Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 1 | <?php if ( ! defined('BASEPATH')) exit('No direct script access allowed'); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 2 | /** |
| 3 | * CodeIgniter |
| 4 | * |
Greg Aker | 741de1c | 2010-11-10 14:52:57 -0600 | [diff] [blame] | 5 | * An open source application development framework for PHP 5.1.6 or newer |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 6 | * |
Derek Jones | f4a4bd8 | 2011-10-20 12:18:42 -0500 | [diff] [blame] | 7 | * NOTICE OF LICENSE |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 8 | * |
Derek Jones | f4a4bd8 | 2011-10-20 12:18:42 -0500 | [diff] [blame] | 9 | * Licensed under the Open Software License version 3.0 |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 10 | * |
Derek Jones | f4a4bd8 | 2011-10-20 12:18:42 -0500 | [diff] [blame] | 11 | * This source file is subject to the Open Software License (OSL 3.0) that is |
| 12 | * bundled with this package in the files license.txt / license.rst. It is |
| 13 | * also available through the world wide web at this URL: |
| 14 | * http://opensource.org/licenses/OSL-3.0 |
| 15 | * If you did not receive a copy of the license and are unable to obtain it |
| 16 | * through the world wide web, please send an email to |
| 17 | * licensing@ellislab.com so we can send you a copy immediately. |
| 18 | * |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 19 | * @package CodeIgniter |
Derek Jones | f4a4bd8 | 2011-10-20 12:18:42 -0500 | [diff] [blame] | 20 | * @author EllisLab Dev Team |
Greg Aker | 0defe5d | 2012-01-01 18:46:41 -0600 | [diff] [blame] | 21 | * @copyright Copyright (c) 2008 - 2012, EllisLab, Inc. (http://ellislab.com/) |
Derek Jones | f4a4bd8 | 2011-10-20 12:18:42 -0500 | [diff] [blame] | 22 | * @license http://opensource.org/licenses/OSL-3.0 Open Software License (OSL 3.0) |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 23 | * @link http://codeigniter.com |
| 24 | * @since Version 1.0 |
| 25 | * @filesource |
| 26 | */ |
| 27 | |
| 28 | // ------------------------------------------------------------------------ |
| 29 | |
| 30 | /** |
| 31 | * Security Class |
| 32 | * |
| 33 | * @package CodeIgniter |
| 34 | * @subpackage Libraries |
| 35 | * @category Security |
Derek Jones | f4a4bd8 | 2011-10-20 12:18:42 -0500 | [diff] [blame] | 36 | * @author EllisLab Dev Team |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 37 | * @link http://codeigniter.com/user_guide/libraries/security.html |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 38 | */ |
| 39 | class CI_Security { |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 40 | |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 41 | /** |
| 42 | * Random Hash for protecting URLs |
| 43 | * |
| 44 | * @var string |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 45 | */ |
| 46 | protected $_xss_hash = ''; |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 47 | |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 48 | /** |
| 49 | * Random Hash for Cross Site Request Forgery Protection Cookie |
| 50 | * |
| 51 | * @var string |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 52 | */ |
| 53 | protected $_csrf_hash = ''; |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 54 | |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 55 | /** |
| 56 | * Expiration time for Cross Site Request Forgery Protection Cookie |
| 57 | * Defaults to two hours (in seconds) |
| 58 | * |
| 59 | * @var int |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 60 | */ |
| 61 | protected $_csrf_expire = 7200; |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 62 | |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 63 | /** |
| 64 | * Token name for Cross Site Request Forgery Protection Cookie |
| 65 | * |
| 66 | * @var string |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 67 | */ |
| 68 | protected $_csrf_token_name = 'ci_csrf_token'; |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 69 | |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 70 | /** |
| 71 | * Cookie name for Cross Site Request Forgery Protection Cookie |
| 72 | * |
| 73 | * @var string |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 74 | */ |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 75 | protected $_csrf_cookie_name = 'ci_csrf_token'; |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 76 | |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 77 | /** |
| 78 | * List of never allowed strings |
| 79 | * |
| 80 | * @var array |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 81 | */ |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 82 | protected $_never_allowed_str = array( |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 83 | 'document.cookie' => '[removed]', |
| 84 | 'document.write' => '[removed]', |
| 85 | '.parentNode' => '[removed]', |
| 86 | '.innerHTML' => '[removed]', |
| 87 | 'window.location' => '[removed]', |
| 88 | '-moz-binding' => '[removed]', |
| 89 | '<!--' => '<!--', |
| 90 | '-->' => '-->', |
| 91 | '<![CDATA[' => '<![CDATA[', |
| 92 | '<comment>' => '<comment>' |
| 93 | ); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 94 | |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 95 | /** |
| 96 | * List of never allowed regex replacement |
| 97 | * |
| 98 | * @var array |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 99 | */ |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 100 | protected $_never_allowed_regex = array( |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 101 | 'javascript\s*:', |
| 102 | 'expression\s*(\(|&\#40;)', // CSS and IE |
| 103 | 'vbscript\s*:', // IE, surprise! |
| 104 | 'Redirect\s+302' |
| 105 | ); |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 106 | |
Greg Aker | a926328 | 2010-11-10 15:26:43 -0600 | [diff] [blame] | 107 | public function __construct() |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 108 | { |
patwork | ef1a55a | 2011-04-09 13:04:06 +0200 | [diff] [blame] | 109 | // CSRF config |
| 110 | foreach(array('csrf_expire', 'csrf_token_name', 'csrf_cookie_name') as $key) |
| 111 | { |
| 112 | if (FALSE !== ($val = config_item($key))) |
| 113 | { |
| 114 | $this->{'_'.$key} = $val; |
| 115 | } |
| 116 | } |
| 117 | |
patwork | 9e26798 | 2011-04-11 13:02:32 +0200 | [diff] [blame] | 118 | // Append application specific cookie prefix |
Greg Aker | b3e614d | 2011-04-19 20:19:17 -0500 | [diff] [blame] | 119 | if (config_item('cookie_prefix')) |
| 120 | { |
patwork | 9e26798 | 2011-04-11 13:02:32 +0200 | [diff] [blame] | 121 | $this->_csrf_cookie_name = config_item('cookie_prefix').$this->_csrf_cookie_name; |
| 122 | } |
Derek Jones | b3f10a2 | 2010-07-25 19:11:26 -0500 | [diff] [blame] | 123 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 124 | // Set the CSRF hash |
| 125 | $this->_csrf_set_hash(); |
Derek Allard | 958543a | 2010-07-22 14:10:26 -0400 | [diff] [blame] | 126 | |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 127 | log_message('debug', 'Security Class Initialized'); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 128 | } |
| 129 | |
| 130 | // -------------------------------------------------------------------- |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 131 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 132 | /** |
| 133 | * Verify Cross Site Request Forgery Protection |
| 134 | * |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 135 | * @return object |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 136 | */ |
Eric Barnes | 9805ecc | 2011-01-16 23:35:16 -0500 | [diff] [blame] | 137 | public function csrf_verify() |
Derek Allard | 958543a | 2010-07-22 14:10:26 -0400 | [diff] [blame] | 138 | { |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 139 | // If no POST data exists we will set the CSRF cookie |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 140 | if (count($_POST) === 0) |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 141 | { |
| 142 | return $this->csrf_set_cookie(); |
| 143 | } |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 144 | |
Alex Bilbie | aeb2c3e | 2011-08-21 16:14:54 +0100 | [diff] [blame] | 145 | // Check if URI has been whitelisted from CSRF checks |
| 146 | if ($exclude_uris = config_item('csrf_exclude_uris')) |
| 147 | { |
| 148 | $uri = load_class('URI', 'core'); |
| 149 | if (in_array($uri->uri_string(), $exclude_uris)) |
| 150 | { |
| 151 | return $this; |
| 152 | } |
| 153 | } |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 154 | |
| 155 | // Do the tokens exist in both the _POST and _COOKIE arrays? |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 156 | if ( ! isset($_POST[$this->_csrf_token_name]) OR |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 157 | ! isset($_COOKIE[$this->_csrf_cookie_name])) |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 158 | { |
| 159 | $this->csrf_show_error(); |
| 160 | } |
| 161 | |
| 162 | // Do the tokens match? |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 163 | if ($_POST[$this->_csrf_token_name] != $_COOKIE[$this->_csrf_cookie_name]) |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 164 | { |
| 165 | $this->csrf_show_error(); |
| 166 | } |
| 167 | |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 168 | // We kill this since we're done and we don't want to |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 169 | // polute the _POST array |
| 170 | unset($_POST[$this->_csrf_token_name]); |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 171 | |
Derek Jones | b3f10a2 | 2010-07-25 19:11:26 -0500 | [diff] [blame] | 172 | // Nothing should last forever |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 173 | unset($_COOKIE[$this->_csrf_cookie_name]); |
Greg Aker | 03abee3 | 2011-12-25 00:31:29 -0600 | [diff] [blame] | 174 | $this->_csrf_hash = ''; |
Derek Jones | b3f10a2 | 2010-07-25 19:11:26 -0500 | [diff] [blame] | 175 | $this->_csrf_set_hash(); |
| 176 | $this->csrf_set_cookie(); |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 177 | |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 178 | log_message('debug', 'CSRF token verified'); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 179 | return $this; |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 180 | } |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 181 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 182 | // -------------------------------------------------------------------- |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 183 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 184 | /** |
| 185 | * Set Cross Site Request Forgery Protection Cookie |
| 186 | * |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 187 | * @return object |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 188 | */ |
Eric Barnes | 9805ecc | 2011-01-16 23:35:16 -0500 | [diff] [blame] | 189 | public function csrf_set_cookie() |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 190 | { |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 191 | $expire = time() + $this->_csrf_expire; |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 192 | $secure_cookie = (bool) config_item('cookie_secure'); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 193 | |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 194 | if ($secure_cookie && ( ! isset($_SERVER['HTTPS']) OR $_SERVER['HTTPS'] == 'off' OR ! $_SERVER['HTTPS'])) |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 195 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 196 | return FALSE; |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 197 | } |
Derek Allard | 958543a | 2010-07-22 14:10:26 -0400 | [diff] [blame] | 198 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 199 | setcookie($this->_csrf_cookie_name, $this->_csrf_hash, $expire, config_item('cookie_path'), config_item('cookie_domain'), $secure_cookie); |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 200 | log_message('debug', 'CRSF cookie Set'); |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 201 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 202 | return $this; |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 203 | } |
| 204 | |
| 205 | // -------------------------------------------------------------------- |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 206 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 207 | /** |
| 208 | * Show CSRF Error |
| 209 | * |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 210 | * @return void |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 211 | */ |
Eric Barnes | 9805ecc | 2011-01-16 23:35:16 -0500 | [diff] [blame] | 212 | public function csrf_show_error() |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 213 | { |
| 214 | show_error('The action you have requested is not allowed.'); |
| 215 | } |
| 216 | |
| 217 | // -------------------------------------------------------------------- |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 218 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 219 | /** |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 220 | * Get CSRF Hash |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 221 | * |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 222 | * Getter Method |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 223 | * |
| 224 | * @return string self::_csrf_hash |
| 225 | */ |
| 226 | public function get_csrf_hash() |
| 227 | { |
| 228 | return $this->_csrf_hash; |
| 229 | } |
| 230 | |
| 231 | // -------------------------------------------------------------------- |
| 232 | |
| 233 | /** |
| 234 | * Get CSRF Token Name |
| 235 | * |
| 236 | * Getter Method |
| 237 | * |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 238 | * @return string self::_csrf_token_name |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 239 | */ |
| 240 | public function get_csrf_token_name() |
| 241 | { |
| 242 | return $this->_csrf_token_name; |
| 243 | } |
| 244 | |
| 245 | // -------------------------------------------------------------------- |
| 246 | |
| 247 | /** |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 248 | * XSS Clean |
| 249 | * |
| 250 | * Sanitizes data so that Cross Site Scripting Hacks can be |
Derek Jones | 37f4b9c | 2011-07-01 17:56:50 -0500 | [diff] [blame] | 251 | * prevented. This function does a fair amount of work but |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 252 | * it is extremely thorough, designed to prevent even the |
Derek Jones | 37f4b9c | 2011-07-01 17:56:50 -0500 | [diff] [blame] | 253 | * most obscure XSS attempts. Nothing is ever 100% foolproof, |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 254 | * of course, but I haven't been able to get anything passed |
| 255 | * the filter. |
| 256 | * |
| 257 | * Note: This function should only be used to deal with data |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 258 | * upon submission. It's not something that should |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 259 | * be used for general runtime processing. |
| 260 | * |
| 261 | * This function was based in part on some code and ideas I |
| 262 | * got from Bitflux: http://channel.bitflux.ch/wiki/XSS_Prevention |
| 263 | * |
| 264 | * To help develop this script I used this great list of |
| 265 | * vulnerabilities along with a few other hacks I've |
| 266 | * harvested from examining vulnerabilities in other programs: |
| 267 | * http://ha.ckers.org/xss.html |
| 268 | * |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 269 | * @param mixed string or array |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 270 | * @param bool |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 271 | * @return string |
| 272 | */ |
Eric Barnes | 9805ecc | 2011-01-16 23:35:16 -0500 | [diff] [blame] | 273 | public function xss_clean($str, $is_image = FALSE) |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 274 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 275 | // Is the string an array? |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 276 | if (is_array($str)) |
| 277 | { |
| 278 | while (list($key) = each($str)) |
| 279 | { |
| 280 | $str[$key] = $this->xss_clean($str[$key]); |
| 281 | } |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 282 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 283 | return $str; |
| 284 | } |
| 285 | |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 286 | // Remove Invisible Characters and validate entities in URLs |
| 287 | $str = $this->_validate_entities(remove_invisible_characters($str)); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 288 | |
| 289 | /* |
| 290 | * URL Decode |
| 291 | * |
| 292 | * Just in case stuff like this is submitted: |
| 293 | * |
| 294 | * <a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">Google</a> |
| 295 | * |
| 296 | * Note: Use rawurldecode() so it does not remove plus signs |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 297 | */ |
| 298 | $str = rawurldecode($str); |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 299 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 300 | /* |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 301 | * Convert character entities to ASCII |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 302 | * |
| 303 | * This permits our tests below to work reliably. |
| 304 | * We only convert entities that are within tags since |
| 305 | * these are the ones that will pose security problems. |
| 306 | * |
| 307 | */ |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 308 | $str = preg_replace_callback("/[a-z]+=([\'\"]).*?\\1/si", array($this, '_convert_attribute'), $str); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 309 | $str = preg_replace_callback("/<\w+.*?(?=>|<|$)/si", array($this, '_decode_entity'), $str); |
| 310 | |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 311 | // Remove Invisible Characters Again! |
Greg Aker | 757dda6 | 2010-04-14 19:06:19 -0500 | [diff] [blame] | 312 | $str = remove_invisible_characters($str); |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 313 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 314 | /* |
| 315 | * Convert all tabs to spaces |
| 316 | * |
| 317 | * This prevents strings like this: ja vascript |
| 318 | * NOTE: we deal with spaces between characters later. |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 319 | * NOTE: preg_replace was found to be amazingly slow here on |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 320 | * large blocks of data, so we use str_replace. |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 321 | */ |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 322 | $str = str_replace("\t", ' ', $str); |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 323 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 324 | /* |
| 325 | * Capture converted string for later comparison |
| 326 | */ |
| 327 | $converted_string = $str; |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 328 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 329 | // Remove Strings that are never allowed |
| 330 | $str = $this->_do_never_allowed($str); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 331 | |
| 332 | /* |
| 333 | * Makes PHP tags safe |
| 334 | * |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 335 | * Note: XML tags are inadvertently replaced too: |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 336 | * |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 337 | * <?xml |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 338 | * |
| 339 | * But it doesn't seem to pose a problem. |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 340 | */ |
| 341 | if ($is_image === TRUE) |
| 342 | { |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 343 | // Images have a tendency to have the PHP short opening and |
| 344 | // closing tags every so often so we skip those and only |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 345 | // do the long opening tags. |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 346 | $str = preg_replace('/<\?(php)/i', '<?\\1', $str); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 347 | } |
| 348 | else |
| 349 | { |
Derek Jones | 37f4b9c | 2011-07-01 17:56:50 -0500 | [diff] [blame] | 350 | $str = str_replace(array('<?', '?'.'>'), array('<?', '?>'), $str); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 351 | } |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 352 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 353 | /* |
| 354 | * Compact any exploded words |
| 355 | * |
Derek Jones | 37f4b9c | 2011-07-01 17:56:50 -0500 | [diff] [blame] | 356 | * This corrects words like: j a v a s c r i p t |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 357 | * These words are compacted back to their correct state. |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 358 | */ |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 359 | $words = array( |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 360 | 'javascript', 'expression', 'vbscript', 'script', |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 361 | 'applet', 'alert', 'document', 'write', 'cookie', 'window' |
| 362 | ); |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 363 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 364 | foreach ($words as $word) |
| 365 | { |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 366 | $word = implode("\s*", str_split($word)) . "\s*"; |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 367 | |
| 368 | // We only want to do this when it is followed by a non-word character |
| 369 | // That way valid stuff like "dealer to" does not become "dealerto" |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 370 | $str = preg_replace_callback('#('.substr($word, 0, -3).')(\W)#is', array($this, '_compact_exploded_words'), $str); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 371 | } |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 372 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 373 | /* |
| 374 | * Remove disallowed Javascript in links or img tags |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 375 | * We used to do some version comparisons and use of stripos for PHP5, |
| 376 | * but it is dog slow compared to these simplified non-capturing |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 377 | * preg_match(), especially if the pattern exists in the string |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 378 | */ |
| 379 | do |
| 380 | { |
| 381 | $original = $str; |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 382 | |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 383 | if (preg_match('/<a/i', $str)) |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 384 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 385 | $str = preg_replace_callback('#<a\s+([^>]*?)(>|$)#si', array($this, '_js_link_removal'), $str); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 386 | } |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 387 | |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 388 | if (preg_match('/<img/i', $str)) |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 389 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 390 | $str = preg_replace_callback('#<img\s+([^>]*?)(\s?/?>|$)#si', array($this, '_js_img_removal'), $str); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 391 | } |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 392 | |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 393 | if (preg_match('/(script|xss)/i', $str)) |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 394 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 395 | $str = preg_replace('#<(/*)(script|xss)(.*?)\>#si', '[removed]', $str); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 396 | } |
| 397 | } |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 398 | while($original != $str); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 399 | |
| 400 | unset($original); |
| 401 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 402 | // Remove evil attributes such as style, onclick and xmlns |
| 403 | $str = $this->_remove_evil_attributes($str, $is_image); |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 404 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 405 | /* |
| 406 | * Sanitize naughty HTML elements |
| 407 | * |
| 408 | * If a tag containing any of the words in the list |
| 409 | * below is found, the tag gets converted to entities. |
| 410 | * |
| 411 | * So this: <blink> |
| 412 | * Becomes: <blink> |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 413 | */ |
| 414 | $naughty = 'alert|applet|audio|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|isindex|layer|link|meta|object|plaintext|style|script|textarea|title|video|xml|xss'; |
| 415 | $str = preg_replace_callback('#<(/*\s*)('.$naughty.')([^><]*)([><]*)#is', array($this, '_sanitize_naughty_html'), $str); |
| 416 | |
| 417 | /* |
| 418 | * Sanitize naughty scripting elements |
| 419 | * |
| 420 | * Similar to above, only instead of looking for |
| 421 | * tags it looks for PHP and JavaScript commands |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 422 | * that are disallowed. Rather than removing the |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 423 | * code, it simply converts the parenthesis to entities |
| 424 | * rendering the code un-executable. |
| 425 | * |
| 426 | * For example: eval('some code') |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 427 | * Becomes: eval('some code') |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 428 | */ |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 429 | $str = preg_replace('#(alert|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si', |
| 430 | '\\1\\2(\\3)', |
| 431 | $str); |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 432 | |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 433 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 434 | // Final clean up |
| 435 | // This adds a bit of extra precaution in case |
| 436 | // something got through the above filters |
| 437 | $str = $this->_do_never_allowed($str); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 438 | |
| 439 | /* |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 440 | * Images are Handled in a Special Way |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 441 | * - Essentially, we want to know that after all of the character |
| 442 | * conversion is done whether any unwanted, likely XSS, code was found. |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 443 | * If not, we return TRUE, as the image is clean. |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 444 | * However, if the string post-conversion does not matched the |
| 445 | * string post-removal of XSS, then it fails, as there was unwanted XSS |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 446 | * code found and removed/changed during processing. |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 447 | */ |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 448 | if ($is_image === TRUE) |
| 449 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 450 | return ($str === $converted_string); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 451 | } |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 452 | |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 453 | log_message('debug', 'XSS Filtering completed'); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 454 | return $str; |
| 455 | } |
| 456 | |
| 457 | // -------------------------------------------------------------------- |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 458 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 459 | /** |
| 460 | * Random Hash for protecting URLs |
| 461 | * |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 462 | * @return string |
| 463 | */ |
Eric Barnes | 9805ecc | 2011-01-16 23:35:16 -0500 | [diff] [blame] | 464 | public function xss_hash() |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 465 | { |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 466 | if ($this->_xss_hash == '') |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 467 | { |
Pascal Kriete | c38e3b6 | 2011-11-14 13:55:00 -0500 | [diff] [blame] | 468 | mt_srand(); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 469 | $this->_xss_hash = md5(time() + mt_rand(0, 1999999999)); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 470 | } |
| 471 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 472 | return $this->_xss_hash; |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 473 | } |
| 474 | |
| 475 | // -------------------------------------------------------------------- |
| 476 | |
| 477 | /** |
Derek Jones | a091147 | 2010-03-30 10:33:09 -0500 | [diff] [blame] | 478 | * HTML Entities Decode |
| 479 | * |
| 480 | * This function is a replacement for html_entity_decode() |
| 481 | * |
Pascal Kriete | c38e3b6 | 2011-11-14 13:55:00 -0500 | [diff] [blame] | 482 | * The reason we are not using html_entity_decode() by itself is because |
| 483 | * while it is not technically correct to leave out the semicolon |
| 484 | * at the end of an entity most browsers will still interpret the entity |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 485 | * correctly. html_entity_decode() does not convert entities without |
Pascal Kriete | c38e3b6 | 2011-11-14 13:55:00 -0500 | [diff] [blame] | 486 | * semicolons, so we are left with our own little solution here. Bummer. |
Derek Jones | a091147 | 2010-03-30 10:33:09 -0500 | [diff] [blame] | 487 | * |
Derek Jones | a091147 | 2010-03-30 10:33:09 -0500 | [diff] [blame] | 488 | * @param string |
| 489 | * @param string |
| 490 | * @return string |
| 491 | */ |
freewil | 8cc0cfe | 2011-08-27 21:53:00 -0400 | [diff] [blame] | 492 | public function entity_decode($str, $charset = NULL) |
Derek Jones | a091147 | 2010-03-30 10:33:09 -0500 | [diff] [blame] | 493 | { |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 494 | if (strpos($str, '&') === FALSE) |
freewil | 5c9b0d1 | 2011-08-28 12:15:23 -0400 | [diff] [blame] | 495 | { |
| 496 | return $str; |
| 497 | } |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 498 | |
freewil | 5c9b0d1 | 2011-08-28 12:15:23 -0400 | [diff] [blame] | 499 | if (empty($charset)) |
| 500 | { |
| 501 | $charset = config_item('charset'); |
| 502 | } |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 503 | |
Andrey Andreev | 3d113bd | 2011-10-05 00:03:20 +0300 | [diff] [blame] | 504 | $str = html_entity_decode($str, ENT_COMPAT, $charset); |
| 505 | $str = preg_replace('~&#x(0*[0-9a-f]{2,5})~ei', 'chr(hexdec("\\1"))', $str); |
| 506 | return preg_replace('~&#([0-9]{2,4})~e', 'chr(\\1)', $str); |
Derek Jones | a091147 | 2010-03-30 10:33:09 -0500 | [diff] [blame] | 507 | } |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 508 | |
Derek Jones | a091147 | 2010-03-30 10:33:09 -0500 | [diff] [blame] | 509 | // -------------------------------------------------------------------- |
Barry Mieny | dd67197 | 2010-10-04 16:33:58 +0200 | [diff] [blame] | 510 | |
Derek Jones | a091147 | 2010-03-30 10:33:09 -0500 | [diff] [blame] | 511 | /** |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 512 | * Filename Security |
| 513 | * |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 514 | * @param string |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 515 | * @param bool |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 516 | * @return string |
| 517 | */ |
Eric Barnes | 9805ecc | 2011-01-16 23:35:16 -0500 | [diff] [blame] | 518 | public function sanitize_filename($str, $relative_path = FALSE) |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 519 | { |
| 520 | $bad = array( |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 521 | '../', '<!--', '-->', '<', '>', |
| 522 | "'", '"', '&', '$', '#', |
| 523 | '{', '}', '[', ']', '=', |
| 524 | ';', '?', '%20', '%22', |
| 525 | '%3c', // < |
| 526 | '%253c', // < |
| 527 | '%3e', // > |
| 528 | '%0e', // > |
| 529 | '%28', // ( |
| 530 | '%29', // ) |
| 531 | '%2528', // ( |
| 532 | '%26', // & |
| 533 | '%24', // $ |
| 534 | '%3f', // ? |
| 535 | '%3b', // ; |
| 536 | '%3d' // = |
| 537 | ); |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 538 | |
Derek Jones | 2ef3759 | 2010-10-06 17:51:59 -0500 | [diff] [blame] | 539 | if ( ! $relative_path) |
| 540 | { |
| 541 | $bad[] = './'; |
| 542 | $bad[] = '/'; |
| 543 | } |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 544 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 545 | $str = remove_invisible_characters($str, FALSE); |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 546 | return stripslashes(str_replace($bad, '', $str)); |
| 547 | } |
| 548 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 549 | // ---------------------------------------------------------------- |
| 550 | |
| 551 | /** |
| 552 | * Compact Exploded Words |
| 553 | * |
| 554 | * Callback function for xss_clean() to remove whitespace from |
| 555 | * things like j a v a s c r i p t |
| 556 | * |
| 557 | * @param type |
| 558 | * @return type |
| 559 | */ |
| 560 | protected function _compact_exploded_words($matches) |
| 561 | { |
| 562 | return preg_replace('/\s+/s', '', $matches[1]).$matches[2]; |
| 563 | } |
| 564 | |
| 565 | // -------------------------------------------------------------------- |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 566 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 567 | /* |
| 568 | * Remove Evil HTML Attributes (like evenhandlers and style) |
| 569 | * |
| 570 | * It removes the evil attribute and either: |
| 571 | * - Everything up until a space |
| 572 | * For example, everything between the pipes: |
| 573 | * <a |style=document.write('hello');alert('world');| class=link> |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 574 | * - Everything inside the quotes |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 575 | * For example, everything between the pipes: |
| 576 | * <a |style="document.write('hello'); alert('world');"| class="link"> |
| 577 | * |
| 578 | * @param string $str The string to check |
| 579 | * @param boolean $is_image TRUE if this is an image |
| 580 | * @return string The string with the evil attributes removed |
| 581 | */ |
| 582 | protected function _remove_evil_attributes($str, $is_image) |
| 583 | { |
| 584 | // All javascript event handlers (e.g. onload, onclick, onmouseover), style, and xmlns |
Pascal Kriete | c38e3b6 | 2011-11-14 13:55:00 -0500 | [diff] [blame] | 585 | $evil_attributes = array('on\w*', 'style', 'xmlns', 'formaction'); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 586 | |
| 587 | if ($is_image === TRUE) |
| 588 | { |
| 589 | /* |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 590 | * Adobe Photoshop puts XML metadata into JFIF images, |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 591 | * including namespacing, so we have to allow this for images. |
| 592 | */ |
| 593 | unset($evil_attributes[array_search('xmlns', $evil_attributes)]); |
| 594 | } |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 595 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 596 | do { |
Pascal Kriete | c38e3b6 | 2011-11-14 13:55:00 -0500 | [diff] [blame] | 597 | $count = 0; |
| 598 | $attribs = array(); |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 599 | |
Pascal Kriete | c38e3b6 | 2011-11-14 13:55:00 -0500 | [diff] [blame] | 600 | // find occurrences of illegal attribute strings without quotes |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 601 | preg_match_all('/('.implode('|', $evil_attributes).')\s*=\s*([^\s]*)/is', $str, $matches, PREG_SET_ORDER); |
| 602 | |
Pascal Kriete | c38e3b6 | 2011-11-14 13:55:00 -0500 | [diff] [blame] | 603 | foreach ($matches as $attr) |
| 604 | { |
| 605 | $attribs[] = preg_quote($attr[0], '/'); |
| 606 | } |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 607 | |
Pascal Kriete | c38e3b6 | 2011-11-14 13:55:00 -0500 | [diff] [blame] | 608 | // find occurrences of illegal attribute strings with quotes (042 and 047 are octal quotes) |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 609 | preg_match_all('/('.implode('|', $evil_attributes).')\s*=\s*(\042|\047)([^\\2]*?)(\\2)/is', $str, $matches, PREG_SET_ORDER); |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 610 | |
Pascal Kriete | c38e3b6 | 2011-11-14 13:55:00 -0500 | [diff] [blame] | 611 | foreach ($matches as $attr) |
| 612 | { |
| 613 | $attribs[] = preg_quote($attr[0], '/'); |
| 614 | } |
| 615 | |
| 616 | // replace illegal attribute strings that are inside an html tag |
| 617 | if (count($attribs) > 0) |
| 618 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 619 | $str = preg_replace('/<(\/?[^><]+?)([^A-Za-z\-])('.implode('|', $attribs).')([\s><])([><]*)/i', '<$1$2$4$5', $str, -1, $count); |
Pascal Kriete | c38e3b6 | 2011-11-14 13:55:00 -0500 | [diff] [blame] | 620 | } |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 621 | |
Pascal Kriete | c38e3b6 | 2011-11-14 13:55:00 -0500 | [diff] [blame] | 622 | } while ($count); |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 623 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 624 | return $str; |
| 625 | } |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 626 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 627 | // -------------------------------------------------------------------- |
| 628 | |
| 629 | /** |
| 630 | * Sanitize Naughty HTML |
| 631 | * |
| 632 | * Callback function for xss_clean() to remove naughty HTML elements |
| 633 | * |
| 634 | * @param array |
| 635 | * @return string |
| 636 | */ |
| 637 | protected function _sanitize_naughty_html($matches) |
| 638 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 639 | return '<'.$matches[1].$matches[2].$matches[3] // encode opening brace |
| 640 | // encode captured opening or closing brace to prevent recursive vectors: |
| 641 | . str_replace(array('>', '<'), array('>', '<'), $matches[4]); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 642 | } |
| 643 | |
| 644 | // -------------------------------------------------------------------- |
| 645 | |
| 646 | /** |
| 647 | * JS Link Removal |
| 648 | * |
| 649 | * Callback function for xss_clean() to sanitize links |
| 650 | * This limits the PCRE backtracks, making it more performance friendly |
| 651 | * and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in |
| 652 | * PHP 5.2+ on link-heavy strings |
| 653 | * |
| 654 | * @param array |
| 655 | * @return string |
| 656 | */ |
| 657 | protected function _js_link_removal($match) |
| 658 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 659 | return str_replace($match[1], |
| 660 | preg_replace('#href=.*?(alert\(|alert&\#40;|javascript\:|livescript\:|mocha\:|charset\=|window\.|document\.|\.cookie|<script|<xss|base64\s*,)#si', |
| 661 | '', |
| 662 | $this->_filter_attributes(str_replace(array('<', '>'), '', $match[1])) |
| 663 | ), |
| 664 | $match[0]); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 665 | } |
| 666 | |
| 667 | // -------------------------------------------------------------------- |
| 668 | |
| 669 | /** |
| 670 | * JS Image Removal |
| 671 | * |
| 672 | * Callback function for xss_clean() to sanitize image tags |
| 673 | * This limits the PCRE backtracks, making it more performance friendly |
| 674 | * and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in |
| 675 | * PHP 5.2+ on image tag heavy strings |
| 676 | * |
| 677 | * @param array |
| 678 | * @return string |
| 679 | */ |
| 680 | protected function _js_img_removal($match) |
| 681 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 682 | return str_replace($match[1], |
| 683 | preg_replace('#src=.*?(alert\(|alert&\#40;|javascript\:|livescript\:|mocha\:|charset\=|window\.|document\.|\.cookie|<script|<xss|base64\s*,)#si', |
| 684 | '', |
| 685 | $this->_filter_attributes(str_replace(array('<', '>'), '', $match[1])) |
| 686 | ), |
| 687 | $match[0]); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 688 | } |
| 689 | |
| 690 | // -------------------------------------------------------------------- |
| 691 | |
| 692 | /** |
| 693 | * Attribute Conversion |
| 694 | * |
| 695 | * Used as a callback for XSS Clean |
| 696 | * |
| 697 | * @param array |
| 698 | * @return string |
| 699 | */ |
| 700 | protected function _convert_attribute($match) |
| 701 | { |
| 702 | return str_replace(array('>', '<', '\\'), array('>', '<', '\\\\'), $match[0]); |
| 703 | } |
| 704 | |
| 705 | // -------------------------------------------------------------------- |
| 706 | |
| 707 | /** |
| 708 | * Filter Attributes |
| 709 | * |
| 710 | * Filters tag attributes for consistency and safety |
| 711 | * |
| 712 | * @param string |
| 713 | * @return string |
| 714 | */ |
| 715 | protected function _filter_attributes($str) |
| 716 | { |
| 717 | $out = ''; |
| 718 | |
| 719 | if (preg_match_all('#\s*[a-z\-]+\s*=\s*(\042|\047)([^\\1]*?)\\1#is', $str, $matches)) |
| 720 | { |
| 721 | foreach ($matches[0] as $match) |
| 722 | { |
| 723 | $out .= preg_replace("#/\*.*?\*/#s", '', $match); |
| 724 | } |
| 725 | } |
| 726 | |
| 727 | return $out; |
| 728 | } |
| 729 | |
| 730 | // -------------------------------------------------------------------- |
| 731 | |
| 732 | /** |
| 733 | * HTML Entity Decode Callback |
| 734 | * |
| 735 | * Used as a callback for XSS Clean |
| 736 | * |
| 737 | * @param array |
| 738 | * @return string |
| 739 | */ |
| 740 | protected function _decode_entity($match) |
| 741 | { |
| 742 | return $this->entity_decode($match[0], strtoupper(config_item('charset'))); |
| 743 | } |
| 744 | |
| 745 | // -------------------------------------------------------------------- |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 746 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 747 | /** |
| 748 | * Validate URL entities |
| 749 | * |
| 750 | * Called by xss_clean() |
| 751 | * |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 752 | * @param string |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 753 | * @return string |
| 754 | */ |
| 755 | protected function _validate_entities($str) |
| 756 | { |
| 757 | /* |
| 758 | * Protect GET variables in URLs |
| 759 | */ |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 760 | |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 761 | // 901119URL5918AMP18930PROTECT8198 |
| 762 | $str = preg_replace('|\&([a-z\_0-9\-]+)\=([a-z\_0-9\-]+)|i', $this->xss_hash().'\\1=\\2', $str); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 763 | |
| 764 | /* |
| 765 | * Validate standard character entities |
| 766 | * |
Derek Jones | 37f4b9c | 2011-07-01 17:56:50 -0500 | [diff] [blame] | 767 | * Add a semicolon if missing. We do this to enable |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 768 | * the conversion of entities to ASCII later. |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 769 | */ |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 770 | $str = preg_replace('#(&\#?[0-9a-z]{2,})([\x00-\x20])*;?#i', '\\1;\\2', $str); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 771 | |
| 772 | /* |
| 773 | * Validate UTF16 two byte encoding (x00) |
| 774 | * |
| 775 | * Just as above, adds a semicolon if missing. |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 776 | */ |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 777 | $str = preg_replace('#(&\#x?)([0-9A-F]+);?#i', '\\1\\2;', $str); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 778 | |
| 779 | /* |
| 780 | * Un-Protect GET variables in URLs |
| 781 | */ |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 782 | return str_replace($this->xss_hash(), '&', $str); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 783 | } |
| 784 | |
| 785 | // ---------------------------------------------------------------------- |
| 786 | |
| 787 | /** |
| 788 | * Do Never Allowed |
| 789 | * |
| 790 | * A utility function for xss_clean() |
| 791 | * |
| 792 | * @param string |
| 793 | * @return string |
| 794 | */ |
| 795 | protected function _do_never_allowed($str) |
| 796 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 797 | $str = str_replace(array_keys($this->_never_allowed_str), $this->_never_allowed_str, $str); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 798 | |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 799 | foreach ($this->_never_allowed_regex as $regex) |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 800 | { |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 801 | $str = preg_replace('#'.$regex.'#i', '[removed]', $str); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 802 | } |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 803 | |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 804 | return $str; |
| 805 | } |
| 806 | |
| 807 | // -------------------------------------------------------------------- |
| 808 | |
| 809 | /** |
| 810 | * Set Cross Site Request Forgery Protection Cookie |
| 811 | * |
| 812 | * @return string |
| 813 | */ |
| 814 | protected function _csrf_set_hash() |
| 815 | { |
| 816 | if ($this->_csrf_hash == '') |
| 817 | { |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 818 | // If the cookie exists we will use it's value. |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 819 | // We don't necessarily want to regenerate it with |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 820 | // each page load since a page could contain embedded |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 821 | // sub-pages causing this feature to fail |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 822 | if (isset($_COOKIE[$this->_csrf_cookie_name]) && |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 823 | $_COOKIE[$this->_csrf_cookie_name] != '') |
| 824 | { |
| 825 | return $this->_csrf_hash = $_COOKIE[$this->_csrf_cookie_name]; |
| 826 | } |
David Behler | 07b5342 | 2011-08-15 00:25:06 +0200 | [diff] [blame] | 827 | |
Chris Berthe | d93e6f3 | 2011-09-25 10:33:25 -0400 | [diff] [blame] | 828 | $this->_csrf_hash = md5(uniqid(rand(), TRUE)); |
| 829 | $this->csrf_set_cookie(); |
Pascal Kriete | c9c045a | 2011-04-05 14:50:41 -0400 | [diff] [blame] | 830 | } |
| 831 | |
| 832 | return $this->_csrf_hash; |
| 833 | } |
| 834 | |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 835 | } |
Derek Jones | e701d76 | 2010-03-02 18:17:01 -0600 | [diff] [blame] | 836 | |
| 837 | /* End of file Security.php */ |
Andrey Andreev | bb488dc | 2012-01-07 23:35:16 +0200 | [diff] [blame^] | 838 | /* Location: ./system/core/Security.php */ |