@anonympins/fingerprint 0.7.2 → 0.7.3

package/src/php/Utils/MaliciousPatterns.php

@@ -1,75 +1,75 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-/**
- * Fournit des fonctions pour détecter les patterns d'injection malveillants.
- */
-class MaliciousPatterns
-{
-    /**
-     * @var array<string, string> Map des patterns malveillants regroupés par type.
-     */
-    private const INJECTION_PATTERNS = [
-        // SQL/NoSQL injections, including time-based attacks
-        'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
-        // Log4Shell (JNDI injection)
-        'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
-        // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
-        'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
-        // XML External Entity (XXE) injection
-        'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
-        // Path Traversal
-        'traversal' => '/(\.\.\/|\.\.)/',
-        // Remote Command Execution (RCE)
-        // The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
-        // Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
-        'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
-            // Server-Side Request Forgery (SSRF)
-            'ssrf' => '/(?:https?:\/\/)?(?:127\.\d+\.\d+\.\d+|169\.254\.169\.254|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|localhost|0\.0\.0\.0|\[[0:]+1\])\b/i',
-            // Carriage Return Line Feed (CRLF) Injection
-            'crlf' => '/[\r\n]|%0[ad]/i',
-            // Cross-Site Scripting (XSS)
-            'xss' => '/(<script|javascript:|on\w+\s*=|alert\s*\(|confirm\s*\(|prompt\s*\(|<img\s+src[^>]+onerror|<iframe)/i',
-            // Open Redirect
-            'openRedirect' => '/^(https?:)?\/\/(?![^\/]*?(localhost|127\.0\.0\.1))[^\s\/]+/i',
-            // Local/Remote File Inclusion (LFI/RFI)
-            'lfi' => '/(?:etc\/passwd|win\.ini|boot\.ini|php:\/\/filter|data:\/\/|zip:\/\/)/i',
-            // Shellshock (CVE-2014-6271)
-            'shellshock' => '/\(\)\s*\{\s*:\s*;\s*\}\s*/i',
-            // NoSQL Injection (MongoDB query operators)
-            'nosql' => '/\$(?:eq|ne|gt|gte|lt|lte|in|nin|and|or|nor|not|expr|jsonSchema|mod|regex|text|where|elemMatch)/i',
-    ];
-
-    /**
-     * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
-     * @param string $str La chaîne à vérifier.
-     * @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
-     * @return bool True si un pattern malveillant est détecté, false sinon.
-     */
-    public static function isMalicious(string $str, array $typesToDetect = []): bool
-    {
-        if (empty($typesToDetect)) {
-            $typesToDetect = array_filter(array_keys(self::INJECTION_PATTERNS), function ($key) {
-                return $key !== 'openRedirect';
-            });
-        }
-
-        foreach ($typesToDetect as $type) {
-            if (isset(self::INJECTION_PATTERNS[$type])) {
-               try {
-                   if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
-                       return true;
-                   }
-               }catch (\Exception $e){
-                   error_log($type);
-                   error_log($e->getMessage());
-                }
-            }
-        }
-
-        return false;
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+/**
+ * Fournit des fonctions pour détecter les patterns d'injection malveillants.
+ */
+class MaliciousPatterns
+{
+    /**
+     * @var array<string, string> Map des patterns malveillants regroupés par type.
+     */
+    private const INJECTION_PATTERNS = [
+        // SQL/NoSQL injections, including time-based attacks
+        'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
+        // Log4Shell (JNDI injection)
+        'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
+        // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
+        'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
+        // XML External Entity (XXE) injection
+        'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
+        // Path Traversal
+        'traversal' => '/(\.\.\/|\.\.)/',
+        // Remote Command Execution (RCE)
+        // The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
+        // Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
+        'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
+            // Server-Side Request Forgery (SSRF)
+            'ssrf' => '/(?:https?:\/\/)?(?:127\.\d+\.\d+\.\d+|169\.254\.169\.254|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|localhost|0\.0\.0\.0|\[[0:]+1\])\b/i',
+            // Carriage Return Line Feed (CRLF) Injection
+            'crlf' => '/[\r\n]|%0[ad]/i',
+            // Cross-Site Scripting (XSS)
+            'xss' => '/(<script|javascript:|on\w+\s*=|alert\s*\(|confirm\s*\(|prompt\s*\(|<img\s+src[^>]+onerror|<iframe)/i',
+            // Open Redirect
+            'openRedirect' => '/^(https?:)?\/\/(?![^\/]*?(localhost|127\.0\.0\.1))[^\s\/]+/i',
+            // Local/Remote File Inclusion (LFI/RFI)
+            'lfi' => '/(?:etc\/passwd|win\.ini|boot\.ini|php:\/\/filter|data:\/\/|zip:\/\/)/i',
+            // Shellshock (CVE-2014-6271)
+            'shellshock' => '/\(\)\s*\{\s*:\s*;\s*\}\s*/i',
+            // NoSQL Injection (MongoDB query operators)
+            'nosql' => '/\$(?:eq|ne|gt|gte|lt|lte|in|nin|and|or|nor|not|expr|jsonSchema|mod|regex|text|where|elemMatch)/i',
+    ];
+
+    /**
+     * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
+     * @param string $str La chaîne à vérifier.
+     * @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
+     * @return bool True si un pattern malveillant est détecté, false sinon.
+     */
+    public static function isMalicious(string $str, array $typesToDetect = []): bool
+    {
+        if (empty($typesToDetect)) {
+            $typesToDetect = array_filter(array_keys(self::INJECTION_PATTERNS), function ($key) {
+                return $key !== 'openRedirect';
+            });
+        }
+
+        foreach ($typesToDetect as $type) {
+            if (isset(self::INJECTION_PATTERNS[$type])) {
+               try {
+                   if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
+                       return true;
+                   }
+               } catch (\Exception $e) {
+                   // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- WAF regex validation diagnostic
+                   error_log("Pattern inspection failed for {$type}: " . $e->getMessage());
+                }
+            }
+        }
+
+        return false;
+    }
 }

package/src/php/Utils/RequestUtils.php

@@ -1038,19 +1038,34 @@ class RequestUtils
     public static function getThreatIntelScore(RequestContext $context, array $threatIntelConfig): array
     {
         $score = 0.0;
+        $signals = [];
+
         $zkpY = $context->zkpY;
         if (!empty($zkpY)) {
             $store = StoreManager::getStore();
             $isBanned = $store->has("banned-zkp-y:{$zkpY}");
             if ($isBanned) {
                 $score = 100.0;
+                $signals[] = [
+                    'ruleId' => 'FEDERATED_ZKP_BANNED',
+                    'confidence' => 1.0,
+                    'score' => 100.0,
+                    'rationale' => 'Cryptographic identity matched federated banned list consensus'
+                ];
             }
         }
 
-        $rttProxyScore = \Anonympins\Fingerprint\Ja3AnomalyDetector::getRttProxyScore($context);
-        $score = max($score, (float)$rttProxyScore);
+        $rttProxyScore = (float)\Anonympins\Fingerprint\Ja3AnomalyDetector::getRttProxyScore($context);
+        if ($rttProxyScore > 0.0) {
+            $score = max($score, $rttProxyScore);
+            $signals[] = [
+                'ruleId' => 'RESIDENTIAL_PROXY_RTT_DISCREPANCY',
+                'score' => $rttProxyScore,
+                'rationale' => 'Physical discrepancy between TCP edge RTT and application transit latency'
+            ];
+        }
 
-        return ['threatIntelScore' => $score];
+        return ['threatIntelScore' => $score, 'threatIntelSignals' => $signals];
     }
 
     /**
@@ -1145,7 +1160,8 @@ class RequestUtils
      */
     public static function cleanUrlFromPowParams(string $originalPath, array $incomingQuery): string
     {
-        $urlParts = parse_url($originalPath);
+        // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Uses wp_parse_url when running inside WordPress
+        $urlParts = function_exists('wp_parse_url') ? wp_parse_url($originalPath) : parse_url($originalPath);
         $path = $urlParts['path'] ?? '/';
         $finalQuery = $incomingQuery;
 
@@ -1326,7 +1342,8 @@ class RequestUtils
 
         // Utilisation de la partie stable du fingerprint matériel plutôt que l'ID de cookie volatil
         $currentDeviceHash = self::getCompositeDeviceHash($context);
-        $stableFpId = FingerprintBuilder::cyrb53(self::extractStablePart($currentDeviceHash));
+        $stablePart = self::extractStablePart($currentDeviceHash);
+        $stableFpId = !empty($stablePart) ? (string)FingerprintBuilder::cyrb53($stablePart) : (!empty($deviceId) ? $deviceId : (string)FingerprintBuilder::cyrb53($currentDeviceHash));
 
         $currentDeviceContributions = $subnetData['highScoreDevices'][$stableFpId] ?? 0;
         if ($currentDeviceContributions < 1 && $finalScore < 95) {

package/src/php/WordPress/WpDbStore.php

@@ -4,6 +4,10 @@ declare(strict_types=1);
 
 namespace Anonympins\Fingerprint\WordPress;
 
+if (!defined('ABSPATH')) {
+    exit;
+}
+
 use Anonympins\Fingerprint\Store\IStore;
 
 // Polyfill pour ARRAY_A si chargé hors du cycle de vie standard de WordPress