnsNullOnInvalidHandshakeType(): void
+    {
+        // 0x02 au lieu de 0x01 (Server Hello au lieu de Client Hello)
+        $invalidHandshake = $this->buildMockClientHello();
+        $invalidHandshake[5] = chr(0x02);
+
+        $this->assertNull(TLSClientHelloParser::parse($invalidHandshake));
+    }
 }

package/src/php/Tests/config/ed25519_key.json

@@ -1,4 +1,4 @@
-{
-    "privateKey": "-----BEGIN PRIVATE KEY-----\\ndummy-php-private\\n-----END PRIVATE KEY-----",
-    "publicKey": "-----BEGIN PUBLIC KEY-----\\ndummy-php-public\\n-----END PUBLIC KEY-----"
+{
+    "privateKey": "-----BEGIN PRIVATE KEY-----\\ndummy-php-private\\n-----END PRIVATE KEY-----",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\\ndummy-php-public\\n-----END PUBLIC KEY-----"
 }

package/src/php/Utils/Env.php

@@ -1,50 +1,50 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-class Env
-{
-    /** @var array<string, mixed> */
-    private static array $localCache = [];
-
-    /**
-     * @param string $key
-     * @param mixed $default
-     * @return mixed
-     */
-    public static function get(string $key, $default = null)
-    {
-        if (array_key_exists($key, self::$localCache)) {
-            return self::$localCache[$key];
-        }
-        if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
-            return $_ENV[$key];
-        }
-        if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
-            return $_SERVER[$key];
-        }
-        $val = getenv($key);
-        if ($val !== false && $val !== '') {
-            return $val;
-        }
-        return $default;
-    }
-
-    public static function set(string $key, $value): void
-    {
-        self::$localCache[$key] = $value;
-        $_ENV[$key] = $value;
-        $_SERVER[$key] = $value;
-        @putenv("{$key}={$value}");
-    }
-
-    public static function clear(string $key): void
-    {
-        unset(self::$localCache[$key]);
-        unset($_ENV[$key]);
-        unset($_SERVER[$key]);
-        @putenv($key);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+class Env
+{
+    /** @var array<string, mixed> */
+    private static array $localCache = [];
+
+    /**
+     * @param string $key
+     * @param mixed $default
+     * @return mixed
+     */
+    public static function get(string $key, $default = null)
+    {
+        if (array_key_exists($key, self::$localCache)) {
+            return self::$localCache[$key];
+        }
+        if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
+            return $_ENV[$key];
+        }
+        if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
+            return $_SERVER[$key];
+        }
+        $val = getenv($key);
+        if ($val !== false && $val !== '') {
+            return $val;
+        }
+        return $default;
+    }
+
+    public static function set(string $key, $value): void
+    {
+        self::$localCache[$key] = $value;
+        $_ENV[$key] = $value;
+        $_SERVER[$key] = $value;
+        @putenv("{$key}={$value}");
+    }
+
+    public static function clear(string $key): void
+    {
+        unset(self::$localCache[$key]);
+        unset($_ENV[$key]);
+        unset($_SERVER[$key]);
+        @putenv($key);
+    }
 }

package/src/php/Utils/MaliciousPatterns.php

@@ -1,75 +1,75 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-/**
- * Fournit des fonctions pour détecter les patterns d'injection malveillants.
- */
-class MaliciousPatterns
-{
-    /**
-     * @var array<string, string> Map des patterns malveillants regroupés par type.
-     */
-    private const INJECTION_PATTERNS = [
-        // SQL/NoSQL injections, including time-based attacks
-        'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
-        // Log4Shell (JNDI injection)
-        'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
-        // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
-        'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
-        // XML External Entity (XXE) injection
-        'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
-        // Path Traversal
-        'traversal' => '/(\.\.\/|\.\.)/',
-        // Remote Command Execution (RCE)
-        // The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
-        // Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
-        'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
-            // Server-Side Request Forgery (SSRF)
-            'ssrf' => '/(?:https?:\/\/)?(?:127\.\d+\.\d+\.\d+|169\.254\.169\.254|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|localhost|0\.0\.0\.0|\[[0:]+1\])\b/i',
-            // Carriage Return Line Feed (CRLF) Injection
-            'crlf' => '/[\r\n]|%0[ad]/i',
-            // Cross-Site Scripting (XSS)
-            'xss' => '/(<script|javascript:|on\w+\s*=|alert\s*\(|confirm\s*\(|prompt\s*\(|<img\s+src[^>]+onerror|<iframe)/i',
-            // Open Redirect
-            'openRedirect' => '/^(https?:)?\/\/(?![^\/]*?(localhost|127\.0\.0\.1))[^\s\/]+/i',
-            // Local/Remote File Inclusion (LFI/RFI)
-            'lfi' => '/(?:etc\/passwd|win\.ini|boot\.ini|php:\/\/filter|data:\/\/|zip:\/\/)/i',
-            // Shellshock (CVE-2014-6271)
-            'shellshock' => '/\(\)\s*\{\s*:\s*;\s*\}\s*/i',
-            // NoSQL Injection (MongoDB query operators)
-            'nosql' => '/\$(?:eq|ne|gt|gte|lt|lte|in|nin|and|or|nor|not|expr|jsonSchema|mod|regex|text|where|elemMatch)/i',
-    ];
-
-    /**
-     * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
-     * @param string $str La chaîne à vérifier.
-     * @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
-     * @return bool True si un pattern malveillant est détecté, false sinon.
-     */
-    public static function isMalicious(string $str, array $typesToDetect = []): bool
-    {
-        if (empty($typesToDetect)) {
-            $typesToDetect = array_filter(array_keys(self::INJECTION_PATTERNS), function ($key) {
-                return $key !== 'openRedirect';
-            });
-        }
-
-        foreach ($typesToDetect as $type) {
-            if (isset(self::INJECTION_PATTERNS[$type])) {
-               try {
-                   if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
-                       return true;
-                   }
-               }catch (\Exception $e){
-                   error_log($type);
-                   error_log($e->getMessage());
-                }
-            }
-        }
-
-        return false;
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+/**
+ * Fournit des fonctions pour détecter les patterns d'injection malveillants.
+ */
+class MaliciousPatterns
+{
+    /**
+     * @var array<string, string> Map des patterns malveillants regroupés par type.
+     */
+    private const INJECTION_PATTERNS = [
+        // SQL/NoSQL injections, including time-based attacks
+        'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
+        // Log4Shell (JNDI injection)
+        'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
+        // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
+        'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
+        // XML External Entity (XXE) injection
+        'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
+        // Path Traversal
+        'traversal' => '/(\.\.\/|\.\.)/',
+        // Remote Command Execution (RCE)
+        // The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
+        // Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
+        'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
+            // Server-Side Request Forgery (SSRF)
+            'ssrf' => '/(?:https?:\/\/)?(?:127\.\d+\.\d+\.\d+|169\.254\.169\.254|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|localhost|0\.0\.0\.0|\[[0:]+1\])\b/i',
+            // Carriage Return Line Feed (CRLF) Injection
+            'crlf' => '/[\r\n]|%0[ad]/i',
+            // Cross-Site Scripting (XSS)
+            'xss' => '/(<script|javascript:|on\w+\s*=|alert\s*\(|confirm\s*\(|prompt\s*\(|<img\s+src[^>]+onerror|<iframe)/i',
+            // Open Redirect
+            'openRedirect' => '/^(https?:)?\/\/(?![^\/]*?(localhost|127\.0\.0\.1))[^\s\/]+/i',
+            // Local/Remote File Inclusion (LFI/RFI)
+            'lfi' => '/(?:etc\/passwd|win\.ini|boot\.ini|php:\/\/filter|data:\/\/|zip:\/\/)/i',
+            // Shellshock (CVE-2014-6271)
+            'shellshock' => '/\(\)\s*\{\s*:\s*;\s*\}\s*/i',
+            // NoSQL Injection (MongoDB query operators)
+            'nosql' => '/\$(?:eq|ne|gt|gte|lt|lte|in|nin|and|or|nor|not|expr|jsonSchema|mod|regex|text|where|elemMatch)/i',
+    ];
+
+    /**
+     * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
+     * @param string $str La chaîne à vérifier.
+     * @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
+     * @return bool True si un pattern malveillant est détecté, false sinon.
+     */
+    public static function isMalicious(string $str, array $typesToDetect = []): bool
+    {
+        if (empty($typesToDetect)) {
+            $typesToDetect = array_filter(array_keys(self::INJECTION_PATTERNS), function ($key) {
+                return $key !== 'openRedirect';
+            });
+        }
+
+        foreach ($typesToDetect as $type) {
+            if (isset(self::INJECTION_PATTERNS[$type])) {
+               try {
+                   if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
+                       return true;
+                   }
+               }catch (\Exception $e){
+                   error_log($type);
+                   error_log($e->getMessage());
+                }
+            }
+        }
+
+        return false;
+    }
 }