@anonympins/fingerprint 0.7.1 → 0.7.3

package/src/php/Tests/ThreatIntelTest.php

@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Ja3AnomalyDetector;
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Store\InMemoryStore;
+use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use PHPUnit\Framework\TestCase;
+
+class ThreatIntelTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        StoreManager::configureStore(new InMemoryStore());
+    }
+
+    public function testRttProxyScoreReturnsZeroForCoherentTurnaround(): void
+    {
+        $reqTime = 1700000000000;
+        $context = new RequestContext(
+            '127.0.0.1', '/',
+            [
+                'x-tcp-rtt' => '15',
+                'x-behavior-metrics' => json_encode(['clientTimestamp' => $reqTime - 30])
+            ],
+            [], null, [], '1.1', $reqTime
+        );
+
+        $score = Ja3AnomalyDetector::getRttProxyScore($context);
+        $this->assertEquals(0.0, $score);
+    }
+
+    public function testRttProxyScoreIgnoresSlowConnectionWithoutTcpRtt(): void
+    {
+        $reqTime = 1700000000000;
+        $context = new RequestContext(
+            '127.0.0.1', '/',
+            ['x-behavior-metrics' => json_encode(['clientTimestamp' => $reqTime - 450])],
+            [], null, [], '1.1', $reqTime
+        );
+
+        $score = Ja3AnomalyDetector::getRttProxyScore($context);
+        $this->assertEquals(0.0, $score, 'A slow connection without TCP RTT context should not trigger a false positive.');
+    }
+
+    public function testRttProxyScoreContinuouslyPenalizesResidentialTunneling(): void
+    {
+        $reqTime = 1700000000000;
+        $context = new RequestContext(
+            '127.0.0.1', '/',
+            ['x-tcp-rtt' => '10', 'x-behavior-metrics' => json_encode(['clientTimestamp' => $reqTime - 300])],
+            [], null, [], '1.1', $reqTime
+        );
+
+        $score = Ja3AnomalyDetector::getRttProxyScore($context);
+        $this->assertGreaterThan(75.0, $score);
+        $this->assertLessThanOrEqual(95.0, $score);
+    }
+}

package/src/php/Utils/BlockList.php

@@ -1,100 +1,100 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-/**
- * Implémentation PHP d'une liste de blocage IP/CIDR, similaire à Node.js `net.BlockList`.
- */
-class BlockList
-{
-    /**
-     * @var array<string> Liste des IPs ou CIDR à bloquer.
-     */
-    private array $entries = [];
-
-    /**
-     * Ajoute une adresse IP ou une plage CIDR à la liste.
-     * @param string $entry Une adresse IP (ex: '192.168.1.1') ou une plage CIDR (ex: '192.168.1.0/24').
-     * @return void
-     */
-    public function add(string $entry): void
-    {
-        $this->entries[] = $entry;
-    }
-
-    /**
-     * Vérifie si une adresse IP est présente dans la liste de blocage.
-     * @param string $ip L'adresse IP à vérifier.
-     * @return bool True si l'IP est bloquée, false sinon.
-     */
-    public function check(string $ip): bool
-    {
-        foreach ($this->entries as $entry) {
-            if (str_contains($entry, '/')) {
-                // C'est une plage CIDR
-                if ($this->ipInCidr($ip, $entry)) {
-                    return true;
-                }
-            } else {
-                // C'est une IP directe
-                if ($ip === $entry) {
-                    return true;
-                }
-            }
-        }
-        return false;
-    }
-
-    /**
-     * Vérifie si une adresse IP se trouve dans une plage CIDR donnée.
-     * @param string $ip L'adresse IP à vérifier.
-     * @param string $cidr La plage CIDR (ex: '192.168.1.0/24').
-     * @return bool True si l'IP est dans la plage, false sinon.
-     */
-    private function ipInCidr(string $ip, string $cidr): bool
-    {
-        [$network, $mask] = explode('/', $cidr);
-        $mask = (int)$mask;
-
-        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) && filter_var($network, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
-            // IPv6
-            $ipBinary = inet_pton($ip);
-            $networkBinary = inet_pton($network);
-
-            if ($ipBinary === false || $networkBinary === false) {
-                return false;
-            }
-
-            $ipHex = bin2hex($ipBinary);
-            $networkHex = bin2hex($networkBinary);
-
-            $numBytes = (int)ceil($mask / 8);
-            $compareLength = $numBytes * 2;
-
-            if (substr($ipHex, 0, $compareLength) !== substr($networkHex, 0, $compareLength)) {
-                return false;
-            }
-
-            if ($mask % 8 !== 0) {
-                $bitMask = (0xFF << (8 - ($mask % 8))) & 0xFF;
-                $ipByte = hexdec(substr($ipHex, $numBytes * 2 - 2, 2));
-                $networkByte = hexdec(substr($networkHex, $numBytes * 2 - 2, 2));
-                return ($ipByte & $bitMask) === ($networkByte & $bitMask);
-            }
-
-            return true;
-
-        } elseif (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) && filter_var($network, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
-            // IPv4
-            $ipLong = ip2long($ip);
-            $networkLong = ip2long($network);
-            $wildcard = pow(2, (32 - $mask)) - 1;
-            $netmask = ~$wildcard;
-            return (($ipLong & $netmask) === ($networkLong & $netmask));
-        }
-
-        return false;
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+/**
+ * Implémentation PHP d'une liste de blocage IP/CIDR, similaire à Node.js `net.BlockList`.
+ */
+class BlockList
+{
+    /**
+     * @var array<string> Liste des IPs ou CIDR à bloquer.
+     */
+    private array $entries = [];
+
+    /**
+     * Ajoute une adresse IP ou une plage CIDR à la liste.
+     * @param string $entry Une adresse IP (ex: '192.168.1.1') ou une plage CIDR (ex: '192.168.1.0/24').
+     * @return void
+     */
+    public function add(string $entry): void
+    {
+        $this->entries[] = $entry;
+    }
+
+    /**
+     * Vérifie si une adresse IP est présente dans la liste de blocage.
+     * @param string $ip L'adresse IP à vérifier.
+     * @return bool True si l'IP est bloquée, false sinon.
+     */
+    public function check(string $ip): bool
+    {
+        foreach ($this->entries as $entry) {
+            if (str_contains($entry, '/')) {
+                // C'est une plage CIDR
+                if ($this->ipInCidr($ip, $entry)) {
+                    return true;
+                }
+            } else {
+                // C'est une IP directe
+                if ($ip === $entry) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Vérifie si une adresse IP se trouve dans une plage CIDR donnée.
+     * @param string $ip L'adresse IP à vérifier.
+     * @param string $cidr La plage CIDR (ex: '192.168.1.0/24').
+     * @return bool True si l'IP est dans la plage, false sinon.
+     */
+    private function ipInCidr(string $ip, string $cidr): bool
+    {
+        // Handle IPv4-mapped IPv6 addresses by converting them to IPv4
+        if (str_starts_with(strtolower($ip), '::ffff:') && filter_var(substr($ip, 7), FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+            $ip = substr($ip, 7);
+        }
+
+        [$network, $mask] = explode('/', $cidr, 2);
+        $mask = (int)$mask;
+
+        // Now, both $ip and $network should be in the same family for a valid comparison
+        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) && filter_var($network, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+            if ($mask < 0 || $mask > 32) { return false; }
+            $ipLong = ip2long($ip);
+            $networkLong = ip2long($network);
+            if ($ipLong === false || $networkLong === false) return false;
+            $netmask = -1 << (32 - $mask);
+            return ($ipLong & $netmask) === ($networkLong & $netmask);
+        } elseif (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) && filter_var($network, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+            // IPv6 vs IPv6 CIDR
+            if ($mask < 0 || $mask > 128) { return false; }
+            $ipBinary = inet_pton($ip);
+            $networkBinary = inet_pton($network);
+            if ($ipBinary === false || $networkBinary === false) return false;
+
+            $bytesToCompare = (int)floor($mask / 8);
+            if (strncmp($ipBinary, $networkBinary, $bytesToCompare) !== 0) {
+                return false;
+            }
+
+            $bitsToCompare = $mask % 8;
+            if ($bitsToCompare > 0) {
+                $byteIndex = $bytesToCompare;
+                $bitmask = (0xFF << (8 - $bitsToCompare)) & 0xFF;
+                if ((ord($ipBinary[$byteIndex]) & $bitmask) !== (ord($networkBinary[$byteIndex]) & $bitmask)) {
+                    return false;
+                }
+            }
+
+            return true;
+        }
+
+        return false;
+    }
 }

package/src/php/Utils/Env.php

@@ -1,50 +1,52 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-class Env
-{
-    /** @var array<string, mixed> */
-    private static array $localCache = [];
-
-    /**
-     * @param string $key
-     * @param mixed $default
-     * @return mixed
-     */
-    public static function get(string $key, $default = null)
-    {
-        if (array_key_exists($key, self::$localCache)) {
-            return self::$localCache[$key];
-        }
-        if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
-            return $_ENV[$key];
-        }
-        if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
-            return $_SERVER[$key];
-        }
-        $val = getenv($key);
-        if ($val !== false && $val !== '') {
-            return $val;
-        }
-        return $default;
-    }
-
-    public static function set(string $key, $value): void
-    {
-        self::$localCache[$key] = $value;
-        $_ENV[$key] = $value;
-        $_SERVER[$key] = $value;
-        @putenv("{$key}={$value}");
-    }
-
-    public static function clear(string $key): void
-    {
-        unset(self::$localCache[$key]);
-        unset($_ENV[$key]);
-        unset($_SERVER[$key]);
-        @putenv($key);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+class Env
+{
+    /** @var array<string, mixed> */
+    private static array $localCache = [];
+
+    /**
+     * @param string $key
+     * @param mixed $default
+     * @return mixed
+     */
+    public static function get(string $key, $default = null)
+    {
+        if (array_key_exists($key, self::$localCache)) {
+            return self::$localCache[$key];
+        }
+        // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Environment and server variables may contain raw cryptographic keys.
+        if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
+            return $_ENV[$key];
+        }
+        if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
+            return $_SERVER[$key];
+        }
+        // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash
+        $val = getenv($key);
+        if ($val !== false && $val !== '') {
+            return $val;
+        }
+        return $default;
+    }
+
+    public static function set(string $key, $value): void
+    {
+        self::$localCache[$key] = $value;
+        $_ENV[$key] = $value;
+        $_SERVER[$key] = $value;
+        @putenv("{$key}={$value}");
+    }
+
+    public static function clear(string $key): void
+    {
+        unset(self::$localCache[$key]);
+        unset($_ENV[$key]);
+        unset($_SERVER[$key]);
+        @putenv($key);
+    }
 }

package/src/php/Utils/MaliciousPatterns.php

@@ -1,75 +1,75 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-/**
- * Fournit des fonctions pour détecter les patterns d'injection malveillants.
- */
-class MaliciousPatterns
-{
-    /**
-     * @var array<string, string> Map des patterns malveillants regroupés par type.
-     */
-    private const INJECTION_PATTERNS = [
-        // SQL/NoSQL injections, including time-based attacks
-        'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
-        // Log4Shell (JNDI injection)
-        'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
-        // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
-        'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
-        // XML External Entity (XXE) injection
-        'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
-        // Path Traversal
-        'traversal' => '/(\.\.\/|\.\.)/',
-        // Remote Command Execution (RCE)
-        // The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
-        // Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
-        'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
-            // Server-Side Request Forgery (SSRF)
-            'ssrf' => '/(?:https?:\/\/)?(?:127\.\d+\.\d+\.\d+|169\.254\.169\.254|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|localhost|0\.0\.0\.0|\[[0:]+1\])\b/i',
-            // Carriage Return Line Feed (CRLF) Injection
-            'crlf' => '/[\r\n]|%0[ad]/i',
-            // Cross-Site Scripting (XSS)
-            'xss' => '/(<script|javascript:|on\w+\s*=|alert\s*\(|confirm\s*\(|prompt\s*\(|<img\s+src[^>]+onerror|<iframe)/i',
-            // Open Redirect
-            'openRedirect' => '/^(https?:)?\/\/(?![^\/]*?(localhost|127\.0\.0\.1))[^\s\/]+/i',
-            // Local/Remote File Inclusion (LFI/RFI)
-            'lfi' => '/(?:etc\/passwd|win\.ini|boot\.ini|php:\/\/filter|data:\/\/|zip:\/\/)/i',
-            // Shellshock (CVE-2014-6271)
-            'shellshock' => '/\(\)\s*\{\s*:\s*;\s*\}\s*/i',
-            // NoSQL Injection (MongoDB query operators)
-            'nosql' => '/\$(?:eq|ne|gt|gte|lt|lte|in|nin|and|or|nor|not|expr|jsonSchema|mod|regex|text|where|elemMatch)/i',
-    ];
-
-    /**
-     * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
-     * @param string $str La chaîne à vérifier.
-     * @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
-     * @return bool True si un pattern malveillant est détecté, false sinon.
-     */
-    public static function isMalicious(string $str, array $typesToDetect = []): bool
-    {
-        if (empty($typesToDetect)) {
-            $typesToDetect = array_filter(array_keys(self::INJECTION_PATTERNS), function ($key) {
-                return $key !== 'openRedirect';
-            });
-        }
-
-        foreach ($typesToDetect as $type) {
-            if (isset(self::INJECTION_PATTERNS[$type])) {
-               try {
-                   if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
-                       return true;
-                   }
-               }catch (\Exception $e){
-                   error_log($type);
-                   error_log($e->getMessage());
-                }
-            }
-        }
-
-        return false;
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+/**
+ * Fournit des fonctions pour détecter les patterns d'injection malveillants.
+ */
+class MaliciousPatterns
+{
+    /**
+     * @var array<string, string> Map des patterns malveillants regroupés par type.
+     */
+    private const INJECTION_PATTERNS = [
+        // SQL/NoSQL injections, including time-based attacks
+        'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
+        // Log4Shell (JNDI injection)
+        'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
+        // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
+        'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
+        // XML External Entity (XXE) injection
+        'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
+        // Path Traversal
+        'traversal' => '/(\.\.\/|\.\.)/',
+        // Remote Command Execution (RCE)
+        // The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
+        // Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
+        'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
+            // Server-Side Request Forgery (SSRF)
+            'ssrf' => '/(?:https?:\/\/)?(?:127\.\d+\.\d+\.\d+|169\.254\.169\.254|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|localhost|0\.0\.0\.0|\[[0:]+1\])\b/i',
+            // Carriage Return Line Feed (CRLF) Injection
+            'crlf' => '/[\r\n]|%0[ad]/i',
+            // Cross-Site Scripting (XSS)
+            'xss' => '/(<script|javascript:|on\w+\s*=|alert\s*\(|confirm\s*\(|prompt\s*\(|<img\s+src[^>]+onerror|<iframe)/i',
+            // Open Redirect
+            'openRedirect' => '/^(https?:)?\/\/(?![^\/]*?(localhost|127\.0\.0\.1))[^\s\/]+/i',
+            // Local/Remote File Inclusion (LFI/RFI)
+            'lfi' => '/(?:etc\/passwd|win\.ini|boot\.ini|php:\/\/filter|data:\/\/|zip:\/\/)/i',
+            // Shellshock (CVE-2014-6271)
+            'shellshock' => '/\(\)\s*\{\s*:\s*;\s*\}\s*/i',
+            // NoSQL Injection (MongoDB query operators)
+            'nosql' => '/\$(?:eq|ne|gt|gte|lt|lte|in|nin|and|or|nor|not|expr|jsonSchema|mod|regex|text|where|elemMatch)/i',
+    ];
+
+    /**
+     * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
+     * @param string $str La chaîne à vérifier.
+     * @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
+     * @return bool True si un pattern malveillant est détecté, false sinon.
+     */
+    public static function isMalicious(string $str, array $typesToDetect = []): bool
+    {
+        if (empty($typesToDetect)) {
+            $typesToDetect = array_filter(array_keys(self::INJECTION_PATTERNS), function ($key) {
+                return $key !== 'openRedirect';
+            });
+        }
+
+        foreach ($typesToDetect as $type) {
+            if (isset(self::INJECTION_PATTERNS[$type])) {
+               try {
+                   if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
+                       return true;
+                   }
+               } catch (\Exception $e) {
+                   // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- WAF regex validation diagnostic
+                   error_log("Pattern inspection failed for {$type}: " . $e->getMessage());
+                }
+            }
+        }
+
+        return false;
+    }
 }

package/src/php/Utils/RequestUtils.php

@@ -1038,19 +1038,34 @@ class RequestUtils
     public static function getThreatIntelScore(RequestContext $context, array $threatIntelConfig): array
     {
         $score = 0.0;
+        $signals = [];
+
         $zkpY = $context->zkpY;
         if (!empty($zkpY)) {
             $store = StoreManager::getStore();
             $isBanned = $store->has("banned-zkp-y:{$zkpY}");
             if ($isBanned) {
                 $score = 100.0;
+                $signals[] = [
+                    'ruleId' => 'FEDERATED_ZKP_BANNED',
+                    'confidence' => 1.0,
+                    'score' => 100.0,
+                    'rationale' => 'Cryptographic identity matched federated banned list consensus'
+                ];
             }
         }
 
-        $rttProxyScore = \Anonympins\Fingerprint\Ja3AnomalyDetector::getRttProxyScore($context);
-        $score = max($score, (float)$rttProxyScore);
+        $rttProxyScore = (float)\Anonympins\Fingerprint\Ja3AnomalyDetector::getRttProxyScore($context);
+        if ($rttProxyScore > 0.0) {
+            $score = max($score, $rttProxyScore);
+            $signals[] = [
+                'ruleId' => 'RESIDENTIAL_PROXY_RTT_DISCREPANCY',
+                'score' => $rttProxyScore,
+                'rationale' => 'Physical discrepancy between TCP edge RTT and application transit latency'
+            ];
+        }
 
-        return ['threatIntelScore' => $score];
+        return ['threatIntelScore' => $score, 'threatIntelSignals' => $signals];
     }
 
     /**
@@ -1145,7 +1160,8 @@ class RequestUtils
      */
     public static function cleanUrlFromPowParams(string $originalPath, array $incomingQuery): string
     {
-        $urlParts = parse_url($originalPath);
+        // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Uses wp_parse_url when running inside WordPress
+        $urlParts = function_exists('wp_parse_url') ? wp_parse_url($originalPath) : parse_url($originalPath);
         $path = $urlParts['path'] ?? '/';
         $finalQuery = $incomingQuery;
 
@@ -1326,7 +1342,8 @@ class RequestUtils
 
         // Utilisation de la partie stable du fingerprint matériel plutôt que l'ID de cookie volatil
         $currentDeviceHash = self::getCompositeDeviceHash($context);
-        $stableFpId = FingerprintBuilder::cyrb53(self::extractStablePart($currentDeviceHash));
+        $stablePart = self::extractStablePart($currentDeviceHash);
+        $stableFpId = !empty($stablePart) ? (string)FingerprintBuilder::cyrb53($stablePart) : (!empty($deviceId) ? $deviceId : (string)FingerprintBuilder::cyrb53($currentDeviceHash));
 
         $currentDeviceContributions = $subnetData['highScoreDevices'][$stableFpId] ?? 0;
         if ($currentDeviceContributions < 1 && $finalScore < 95) {

package/src/php/WordPress/WpDbStore.php

@@ -4,6 +4,10 @@ declare(strict_types=1);
 
 namespace Anonympins\Fingerprint\WordPress;
 
+if (!defined('ABSPATH')) {
+    exit;
+}
+
 use Anonympins\Fingerprint\Store\IStore;
 
 // Polyfill pour ARRAY_A si chargé hors du cycle de vie standard de WordPress