123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872 |
- <?php
- namespace app\common\library;
- use Exception;
- class Security
- {
- protected static $instance = null;
-
- public $filename_bad_chars = array(
- '../',
- '<!--',
- '-->',
- '<',
- '>',
- "'",
- '"',
- '&',
- '$',
- '#',
- '{',
- '}',
- '[',
- ']',
- '=',
- ';',
- '?',
- '%20',
- '%22',
- '%3c',
- '%253c',
- '%3e',
- '%0e',
- '%28',
- '%29',
- '%2528',
- '%26',
- '%24',
- '%3f',
- '%3b',
- '%3d'
- );
-
- public $charset = 'UTF-8';
-
- protected $_xss_hash;
-
- protected $_never_allowed_str = array(
- 'document.cookie' => '[removed]',
- '(document).cookie' => '[removed]',
- 'document.write' => '[removed]',
- '(document).write' => '[removed]',
- '.parentNode' => '[removed]',
- '.innerHTML' => '[removed]',
- '-moz-binding' => '[removed]',
- '<!--' => '<!--',
- '-->' => '-->',
- '<![CDATA[' => '<![CDATA[',
- '<comment>' => '<comment>',
- '<%' => '<%'
- );
-
- protected $_never_allowed_regex = array(
- 'javascript\s*:',
- '(\(?document\)?|\(?window\)?(\.document)?)\.(location|on\w*)',
- 'expression\s*(\(|&\#40;)',
- 'vbscript\s*:',
- 'wscript\s*:',
- 'jscript\s*:',
- 'vbs\s*:',
- 'Redirect\s+30\d',
- "([\"'])?data\s*:[^\\1]*?base64[^\\1]*?,[^\\1]*?\\1?"
- );
- protected $options = [
- 'placeholder' => '[removed]'
- ];
-
- public function __construct($options = [])
- {
- $this->options = array_merge($this->options, $options);
- foreach ($this->_never_allowed_str as $index => &$item) {
- $item = str_replace('[removed]', $this->options['placeholder'], $item);
- }
- }
-
- public static function instance($options = [])
- {
- if (is_null(self::$instance)) {
- self::$instance = new static($options);
- }
- return self::$instance;
- }
-
- public function xss_clean($str, $is_image = false)
- {
-
- if (is_array($str)) {
- foreach ($str as $key => &$value) {
- $str[$key] = $this->xss_clean($value);
- }
- return $str;
- }
-
- $str = $this->remove_invisible_characters($str);
-
- if (stripos($str, '%') !== false) {
- do {
- $oldstr = $str;
- $str = rawurldecode($str);
- $str = preg_replace_callback('#%(?:\s*[0-9a-f]){2,}#i', array($this, '_urldecodespaces'), $str);
- } while ($oldstr !== $str);
- unset($oldstr);
- }
-
- $str = preg_replace_callback("/[^a-z0-9>]+[a-z0-9]+=([\'\"]).*?\\1/si", array($this, '_convert_attribute'), $str);
- $str = preg_replace_callback('/<\w+.*/si', array($this, '_decode_entity'), $str);
-
- $str = $this->remove_invisible_characters($str);
-
- $str = str_replace("\t", ' ', $str);
-
- $converted_string = $str;
-
- $str = $this->_do_never_allowed($str);
-
- if ($is_image === true) {
-
-
-
- $str = preg_replace('/<\?(php)/i', '<?\\1', $str);
- } else {
- $str = str_replace(array('<?', '?' . '>'), array('<?', '?>'), $str);
- }
-
- $words = array(
- 'javascript',
- 'expression',
- 'vbscript',
- 'jscript',
- 'wscript',
- 'vbs',
- 'script',
- 'base64',
- 'applet',
- 'alert',
- 'document',
- 'write',
- 'cookie',
- 'window',
- 'confirm',
- 'prompt',
- 'eval'
- );
- foreach ($words as $word) {
- $word = implode('\s*', str_split($word)) . '\s*';
-
-
- $str = preg_replace_callback('#(' . substr($word, 0, -3) . ')(\W)#is', array($this, '_compact_exploded_words'), $str);
- }
-
- do {
- $original = $str;
- if (preg_match('/<a/i', $str)) {
- $str = preg_replace_callback('#<a(?:rea)?[^a-z0-9>]+([^>]*?)(?:>|$)#si', array($this, '_js_link_removal'), $str);
- }
- if (preg_match('/<img/i', $str)) {
- $str = preg_replace_callback('#<img[^a-z0-9]+([^>]*?)(?:\s?/?>|$)#si', array($this, '_js_img_removal'), $str);
- }
- if (preg_match('/script|xss/i', $str)) {
- $str = preg_replace('#</*(?:script|xss).*?>#si', $this->options['placeholder'], $str);
- }
- } while ($original !== $str);
- unset($original);
-
- $pattern = '#'
- . '<((?<slash>/*\s*)((?<tagName>[a-z0-9]+)(?=[^a-z0-9]|$)|.+)'
- . '[^\s\042\047a-z0-9>/=]*'
-
- . '(?<attributes>(?:[\s\042\047/=]*'
- . '[^\s\042\047>/=]+'
-
- . '(?:\s*='
- . '(?:[^\s\042\047=><`]+|\s*\042[^\042]*\042|\s*\047[^\047]*\047|\s*(?U:[^\s\042\047=><`]*))'
- . ')?'
- . ')*)'
- . '[^>]*)(?<closeTag>\>)?#isS';
-
-
-
- do {
- $old_str = $str;
- $str = preg_replace_callback($pattern, array($this, '_sanitize_naughty_html'), $str);
- } while ($old_str !== $str);
- unset($old_str);
-
- $str = preg_replace(
- '#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si',
- '\\1\\2(\\3)',
- $str
- );
-
- $str = preg_replace(
- '#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)`(.*?)`#si',
- '\\1\\2`\\3`',
- $str
- );
-
-
-
- $str = $this->_do_never_allowed($str);
-
- if ($is_image === true) {
- return ($str === $converted_string);
- }
- return $str;
- }
-
-
- public function xss_hash()
- {
- if ($this->_xss_hash === null) {
- $rand = $this->get_random_bytes(16);
- $this->_xss_hash = ($rand === false)
- ? md5(uniqid(mt_rand(), true))
- : bin2hex($rand);
- }
- return $this->_xss_hash;
- }
-
-
- public function get_random_bytes($length)
- {
- if (empty($length) or !ctype_digit((string)$length)) {
- return false;
- }
- if (function_exists('random_bytes')) {
- try {
-
- return random_bytes((int)$length);
- } catch (Exception $e) {
-
-
- return false;
- }
- }
-
- if (defined('MCRYPT_DEV_URANDOM') && ($output = mcrypt_create_iv($length, MCRYPT_DEV_URANDOM)) !== false) {
- return $output;
- }
- if (is_readable('/dev/urandom') && ($fp = fopen('/dev/urandom', 'rb')) !== false) {
-
- stream_set_chunk_size($fp, $length);
- $output = fread($fp, $length);
- fclose($fp);
- if ($output !== false) {
- return $output;
- }
- }
- if (function_exists('openssl_random_pseudo_bytes')) {
- return openssl_random_pseudo_bytes($length);
- }
- return false;
- }
-
-
- public function entity_decode($str, $charset = null)
- {
- if (strpos($str, '&') === false) {
- return $str;
- }
- static $_entities;
- isset($charset) or $charset = $this->charset;
- isset($_entities) or $_entities = array_map('strtolower', get_html_translation_table(HTML_ENTITIES, ENT_COMPAT | ENT_HTML5, $charset));
- do {
- $str_compare = $str;
-
- if (preg_match_all('/&[a-z]{2,}(?![a-z;])/i', $str, $matches)) {
- $replace = array();
- $matches = array_unique(array_map('strtolower', $matches[0]));
- foreach ($matches as &$match) {
- if (($char = array_search($match . ';', $_entities, true)) !== false) {
- $replace[$match] = $char;
- }
- }
- $str = str_replace(array_keys($replace), array_values($replace), $str);
- }
-
- $str = html_entity_decode(
- preg_replace('/(&#(?:x0*[0-9a-f]{2,5}(?![0-9a-f;])|(?:0*\d{2,4}(?![0-9;]))))/iS', '$1;', $str),
- ENT_COMPAT | ENT_HTML5,
- $charset
- );
- } while ($str_compare !== $str);
- return $str;
- }
-
-
- public function sanitize_filename($str, $relative_path = false)
- {
- $bad = $this->filename_bad_chars;
- if (!$relative_path) {
- $bad[] = './';
- $bad[] = '/';
- }
- $str = $this->remove_invisible_characters($str, false);
- do {
- $old = $str;
- $str = str_replace($bad, '', $str);
- } while ($old !== $str);
- return stripslashes($str);
- }
-
-
- public function strip_image_tags($str)
- {
- return preg_replace(
- array(
- '#<img[\s/]+.*?src\s*=\s*(["\'])([^\\1]+?)\\1.*?\>#i',
- '#<img[\s/]+.*?src\s*=\s*?(([^\s"\'=<>`]+)).*?\>#i'
- ),
- '\\2',
- $str
- );
- }
-
-
- protected function _urldecodespaces($matches)
- {
- $input = $matches[0];
- $nospaces = preg_replace('#\s+#', '', $input);
- return ($nospaces === $input)
- ? $input
- : rawurldecode($nospaces);
- }
-
-
- protected function _compact_exploded_words($matches)
- {
- return preg_replace('/\s+/s', '', $matches[1]) . $matches[2];
- }
-
-
- protected function _sanitize_naughty_html($matches)
- {
- static $naughty_tags = array(
- 'alert',
- 'area',
- 'prompt',
- 'confirm',
- 'applet',
- 'audio',
- 'basefont',
- 'base',
- 'behavior',
- 'bgsound',
- 'blink',
- 'body',
- 'embed',
- 'expression',
- 'form',
- 'frameset',
- 'frame',
- 'head',
- 'html',
- 'ilayer',
- 'iframe',
- 'input',
- 'button',
- 'select',
- 'isindex',
- 'layer',
- 'link',
- 'meta',
- 'keygen',
- 'object',
- 'plaintext',
- 'style',
- 'script',
- 'textarea',
- 'title',
- 'math',
- 'video',
- 'svg',
- 'xml',
- 'xss'
- );
- static $evil_attributes = array(
- 'on\w+',
- 'style',
- 'xmlns',
- 'formaction',
- 'form',
- 'xlink:href',
- 'FSCommand',
- 'seekSegmentTime'
- );
-
- if (empty($matches['closeTag'])) {
- return '<' . $matches[1];
- }
- elseif (in_array(strtolower($matches['tagName']), $naughty_tags, true)) {
- return '<' . $matches[1] . '>';
- }
- elseif (isset($matches['attributes'])) {
-
- $attributes = array();
-
- $attributes_pattern = '#'
- . '(?<name>[^\s\042\047>/=]+)'
-
- . '(?:\s*=(?<value>[^\s\042\047=><`]+|\s*\042[^\042]*\042|\s*\047[^\047]*\047|\s*(?U:[^\s\042\047=><`]*)))'
- . '#i';
-
- $is_evil_pattern = '#^(' . implode('|', $evil_attributes) . ')$#i';
-
- do {
-
-
-
- $matches['attributes'] = preg_replace('#^[^a-z]+#i', '', $matches['attributes']);
- if (!preg_match($attributes_pattern, $matches['attributes'], $attribute, PREG_OFFSET_CAPTURE)) {
-
- break;
- }
- if (
-
- preg_match($is_evil_pattern, $attribute['name'][0])
-
- or (trim($attribute['value'][0]) === '')
- ) {
- $attributes[] = 'xss=removed';
- } else {
- $attributes[] = $attribute[0][0];
- }
- $matches['attributes'] = substr($matches['attributes'], $attribute[0][1] + strlen($attribute[0][0]));
- } while ($matches['attributes'] !== '');
- $attributes = empty($attributes)
- ? ''
- : ' ' . implode(' ', $attributes);
- return '<' . $matches['slash'] . $matches['tagName'] . $attributes . '>';
- }
- return $matches[0];
- }
-
-
- protected function _js_link_removal($match)
- {
- return str_replace(
- $match[1],
- preg_replace(
- '#href=.*?(?:(?:alert|prompt|confirm)(?:\(|&\#40;|`|&\#96;)|javascript:|livescript:|mocha:|charset=|window\.|\(?document\)?\.|\.cookie|<script|<xss|d\s*a\s*t\s*a\s*:)#si',
- '',
- $this->_filter_attributes($match[1])
- ),
- $match[0]
- );
- }
-
-
- protected function _js_img_removal($match)
- {
- return str_replace(
- $match[1],
- preg_replace(
- '#src=.*?(?:(?:alert|prompt|confirm|eval)(?:\(|&\#40;|`|&\#96;)|javascript:|livescript:|mocha:|charset=|window\.|\(?document\)?\.|\.cookie|<script|<xss|base64\s*,)#si',
- '',
- $this->_filter_attributes($match[1])
- ),
- $match[0]
- );
- }
-
-
- protected function _convert_attribute($match)
- {
- return str_replace(array('>', '<', '\\'), array('>', '<', '\\\\'), $match[0]);
- }
-
-
- protected function _filter_attributes($str)
- {
- $out = '';
- if (preg_match_all('#\s*[a-z\-]+\s*=\s*(\042|\047)([^\\1]*?)\\1#is', $str, $matches)) {
- foreach ($matches[0] as $match) {
- $out .= preg_replace('#/\*.*?\*/#s', '', $match);
- }
- }
- return $out;
- }
-
-
- protected function _decode_entity($match)
- {
-
-
- $match = preg_replace('|\&([a-z\_0-9\-]+)\=([a-z\_0-9\-/]+)|i', $this->xss_hash() . '\\1=\\2', $match[0]);
-
- return str_replace(
- $this->xss_hash(),
- '&',
- $this->entity_decode($match, $this->charset)
- );
- }
-
-
- protected function _do_never_allowed($str)
- {
- $str = str_replace(array_keys($this->_never_allowed_str), $this->_never_allowed_str, $str);
- foreach ($this->_never_allowed_regex as $regex) {
- $str = preg_replace('#' . $regex . '#is', $this->options['placeholder'], $str);
- }
- return $str;
- }
-
- public function remove_invisible_characters($str, $url_encoded = true)
- {
- $non_displayables = array();
-
-
- if ($url_encoded) {
- $non_displayables[] = '/%0[0-8bcef]/i';
- $non_displayables[] = '/%1[0-9a-f]/i';
- $non_displayables[] = '/%7f/i';
- }
- $non_displayables[] = '/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S';
- do {
- $str = preg_replace($non_displayables, '', $str, -1, $count);
- } while ($count);
- return $str;
- }
- }
|