@anonympins/fingerprint 0.8.0 → 0.8.2

package/src/php/Challenge/ChallengeUtils.php

@@ -236,6 +236,31 @@ class ChallengeUtils
         return $activePeers[array_rand($activePeers)];
     }
 
+    public static function verifyEd25519Signature(string $message, string $signatureHex, array $config = []): bool
+    {
+        if (empty($message) || empty($signatureHex)) {
+            return false;
+        }
+        $publicKey = $config['ed25519_public_key'] ?? Env::get('ED25519_PUBLIC_KEY');
+        if (empty($publicKey)) {
+            return false;
+        }
+        try {
+            $cleanKey = str_replace('\n', "\n", $publicKey);
+            $pubKeyObj = openssl_pkey_get_public($cleanKey);
+            if (!$pubKeyObj) {
+                return false;
+            }
+            $sigBytes = hex2bin($signatureHex);
+            if ($sigBytes === false) {
+                return false;
+            }
+            return openssl_verify($message, $sigBytes, $pubKeyObj, null) === 1;
+        } catch (\Throwable $e) {
+            return false;
+        }
+    }
+
     /**
      * Handles cooperative peer-to-peer operations (federation threat intel sharing,
      * node registration, peer discovery, WebRTC signaling, block requests/responses).
@@ -261,7 +286,7 @@ class ChallengeUtils
             $peers = $config['federatedPeers'] ?? [];
             if (!empty($peers)) {
                 $allowedHosts = array_map(function ($url) {
-                    // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url
+                    // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Fallback for standalone PHP environments
                     $host = function_exists('wp_parse_url') ? wp_parse_url($url, PHP_URL_HOST) : parse_url($url, PHP_URL_HOST);
                     return !empty($host) ? $host : $url;
                 }, $peers);
@@ -289,18 +314,8 @@ class ChallengeUtils
             $msg = "{$timestamp}:{$zkpY}";
 
             if (!empty($sigEd25519)) {
-                $publicKey = $config['ed25519_public_key'] ?? Env::get('ED25519_PUBLIC_KEY');
-                if (!$publicKey) {
-                    return ['error' => 'Missing public key for asymmetric verification'];
-                }
-                try {
-                    $cleanKey = str_replace('\n', "\n", $publicKey);
-                    $pubKeyObj = openssl_pkey_get_public($cleanKey);
-                    if (!$pubKeyObj || openssl_verify($msg, hex2bin($sigEd25519), $pubKeyObj, null) !== 1) {
-                        return ['error' => 'Invalid asymmetric federation signature'];
-                    }
-                } catch (\Throwable $e) {
-                    return ['error' => 'Asymmetric signature verification failed'];
+                if (!self::verifyEd25519Signature($msg, $sigEd25519, $config)) {
+                    return ['error' => 'Invalid asymmetric federation signature'];
                 }
             } elseif (!empty($sigHmac)) {
                 $secret = $params['federationSecret'] ?? $config['federationSecret'] ?? self::getPowSecret();
@@ -330,6 +345,51 @@ class ChallengeUtils
             return ['status' => 'synchronized', 'banned' => false, 'reportsCount' => count($reportedPeers)];
         }
 
+        if ($op === 'share_whitelist') {
+            $peers = $config['federatedPeers'] ?? [];
+            if (!empty($peers)) {
+                $allowedHosts = array_map(function ($url) {
+                    // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Fallback for standalone PHP environments
+                    $host = function_exists('wp_parse_url') ? wp_parse_url($url, PHP_URL_HOST) : parse_url($url, PHP_URL_HOST);
+                    return !empty($host) ? $host : $url;
+                }, $peers);
+
+                if (!in_array($clientIp, $allowedHosts, true)) {
+                    return ['error' => 'Unauthorized federation sender IP'];
+                }
+            }
+
+            $entry = $params['entry'] ?? '';
+            $entryType = $params['entry_type'] ?? 'ip';
+            $headers = function_exists('getallheaders') ? array_change_key_case(getallheaders(), CASE_LOWER) : [];
+            $sigEd25519 = $params['signature_ed25519'] ?? $headers['x-federation-signature-ed25519'] ?? self::getSanitizedServerVar('HTTP_X_FEDERATION_SIGNATURE_ED25519', '');
+            $timestamp = (int)($params['timestamp'] ?? $headers['x-federation-timestamp'] ?? self::getSanitizedServerVar('HTTP_X_FEDERATION_TIMESTAMP', 0));
+            $ttl = (int)($params['ttl'] ?? 86400);
+
+            $cleanEntry = trim($entry);
+            if ($cleanEntry === '' || empty($sigEd25519) || empty($timestamp)) {
+                return ['error' => 'Missing required parameters for share_whitelist'];
+            }
+
+            if ($cleanEntry === '*' || $cleanEntry === '0.0.0.0/0' || $cleanEntry === '::/0') {
+                return ['error' => 'Permissive wildcard entries are prohibited'];
+            }
+
+            $now = (int)(microtime(true) * 1000);
+            if (abs($now - $timestamp) > 300000) {
+                return ['error' => 'Timestamp expired or clock skew too high'];
+            }
+
+            $msg = "{$timestamp}:whitelist:{$entryType}:{$cleanEntry}";
+            if (!self::verifyEd25519Signature($msg, $sigEd25519, $config)) {
+                return ['error' => 'Invalid Ed25519 signature for whitelist synchronization'];
+            }
+
+            $boundedTtl = min(604800, max(60, $ttl));
+            $store->set("federated-whitelist:{$entryType}:{$cleanEntry}", true, $boundedTtl);
+            return ['status' => 'whitelist_synchronized', 'entry' => $cleanEntry, 'entryType' => $entryType, 'ttl' => $boundedTtl];
+        }
+
         $nodeId = $params['node_id'] ?? '';
         if (empty($nodeId)) {
             return ['error' => 'Missing node_id'];
@@ -353,19 +413,19 @@ class ChallengeUtils
                 $expectedMsg = "{$clientSecret}:find_peer:{$nodeId}";
                 break;
             case 'webrtc_signal':
-                $expectedMsg = "{$clientSecret}:webrtc_signal:{$nodeId}:" . ($params['target_peer_id'] ?? '') . ":" . ($params['signal_type'] ?? '') . ":" . ($params['signal_data'] ?? '');
+                $expectedMsg = "{$clientSecret}:webrtc_signal:{$nodeId}:" . (isset($params['target_peer_id']) ? self::sanitizeString($params['target_peer_id']) : '') . ":" . (isset($params['signal_type']) ? self::sanitizeString($params['signal_type']) : '') . ":" . (isset($params['signal_data']) ? self::sanitizeString($params['signal_data']) : '');
                 break;
             case 'poll_signals':
                 $expectedMsg = "{$clientSecret}:poll_signals:{$nodeId}";
                 break;
             case 'request_peer_block':
-                $expectedMsg = "{$clientSecret}:request_peer_block:{$nodeId}:" . ($params['peer_id'] ?? '') . ":" . ($params['block_idx'] ?? '0') . ":" . ($params['req_id'] ?? '');
+                $expectedMsg = "{$clientSecret}:request_peer_block:{$nodeId}:" . (isset($params['peer_id']) ? self::sanitizeString($params['peer_id']) : '') . ":" . ($params['block_idx'] ?? '0') . ":" . (isset($params['req_id']) ? self::sanitizeString($params['req_id']) : '');
                 break;
             case 'poll_requests':
                 $expectedMsg = "{$clientSecret}:poll_requests:{$nodeId}";
                 break;
             case 'respond_block':
-                $expectedMsg = "{$clientSecret}:respond_block:{$nodeId}:" . ($params['requester_id'] ?? '') . ":" . ($params['req_id'] ?? '') . ":" . ($params['block_data'] ?? '');
+                $expectedMsg = "{$clientSecret}:respond_block:{$nodeId}:" . (isset($params['requester_id']) ? self::sanitizeString($params['requester_id']) : '') . ":" . (isset($params['req_id']) ? self::sanitizeString($params['req_id']) : '') . ":" . (isset($params['block_data']) ? self::sanitizeString($params['block_data']) : '');
                 break;
             case 'poll_response':
                 $expectedMsg = "{$clientSecret}:poll_response:{$nodeId}:" . ($params['req_id'] ?? '');
@@ -383,7 +443,7 @@ class ChallengeUtils
         switch ($op) {
             case 'register':
                 $clientIp = self::getSanitizedServerVar('REMOTE_ADDR', '127.0.0.1');
-                $seed = $params['seed'] ?? ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+                $seed = isset($params['seed']) ? self::sanitizeString($params['seed']) : '';
                 self::registerCooperativeNode($clientIp, $nodeId, $seed);
                 return ['status' => 'registered'];
 
@@ -395,9 +455,9 @@ class ChallengeUtils
                 return ['status' => 'no_peers'];
 
             case 'webrtc_signal':
-                $targetPeerId = $params['target_peer_id'] ?? '';
-                $signalType = $params['signal_type'] ?? '';
-                $signalData = $params['signal_data'] ?? '';
+                $targetPeerId = isset($params['target_peer_id']) ? self::sanitizeString($params['target_peer_id']) : '';
+                $signalType = isset($params['signal_type']) ? self::sanitizeString($params['signal_type']) : '';
+                $signalData = isset($params['signal_data']) ? self::sanitizeString($params['signal_data']) : '';
                 if (empty($targetPeerId) || empty($signalType) || empty($signalData)) {
                     return ['error' => 'Invalid parameters'];
                 }
@@ -420,9 +480,9 @@ class ChallengeUtils
                 return ['status' => 'ok', 'signals' => $signals];
 
             case 'request_peer_block':
-                $peerId = $params['peer_id'] ?? '';
+                $peerId = isset($params['peer_id']) ? self::sanitizeString($params['peer_id']) : '';
                 $blockIdx = (int)($params['block_idx'] ?? 0);
-                $requestId = $params['req_id'] ?? '';
+                $requestId = isset($params['req_id']) ? self::sanitizeString($params['req_id']) : '';
                 if (empty($peerId) || empty($requestId)) {
                     return ['error' => 'Invalid parameters'];
                 }
@@ -444,9 +504,9 @@ class ChallengeUtils
                 return ['requests' => $requests];
 
             case 'respond_block':
-                $requesterId = $params['requester_id'] ?? '';
-                $requestId = $params['req_id'] ?? '';
-                $blockData = $params['block_data'] ?? '';
+                $requesterId = isset($params['requester_id']) ? self::sanitizeString($params['requester_id']) : '';
+                $requestId = isset($params['req_id']) ? self::sanitizeString($params['req_id']) : '';
+                $blockData = isset($params['block_data']) ? self::sanitizeString($params['block_data']) : '';
                 if (empty($requesterId) || empty($requestId)) {
                     return ['error' => 'Invalid parameters'];
                 }
@@ -456,7 +516,7 @@ class ChallengeUtils
                 return ['status' => 'delivered'];
 
             case 'poll_response':
-                $requestId = $params['req_id'] ?? '';
+                $requestId = isset($params['req_id']) ? self::sanitizeString($params['req_id']) : '';
                 $responseKey = "coop-mailbox:res:{$nodeId}:{$requestId}";
                 $data = $store->get($responseKey);
                 if ($data) {
@@ -634,28 +694,44 @@ class ChallengeUtils
             throw new \RuntimeException("Failed to extract Ed25519 public key.");
         }
 
-        if ($outDir === '') {
-            $outDir = dirname(__DIR__, 2) . '/config';
-        }
-
-        if (!is_dir($outDir)) {
-            if (function_exists('wp_mkdir_p')) {
-                wp_mkdir_p($outDir);
-            } else {
-                mkdir($outDir, 0755, true);
-            }
-        }
-
         $privName = $options['privateKeyName'] ?? 'issuer-private.pem';
         $pubName = $options['publicKeyName'] ?? 'issuer-public.pem';
 
-        $privateKeyPath = rtrim($outDir, '/\\') . '/' . $privName;
-        $publicKeyPath = rtrim($outDir, '/\\') . '/' . $pubName;
+        $privateKeyPath = '';
+        $publicKeyPath = '';
+
+        if ($outDir !== '') {
+            if (!is_dir($outDir)) {
+                if (function_exists('wp_mkdir_p')) {
+                    wp_mkdir_p($outDir);
+                } else {
+                    // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_mkdir -- Standalone filesystem fallback
+                    mkdir($outDir, 0755, true);
+                }
+            }
+            $privateKeyPath = rtrim($outDir, '/\\') . '/' . $privName;
+            $publicKeyPath = rtrim($outDir, '/\\') . '/' . $pubName;
+
+            global $wp_filesystem;
+            if (empty($wp_filesystem) && defined('ABSPATH')) {
+                require_once ABSPATH . 'wp-admin/includes/file.php';
+                WP_Filesystem();
+            }
 
-        file_put_contents($privateKeyPath, $privateKeyPem);
-        @chmod($privateKeyPath, 0600);
-        file_put_contents($publicKeyPath, $publicKeyPem);
-        @chmod($publicKeyPath, 0644);
+            if (!empty($wp_filesystem) && is_object($wp_filesystem)) {
+                $wp_filesystem->put_contents($privateKeyPath, $privateKeyPem, 0600);
+                $wp_filesystem->put_contents($publicKeyPath, $publicKeyPem, 0644);
+            } else {
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- Standalone filesystem fallback
+                file_put_contents($privateKeyPath, $privateKeyPem);
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_chmod -- Standalone filesystem fallback
+                @chmod($privateKeyPath, 0600);
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- Standalone filesystem fallback
+                file_put_contents($publicKeyPath, $publicKeyPem);
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_chmod -- Standalone filesystem fallback
+                @chmod($publicKeyPath, 0644);
+            }
+        }
 
         return [
             'privateKeyPath' => $privateKeyPath,
@@ -1294,20 +1370,25 @@ class ChallengeUtils
      */
     private static function getPowSolverCode(): string
     {
+        if (defined('ANONYMPINS_BOT_MITIGATION_DIR')) {
+            $wpPluginSolver = rtrim(ANONYMPINS_BOT_MITIGATION_DIR, '/\\') . '/assets/pow.solver.inline.js';
+            if (file_exists($wpPluginSolver)) {
+                return (string)file_get_contents($wpPluginSolver);
+            }
+        } elseif (defined('WP_PLUGIN_DIR')) {
+            $wpPluginSolver = WP_PLUGIN_DIR . '/anonympins-bot-mitigation-pow/assets/pow.solver.inline.js';
+            if (file_exists($wpPluginSolver)) {
+                return (string)file_get_contents($wpPluginSolver);
+            }
+        }
+
         $candidates = [
             __DIR__ . '/../../js/pow.solver.inline.js',
             __DIR__ . '/../assets/pow.solver.inline.js',
             __DIR__ . '/../js/pow.solver.inline.js',
-            dirname(__DIR__, 2) . '/assets/pow.solver.inline.js',
-            dirname(__DIR__, 2) . '/js/pow.solver.inline.js',
-            dirname(__DIR__, 1) . '/assets/pow.solver.inline.js',
+            dirname(__DIR__) . '/assets/pow.solver.inline.js',
+            dirname(__DIR__) . '/js/pow.solver.inline.js',
         ];
-        if (defined('ABSPATH')) {
-            $wpPluginSolver = ABSPATH . 'wp-content/plugins/fingerprint-anti-bot/assets/pow.solver.inline.js';
-            if (file_exists($wpPluginSolver)) {
-                return file_get_contents($wpPluginSolver) ?: '';
-            }
-        }
         foreach ($candidates as $solverPath) {
             if (file_exists($solverPath)) {
                 return file_get_contents($solverPath) ?: '';
@@ -1368,7 +1449,7 @@ class ChallengeUtils
             . '}' . "\n"
             . 'solve();';
 
-        return "<html><head><title>Security Check</title></head><body style=\"font-family:sans-serif; text-align:center; padding-top:50px;\"><h1>Security Check (Level 2)</h1><p>We are verifying your storage allocation. This may take a few seconds on first load.</p><div id=\"loader\" style=\"margin:20px;\">⚙️ Initializing storage space...</div><script>{$solverCode}</script><script>{$challengeScript}</script></body></html>";
+        return "<html><head><title>Security check</title></head><body style=\"font-family:sans-serif; text-align:center; padding-top:50px;\"><h1>Security check (level 2)</h1><p>We are verifying your storage allocation. This may take a few seconds on first load.</p><div id=\"loader\" style=\"margin:20px;\">⚙️ Initializing storage space...</div><script>{$solverCode}</script><script>{$challengeScript}</script></body></html>";
     }
 
     /**
@@ -1467,7 +1548,7 @@ class ChallengeUtils
             . '}' . "\n"
             . 'solve();';
 
-        $htmlTemplate = '<html><head><title>Advanced Security Check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced Verification... (Level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script><!-- FINGERPRINT_TRAPS --></body></html>';
+        $htmlTemplate = '<html><head><title>Advanced security check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced verification... (level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script><!-- FINGERPRINT_TRAPS --></body></html>';
         $customTemplatePath = $securityConfig['challengePagePath'] ?? null;
 
         if ($customTemplatePath && file_exists($customTemplatePath)) {
@@ -1493,6 +1574,31 @@ class ChallengeUtils
         error_log($message);
     }
 
+    /**
+     * Safely sanitizes a string input using WordPress functions if available, or fallback PHP functions.
+     *
+     * @param mixed $value
+     * @return string
+     */
+    private static function sanitizeString($value): string
+    {
+        if (!is_scalar($value)) {
+            return '';
+        }
+        $val = (string)$value;
+        if (function_exists('wp_unslash')) {
+            $val = wp_unslash($val);
+        }
+        if (function_exists('sanitize_text_field')) {
+            return sanitize_text_field($val);
+        }
+        if (function_exists('wp_strip_all_tags')) {
+            return trim(wp_strip_all_tags($val));
+        }
+        // phpcs:ignore WordPress.WP.AlternativeFunctions.strip_tags_strip_tags -- Standalone fallback when running outside WordPress
+        return trim(strip_tags($val));
+    }
+
     /**
      * Safely retrieves and sanitizes a value from the $_SERVER superglobal.
      * Uses WordPress functions if available, otherwise falls back to basic PHP sanitization.
@@ -1509,14 +1615,6 @@ class ChallengeUtils
 
         // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Unslashed and sanitized immediately below
         $value = $_SERVER[$key];
-
-        if (function_exists('wp_unslash')) {
-            $value = wp_unslash($value);
-        }
-        if (function_exists('sanitize_text_field')) {
-            return sanitize_text_field($value);
-        }
-
-        return is_scalar($value) ? (string) $value : '';
+        return self::sanitizeString($value);
     }
 }

package/src/php/DirectFingerprint.php

@@ -29,24 +29,44 @@ class DirectFingerprint
      */
     public function buildRequestContext(): RequestContext
     {
+        $sanitizeDeep = function ($data) use (&$sanitizeDeep) {
+            if (is_array($data)) {
+                $clean = [];
+                foreach ($data as $k => $v) {
+                    $cleanKey = is_string($k) ? (function_exists('sanitize_text_field') && function_exists('wp_unslash') ? sanitize_text_field(wp_unslash($k)) : trim((string)$k)) : $k;
+                    $clean[$cleanKey] = $sanitizeDeep($v);
+                }
+                return $clean;
+            }
+            if (is_string($data)) {
+                return function_exists('sanitize_text_field') && function_exists('wp_unslash') ? sanitize_text_field(wp_unslash($data)) : trim($data);
+            }
+            return $data;
+        };
+
+        $rawInput = (string)file_get_contents('php://input');
+        $decodedJson = !empty($rawInput) ? json_decode($rawInput, true) : null;
         // phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.NonceVerification.Recommended -- Direct WAF inspection firewall before WP core logic
-        $body = $_POST ?: json_decode(file_get_contents('php://input'), true);
-        $headers = function_exists('getallheaders') ? getallheaders() : [];
+        $body = !empty($_POST) ? $sanitizeDeep($_POST) : (is_array($decodedJson) ? $sanitizeDeep($decodedJson) : null);
+        $rawHeaders = function_exists('getallheaders') ? getallheaders() : [];
+        $headers = is_array($rawHeaders) ? $sanitizeDeep($rawHeaders) : [];
 
         $remoteAddr = isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '127.0.0.1';
         $rawUri = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '/';
         // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Uses wp_parse_url when available
         $path = function_exists('wp_parse_url') ? (string)wp_parse_url($rawUri, PHP_URL_PATH) : (string)parse_url($rawUri, PHP_URL_PATH);
         $serverProtocol = isset($_SERVER['SERVER_PROTOCOL']) ? sanitize_text_field(wp_unslash($_SERVER['SERVER_PROTOCOL'])) : '1.1';
+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+        $query = isset($_GET) && is_array($_GET) ? $sanitizeDeep($_GET) : [];
+        $cookies = isset($_COOKIE) && is_array($_COOKIE) ? $sanitizeDeep($_COOKIE) : [];
 
         return new RequestContext(
             $remoteAddr,
             !empty($path) ? $path : '/',
             $headers,
-            // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-            $_GET,
+            $query,
             $body,
-            $_COOKIE,
+            $cookies,
             $serverProtocol
         );
     }