@anonympins/fingerprint 0.7.2 → 0.7.4

package/src/php/Tests/FingerprintEngineTest.php

@@ -304,6 +304,9 @@ class FingerprintEngineTest extends TestCase
         }
 
         $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        if (!is_dir($configDir)) {
+            mkdir($configDir, 0777, true);
+        }
         $keyPath = $configDir . '/ed25519_key.json';
 
         Env::clear('ED25519_PRIVATE_KEY');
@@ -328,7 +331,9 @@ class FingerprintEngineTest extends TestCase
         $this->assertEquals(Env::get('ED25519_PRIVATE_KEY'), $stored['privateKey']);
         $this->assertEquals(Env::get('ED25519_PUBLIC_KEY'), $stored['publicKey']);
 
-        unlink($keyPath);
+        if (file_exists($keyPath)) {
+            unlink($keyPath);
+        }
     }
 
     public function testEd25519KeyLoadingFromDisk(): void

package/src/php/Tests/RequestUtilsTest.php

@@ -233,7 +233,7 @@ class RequestUtilsTest extends TestCase
             'headers' => ['x-behavior-metrics' => json_encode($metricsNoActivity)]
         ]);
         $scoreNoActivity = RequestUtils::getBehaviorScore($contextNoActivity);
-        $this->assertEquals(40.0, $scoreNoActivity['behaviorScore']);
+        $this->assertEquals(5.0, $scoreNoActivity['behaviorScore']);
     }
 
     public function testGetBehaviorScoreWithBotLikeKeystrokeDynamics(): void

package/src/php/Tests/ThreatIntelTest.php

@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Ja3AnomalyDetector;
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Store\InMemoryStore;
+use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use PHPUnit\Framework\TestCase;
+
+class ThreatIntelTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        StoreManager::configureStore(new InMemoryStore());
+    }
+
+    public function testRttProxyScoreReturnsZeroForCoherentTurnaround(): void
+    {
+        $reqTime = 1700000000000;
+        $context = new RequestContext(
+            '127.0.0.1', '/',
+            [
+                'x-tcp-rtt' => '15',
+                'x-behavior-metrics' => json_encode(['clientTimestamp' => $reqTime - 30])
+            ],
+            [], null, [], '1.1', $reqTime
+        );
+
+        $score = Ja3AnomalyDetector::getRttProxyScore($context);
+        $this->assertEquals(0.0, $score);
+    }
+
+    public function testRttProxyScoreIgnoresSlowConnectionWithoutTcpRtt(): void
+    {
+        $reqTime = 1700000000000;
+        $context = new RequestContext(
+            '127.0.0.1', '/',
+            ['x-behavior-metrics' => json_encode(['clientTimestamp' => $reqTime - 450])],
+            [], null, [], '1.1', $reqTime
+        );
+
+        $score = Ja3AnomalyDetector::getRttProxyScore($context);
+        $this->assertEquals(0.0, $score, 'A slow connection without TCP RTT context should not trigger a false positive.');
+    }
+
+    public function testRttProxyScoreContinuouslyPenalizesResidentialTunneling(): void
+    {
+        $reqTime = 1700000000000;
+        $context = new RequestContext(
+            '127.0.0.1', '/',
+            ['x-tcp-rtt' => '10', 'x-behavior-metrics' => json_encode(['clientTimestamp' => $reqTime - 300])],
+            [], null, [], '1.1', $reqTime
+        );
+
+        $score = Ja3AnomalyDetector::getRttProxyScore($context);
+        $this->assertGreaterThan(75.0, $score);
+        $this->assertLessThanOrEqual(95.0, $score);
+    }
+}

package/src/php/Utils/Env.php

@@ -1,50 +1,52 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-class Env
-{
-    /** @var array<string, mixed> */
-    private static array $localCache = [];
-
-    /**
-     * @param string $key
-     * @param mixed $default
-     * @return mixed
-     */
-    public static function get(string $key, $default = null)
-    {
-        if (array_key_exists($key, self::$localCache)) {
-            return self::$localCache[$key];
-        }
-        if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
-            return $_ENV[$key];
-        }
-        if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
-            return $_SERVER[$key];
-        }
-        $val = getenv($key);
-        if ($val !== false && $val !== '') {
-            return $val;
-        }
-        return $default;
-    }
-
-    public static function set(string $key, $value): void
-    {
-        self::$localCache[$key] = $value;
-        $_ENV[$key] = $value;
-        $_SERVER[$key] = $value;
-        @putenv("{$key}={$value}");
-    }
-
-    public static function clear(string $key): void
-    {
-        unset(self::$localCache[$key]);
-        unset($_ENV[$key]);
-        unset($_SERVER[$key]);
-        @putenv($key);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+class Env
+{
+    /** @var array<string, mixed> */
+    private static array $localCache = [];
+
+    /**
+     * @param string $key
+     * @param mixed $default
+     * @return mixed
+     */
+    public static function get(string $key, $default = null)
+    {
+        if (array_key_exists($key, self::$localCache)) {
+            return self::$localCache[$key];
+        }
+        // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Environment and server variables may contain raw cryptographic keys.
+        if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
+            return $_ENV[$key];
+        }
+        if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
+            return $_SERVER[$key];
+        }
+        // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash
+        $val = getenv($key);
+        if ($val !== false && $val !== '') {
+            return $val;
+        }
+        return $default;
+    }
+
+    public static function set(string $key, $value): void
+    {
+        self::$localCache[$key] = $value;
+        $_ENV[$key] = $value;
+        $_SERVER[$key] = $value;
+        @putenv("{$key}={$value}");
+    }
+
+    public static function clear(string $key): void
+    {
+        unset(self::$localCache[$key]);
+        unset($_ENV[$key]);
+        unset($_SERVER[$key]);
+        @putenv($key);
+    }
 }

package/src/php/Utils/MaliciousPatterns.php

@@ -1,75 +1,75 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-/**
- * Fournit des fonctions pour détecter les patterns d'injection malveillants.
- */
-class MaliciousPatterns
-{
-    /**
-     * @var array<string, string> Map des patterns malveillants regroupés par type.
-     */
-    private const INJECTION_PATTERNS = [
-        // SQL/NoSQL injections, including time-based attacks
-        'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
-        // Log4Shell (JNDI injection)
-        'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
-        // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
-        'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
-        // XML External Entity (XXE) injection
-        'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
-        // Path Traversal
-        'traversal' => '/(\.\.\/|\.\.)/',
-        // Remote Command Execution (RCE)
-        // The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
-        // Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
-        'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
-            // Server-Side Request Forgery (SSRF)
-            'ssrf' => '/(?:https?:\/\/)?(?:127\.\d+\.\d+\.\d+|169\.254\.169\.254|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|localhost|0\.0\.0\.0|\[[0:]+1\])\b/i',
-            // Carriage Return Line Feed (CRLF) Injection
-            'crlf' => '/[\r\n]|%0[ad]/i',
-            // Cross-Site Scripting (XSS)
-            'xss' => '/(<script|javascript:|on\w+\s*=|alert\s*\(|confirm\s*\(|prompt\s*\(|<img\s+src[^>]+onerror|<iframe)/i',
-            // Open Redirect
-            'openRedirect' => '/^(https?:)?\/\/(?![^\/]*?(localhost|127\.0\.0\.1))[^\s\/]+/i',
-            // Local/Remote File Inclusion (LFI/RFI)
-            'lfi' => '/(?:etc\/passwd|win\.ini|boot\.ini|php:\/\/filter|data:\/\/|zip:\/\/)/i',
-            // Shellshock (CVE-2014-6271)
-            'shellshock' => '/\(\)\s*\{\s*:\s*;\s*\}\s*/i',
-            // NoSQL Injection (MongoDB query operators)
-            'nosql' => '/\$(?:eq|ne|gt|gte|lt|lte|in|nin|and|or|nor|not|expr|jsonSchema|mod|regex|text|where|elemMatch)/i',
-    ];
-
-    /**
-     * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
-     * @param string $str La chaîne à vérifier.
-     * @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
-     * @return bool True si un pattern malveillant est détecté, false sinon.
-     */
-    public static function isMalicious(string $str, array $typesToDetect = []): bool
-    {
-        if (empty($typesToDetect)) {
-            $typesToDetect = array_filter(array_keys(self::INJECTION_PATTERNS), function ($key) {
-                return $key !== 'openRedirect';
-            });
-        }
-
-        foreach ($typesToDetect as $type) {
-            if (isset(self::INJECTION_PATTERNS[$type])) {
-               try {
-                   if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
-                       return true;
-                   }
-               }catch (\Exception $e){
-                   error_log($type);
-                   error_log($e->getMessage());
-                }
-            }
-        }
-
-        return false;
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+/**
+ * Fournit des fonctions pour détecter les patterns d'injection malveillants.
+ */
+class MaliciousPatterns
+{
+    /**
+     * @var array<string, string> Map des patterns malveillants regroupés par type.
+     */
+    private const INJECTION_PATTERNS = [
+        // SQL/NoSQL injections, including time-based attacks
+        'sql' => '/(\$ne|\' *OR *\'1\'=\'1|[\'";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i',
+        // Log4Shell (JNDI injection)
+        'log4shell' => '/\$\{jndi:(ldap|rmi|dns):/i',
+        // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
+        'ssti' => '/\{\{.*\}\}|\{%.*%\}/',
+        // XML External Entity (XXE) injection
+        'xxe' => '/<!ENTITY\s+.*SYSTEM/i',
+        // Path Traversal
+        'traversal' => '/(\.\.\/|\.\.)/',
+        // Remote Command Execution (RCE)
+        // The original regex had an issue with `|cmd` being interpreted as a modifier in some PCRE versions.
+        // Using a non-capturing group (?:...) makes it more robust and fixes the compilation error.
+        'rce' => '/`.*`|(?:^|[\n;&|]\s*)(?:ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i',
+            // Server-Side Request Forgery (SSRF)
+            'ssrf' => '/(?:https?:\/\/)?(?:127\.\d+\.\d+\.\d+|169\.254\.169\.254|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|localhost|0\.0\.0\.0|\[[0:]+1\])\b/i',
+            // Carriage Return Line Feed (CRLF) Injection
+            'crlf' => '/[\r\n]|%0[ad]/i',
+            // Cross-Site Scripting (XSS)
+            'xss' => '/(<script|javascript:|on\w+\s*=|alert\s*\(|confirm\s*\(|prompt\s*\(|<img\s+src[^>]+onerror|<iframe)/i',
+            // Open Redirect
+            'openRedirect' => '/^(https?:)?\/\/(?![^\/]*?(localhost|127\.0\.0\.1))[^\s\/]+/i',
+            // Local/Remote File Inclusion (LFI/RFI)
+            'lfi' => '/(?:etc\/passwd|win\.ini|boot\.ini|php:\/\/filter|data:\/\/|zip:\/\/)/i',
+            // Shellshock (CVE-2014-6271)
+            'shellshock' => '/\(\)\s*\{\s*:\s*;\s*\}\s*/i',
+            // NoSQL Injection (MongoDB query operators)
+            'nosql' => '/\$(?:eq|ne|gt|gte|lt|lte|in|nin|and|or|nor|not|expr|jsonSchema|mod|regex|text|where|elemMatch)/i',
+    ];
+
+    /**
+     * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
+     * @param string $str La chaîne à vérifier.
+     * @param array<string> $typesToDetect Les types d'injections à détecter (par défaut, tous).
+     * @return bool True si un pattern malveillant est détecté, false sinon.
+     */
+    public static function isMalicious(string $str, array $typesToDetect = []): bool
+    {
+        if (empty($typesToDetect)) {
+            $typesToDetect = array_filter(array_keys(self::INJECTION_PATTERNS), function ($key) {
+                return $key !== 'openRedirect';
+            });
+        }
+
+        foreach ($typesToDetect as $type) {
+            if (isset(self::INJECTION_PATTERNS[$type])) {
+               try {
+                   if (preg_match(self::INJECTION_PATTERNS[$type], $str)) {
+                       return true;
+                   }
+               } catch (\Exception $e) {
+                   // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- WAF regex validation diagnostic
+                   error_log("Pattern inspection failed for {$type}: " . $e->getMessage());
+                }
+            }
+        }
+
+        return false;
+    }
 }