-
- ![\"Damn](\"")
-
-
-
-
-
-
-
- {$pPage[ 'body' ]}
-
- {$messagesHtml} - -
-
- - {$messagesHtml} - -
-
-
-
- {$systemInfoHtml}
-
-
-
-
- Version " . dvwaVersionGet() . " (Release date: " . dvwaReleaseDateGet() . ")
-Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment
-The official documentation for DVWA can be found here.
-All material is copyright 2008-2015 RandomStorm & Ryan Dewhurst.
- -Damn Vulnerable Web Application (DVWA) is free software: you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version.
-The PHPIDS library is included, in good faith, with this DVWA distribution. The operation of PHPIDS is provided without support from the DVWA team. It is licensed under separate terms to the DVWA code.
- -Everyone is welcome to contribute and help make DVWA as successful as it can be. All contributors can have their name and link (if they wish) placed in the credits section. To contribute pick an Issue from the Project Home to work on or submit a patch to the Issues list.
-\n"; - -dvwaHtmlEcho( $page ); - -exit; - -?> diff --git a/dvwa/config/config.inc.php.dist b/dvwa/config/config.inc.php.dist deleted file mode 100644 index a03dd25..0000000 --- a/dvwa/config/config.inc.php.dist +++ /dev/null @@ -1,47 +0,0 @@ - diff --git a/dvwa/docs/DVWA_v1.3.pdf b/dvwa/docs/DVWA_v1.3.pdf deleted file mode 100644 index fb3e952..0000000 Binary files a/dvwa/docs/DVWA_v1.3.pdf and /dev/null differ diff --git a/dvwa/docs/pdf.html b/dvwa/docs/pdf.html deleted file mode 100644 index dae1304..0000000 --- a/dvwa/docs/pdf.html +++ /dev/null @@ -1 +0,0 @@ -Damn Vulnerable Web Application (DVWA) Official Documentation PDF v1.3 diff --git a/dvwa/dvwa/css/help.css b/dvwa/dvwa/css/help.css deleted file mode 100644 index abe9ebf..0000000 --- a/dvwa/dvwa/css/help.css +++ /dev/null @@ -1,25 +0,0 @@ -body { - background-color: #e7e7e7; - font-family: Arial, Helvetica, sans-serif; - font-size: 13px; -} - -h1 { - font-size: 25px; -} - -div#container { -} - -div#code { - background-color: #ffffff; -} - -div#area { - margin-left: 30px; -} - -span.spoiler { - background-color: black; - color: black; -} diff --git a/dvwa/dvwa/css/login.css b/dvwa/dvwa/css/login.css deleted file mode 100644 index e4727a0..0000000 --- a/dvwa/dvwa/css/login.css +++ /dev/null @@ -1,59 +0,0 @@ -body { - background: #fefffe; - font: 12px/15px Arial, Helvetica, sans-serif; - line-height: 20px; - color: #6b6b6b; -} - -#wrapper { - text-align: center; - margin: 0 auto; -} - -#content { - display: inline-block; - padding: 20px; - width: auto; -} - -#footer { - position: absolute; - width: 100%; - height: 50px; - bottom: 0px; - left: 0px; -} - -label { - float: left; - text-align: right; - margin-right: 0.5em; - display: block; - overflow: hidden; - padding-right: 50px; - font-weight: bold; -} - -.loginInput { - float: left; - color: #6B6B6B; - width: 320px; - background-color: #F4F4F4; - border: 1px; - border-style: solid; - border-color: #c4c4c4; - padding: 6px; - margin-bottom: 12px; -} - -fieldset { - width: 350px; - padding: 10px 20px 10px 20px; - overflow: hidden; - border-style: none; -} - -p { - font-size: 10px; -} - diff --git a/dvwa/dvwa/css/main.css b/dvwa/dvwa/css/main.css deleted file mode 100644 index 82e6658..0000000 --- a/dvwa/dvwa/css/main.css +++ /dev/null @@ -1,266 +0,0 @@ -body { - margin: 0; - color: #2f2f2f; - font: 12px/15px Arial, Helvetica, sans-serif; - min-width: 981px; - height: 100%; - position: relative; -} - -body.home { - background: #e7e7e7; -} - -div.clear { - clear: both; -} - -a { - color: #99cc33; - text-decoration: underline; - font-weight: bold; -} - -a img { - border: 0; -} - -a: hover { - text-decoration: none; -} - -input, textarea, select { - font: 100% arial,sans-serif; - vertical-align: middle; -} - -form,fieldset { - margin: 0; - padding: 0; - border-style: none; -} - -em { - font-weight: bold; - font-style: normal; -} - -h1, h2, h3, h4, h5, h6 { - margin-top: 0px; -} - -h1 { - font-size: 200%; -} - -h2 { - font-size: 160%; -} - - -h3 { - font-size: 130%; -} - -hr { - border-width: 0px; - color: #C3D9FF; - background-color: #C3D9FF; - height: 1px; -} - -ul.menuBlocks { - list-style-type: none; - padding-left: 0px; - margin-top: 0px; - margin-bottom: 0px; - margin-left: 0px; -} - -ul + ul, ul + ul.menuBlocks, ul + h1, ul + h2, ul + p { - margin-top: 20px; -} - -.fixed { - font-family: Fixed, Courier, monospace; - font-size: 13px; -} - -div.warning { - border: 2px solid #ff0000; - padding: 10px 20px 10px 20px; - color: #800000; - margin-top: 15px; - margin-bottom: 15px; -} - -div.warning h1 { - color: #ff0000; -} - -div.message { - border: 1px solid #C0C0C0; - padding: 5px; - margin: 10px 0px 10px 0px; - background-color: #f8fafa; - width: 45%; -} - -div#container { - width: 900px; - height: 100%; - margin-left: auto; - margin-right: auto; - background: #f4f4f4; - font-size: 13px; -} - -div#header { - padding: 10px; - overflow: hidden; - background: #2f2f2f; - border-bottom: 5px solid #A1CC33; - text-align: center; -} - -div#system_info { - padding: 10px; - text-align: right; -} - -div#main_body { - float: right; - width: 693px; - background: #f4f4f4; - padding-top: 20px; - padding-bottom: 10px; - font-size: 13px; -} - -div.body_padded { - padding-left: 20px; - padding-right: 20px; -} - -div#main_menu { - float: left; - width: 200px; - height: 100%; - background-color: #f4f4f4; - padding-top: 10px; - padding-bottom: 10px; -} - -div#main_menu li { - border-width: 1px; - border-style: solid; - border-color: #D2D4D4 #6B778C #6B778C #D2D4D4; - padding: 3px 5px 3px 5px; - margin-bottom: 3px; - background-color: #bebebe; -} - -div#main_menu li a { - color: #000000; - text-decoration: none; - text-decoration: none; -} - -div#main_menu li.selected { - border-color: #758DAE #758DAE #758DAE #758DAE; - background-color: #99cc33; -} - -div#main_menu li.selected a { - color: #F9F7ED; -} - -div#main_menu li: hover { - border-color: #D2D4D4; -} - -div#main_menu li: hover a { - color: #F9F7ED; -} - -div#main_menu_padded { - padding: 15px; -} - -div#footer { - color: #999999; - background: #2f2f2f; - padding: 10px; - text-align: center; - border-top: 5px solid #A1CC33; -} - -input.popup_button { - border-width: 1px; - border-style: solid; - border-color: #D2D4D4 #6B778C #6B778C #D2D4D4; - padding: 3px 5px 3px 5px; - margin-bottom: 3px; - background-color: #C3C3C3; - float: right; -} - -div.vulnerable_code_area { - background-color: #f8fafa; - border-width: 1px; - border-style: solid; - border-color: #000000; - padding: 10px 20px 10px 20px; - margin-bottom: 20px; -} - -div#guestbook_comments { - width: 45%; - background-color: #f8fafa; - border-width: 1px; - border-style: solid; - border-color: #C0C0C0; - padding: 5px 10px 5px 10px; - margin-bottom: 5px; -} - -div#idslog { - border: 1px solid #C0C0C0; - padding: 5px; - margin: 10px 0px 10px 0px; - background-color: #f8fafa; -} - -pre { - color: red; -} - -div.submenu { - border-bottom: 1px solid #000000; - margin-bottom: 15px; - padding: 4px 0px 10px 0px; - font-size: 13px; -} - -span.submenu_item { - padding: 0px 10px 0px 10px; -} - -span.submenu_item + span.submenu_item { - border-left: 1px dashed #000000; - font-size: 13px; -} - -span.selected { - font-weight: bold; -} - -span.success { - - color:green; -} - -span.failure { - color:red; - font-weight: bold; -} diff --git a/dvwa/dvwa/css/source.css b/dvwa/dvwa/css/source.css deleted file mode 100644 index 7d996c2..0000000 --- a/dvwa/dvwa/css/source.css +++ /dev/null @@ -1,20 +0,0 @@ -body { - background-color: #e7e7e7; - font-family: Arial, Helvetica, sans-serif; - font-size: 13px; -} - -h1 { - font-size: 25px; -} - -div#container { -} - -div#code { - background-color: #ffffff; -} - -div#area { - margin-left: 30px; -} diff --git a/dvwa/dvwa/images/RandomStorm.png b/dvwa/dvwa/images/RandomStorm.png deleted file mode 100644 index 7328c05..0000000 Binary files a/dvwa/dvwa/images/RandomStorm.png and /dev/null differ diff --git a/dvwa/dvwa/images/dollar.png b/dvwa/dvwa/images/dollar.png deleted file mode 100644 index 5bc12b9..0000000 Binary files a/dvwa/dvwa/images/dollar.png and /dev/null differ diff --git a/dvwa/dvwa/images/lock.png b/dvwa/dvwa/images/lock.png deleted file mode 100644 index 16979f1..0000000 Binary files a/dvwa/dvwa/images/lock.png and /dev/null differ diff --git a/dvwa/dvwa/images/login_logo.png b/dvwa/dvwa/images/login_logo.png deleted file mode 100644 index 11c59f4..0000000 Binary files a/dvwa/dvwa/images/login_logo.png and /dev/null differ diff --git a/dvwa/dvwa/images/logo.png b/dvwa/dvwa/images/logo.png deleted file mode 100644 index b98bcf6..0000000 Binary files a/dvwa/dvwa/images/logo.png and /dev/null differ diff --git a/dvwa/dvwa/images/spanner.png b/dvwa/dvwa/images/spanner.png deleted file mode 100644 index efafbcf..0000000 Binary files a/dvwa/dvwa/images/spanner.png and /dev/null differ diff --git a/dvwa/dvwa/images/warning.png b/dvwa/dvwa/images/warning.png deleted file mode 100644 index 6c9e470..0000000 Binary files a/dvwa/dvwa/images/warning.png and /dev/null differ diff --git a/dvwa/dvwa/includes/DBMS/MySQL.php b/dvwa/dvwa/includes/DBMS/MySQL.php deleted file mode 100644 index c390612..0000000 --- a/dvwa/dvwa/includes/DBMS/MySQL.php +++ /dev/null @@ -1,102 +0,0 @@ -Please check the config file." ); - if ($_DVWA[ 'db_user' ] == "root") { - dvwaMessagePush( 'Your database user is root, if you are using MariaDB, this will not work, please read the README.md file.' ); - } - dvwaPageReload(); -} - - -// Create database -$drop_db = "DROP DATABASE IF EXISTS {$_DVWA[ 'db_database' ]};"; -if( !@mysqli_query($GLOBALS["___mysqli_ston"], $drop_db ) ) { - dvwaMessagePush( "Could not drop existing database
-// Unable to connect to the database.-// Click here to setup the database. -//
' . $DBMS_errorFunc . '
Caching factory
-This class is used as a factory to load the correct concrete caching implementation.
- -- Located in /Caching/Factory.php (line 51) -
- - - - -- Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 -
-- Implements interfaces: -
- - -Database caching wrapper
-This class inhabits functionality to get and set cache via a database.
- -- Located in /Caching/Database.php (line 72) -
- - - - -Returns an instance of this class
- - -Constructor
-Connects to database.
- - -Returns the cached data
-Note that this method returns false if either type or file cache is not set
- - -Writes cache data into the database
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:42 +0100 by phpDocumentor 1.4.2 -
-- Implements interfaces: -
- - -File caching wrapper
-This class inhabits functionality to get and set cache via a static flatfile.
- -- Located in /Caching/File.php (line 52) -
- - - - -Returns an instance of this class
- - -Constructor
- - -Returns the cached data
-Note that this method returns false if either type or file cache is not set
- - -Writes cache data into the file
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 -
-Caching wrapper interface
- -- Located in /Caching/Interface.php (line 48) -
- - - - -- Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 -
-- Implements interfaces: -
- - -File caching wrapper
-This class inhabits functionality to get and set cache via memcached.
- -- Located in /Caching/Memcached.php (line 52) -
- - - - -Returns an instance of this class
- - -Constructor
- - -Returns the cached data
-Note that this method returns false if either type or file cache is not set
- - -Writes cache data
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:50 +0100 by phpDocumentor 1.4.2 -
-- Implements interfaces: -
- - -File caching wrapper
-This class inhabits functionality to get and set cache via session.
- -- Located in /Caching/Session.php (line 52) -
- - - - -Returns an instance of this class
- - -Constructor
- - -Returns the cached data
-Note that this method returns false if either type or file cache is not set
- - -Writes cache data into the session
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:53 +0100 by phpDocumentor 1.4.2 -
-PHPIDS specific utility class to convert charsets manually
-Note that if you make use of IDS_Converter::runAll(), existing class methods will be executed in the same order as they are implemented in the class tree!
- -- Located in /Converter.php (line 51) -
- - - - -Converts basic concatenations
- - -Converts from hex/dec entities
- - -Check for comments and erases them if available
- - -Detects nullbytes and controls chars via ord()
- - -Checks for common charcode pattern and decodes them
- - -This method converts JS unicode code points to regular characters
- - -This method matches and translates base64 strings and fragments used in data URIs
- - -Strip newlines
- - -Detects nullbytes and controls chars via ord()
- - -This method collects and decodes proprietary encoding types
- - - - -Converts SQLHEX to plain text
- - -Converts basic SQL keywords and obfuscations
- - -Converts relevant UTF-7 tags to UTF-8
- - -Strip XML patterns
- - -Eliminate JS regex modifiers
- - -Normalize quotes
- - -Runs all converter functions
-Note that if you make use of IDS_Converter::runAll(), existing class methods will be executed in the same order as they are implemented in the class tree!
- - -This method is the centrifuge prototype
- - - - -- Documentation generated on Mon, 22 Dec 2008 13:36:41 +0100 by phpDocumentor 1.4.2 -
-- Implements interfaces: -
PHPIDS event object
-This class represents a certain event that occured while applying the filters to the supplied data. It aggregates a bunch of IDS_Filter implementations and is a assembled in IDS_Report.
Note that this class implements both Countable and IteratorAggregate
- -- Located in /Event.php (line 53) -
- - - - -List of filter objects
-Filter objects in this array are those that matched the events value
- - - - - - -Calculated impact
-Total impact of the event
- - - - - - -Event name
- - - - - - -Affecte tags
- - - - - - -Value of the event
- - - - - - -Constructor
-Fills event properties
- - -Returns number of filters
-To implement interface Countable this returns the number of filters appended.
- - -Returns list of filter objects
- - -Returns calculated impact
- - -IteratorAggregate iterator getter
-Returns an iterator to iterate over the appended filters.
- - -Returns event name
-The name of the event usually is the key of the variable that was considered to be malicious
- - -Returns affected tags
- - -Returns event value
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 -
-PHPIDS Filter object
-Each object of this class serves as a container for a specific filter. The object provides methods to get information about this particular filter and also to match an arbitrary string against it.
- -- Located in /Filter.php (line 52) -
- - - - -Filter description
- - - - - - -Filter impact level
- - - - - - -Filter rule
- - - - - - -List of tags of the filter
- - - - - - -Constructor
- - -Returns filter description
- - -Get filter ID
- - -Get filter impact level
- - -Returns filter rule
- - -Return list of affected tags
-Each filter rule is concerned with a certain kind of attack vectors. This method returns those affected kinds.
- - -Matches a string against current filter
-Matches given string against the filter rule the specific object of this class represents
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:45 +0100 by phpDocumentor 1.4.2 -
-Filter Storage
-This class provides various default functions for gathering filter patterns to be used later on by the detection mechanism. You might extend this class to your requirements.
- -- Located in /Filter/Storage.php (line 51) -
- - - - -Cache container
- - - - - - -Holds caching settings
- - - - - - -Filter container
- - - - - - -Filter source file
- - - - - - -Constructor
-Loads filters based on provided IDS_Init settings.
- - - - -Adds a filter
- - - - -Loads filters from Json file using ext/Json
-This function parses the provided source file and stores the result. If caching mode is enabled the result will be cached to increase the performance.
- - -Loads filters from XML using SimpleXML
-This function parses the provided source file and stores the result. If caching mode is enabled the result will be cached to increase the performance.
- - -Returns registered filters
- - -Sets the filter array
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:53 +0100 by phpDocumentor 1.4.2 -
-Abstract Filter Storage
-Class to assure the systems API
- -- Located in /Filter/Storage/Abstract.php (line 31) -
- - - - -| Class | -Description | -
|---|---|
| IDS_Filter_Storage | -- Filter Storage Class - | -
Constructor
- - - - -Adds one particular filter
- - - - -Returns array containing all filters
- - -Sets filter array manually
- - -- Documentation generated on Thu, 13 Sep 2007 22:36:58 +0200 by phpDocumentor 1.4.0 -
-Framework initiation
-This class is used for the purpose to initiate the framework and inhabits functionality to parse the needed configuration file.
- -- Located in /Init.php (line 51) -
- - - - -Returns an instance of this class. Also a PHP version check is being performed to avoid compatibility problems with PHP < 5.1.6
- - -This method checks if a base path is given and usage is set to true.
-If all that tests succeed the base path will be returned as a string - else null will be returned.
- - -Returns the config array
- - -Returns path to configuration file
- - -Merges new settings into the exsiting ones or overwrites them
- - -Sets the path to the configuration file
- - -Merge config hashes recursivly
-The algorithm merges configuration arrays recursively. If an element is an array in both, the values will be appended. If it is a scalar in both, the value will be replaced.
- - -Permitting to clone this object
-For the sake of correctness of a singleton pattern, this is necessary
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 -
-Log Composite
-This class implements the composite pattern to allow to work with multiple logging wrappers at once.
- -- Located in /Log/Composite.php (line 52) -
- - - - -Registers a new logging wrapper
-Only valid IDS_Log_Interface instances passed to this function will be registered
- - -Iterates through registered loggers and executes them
- - - - -Removes a logger
- - - - -- Documentation generated on Mon, 22 Dec 2008 13:36:40 +0100 by phpDocumentor 1.4.2 -
-- Implements interfaces: -
- - -Database logging wrapper
-The database wrapper is designed to store reports into an sql database. It implements the singleton pattern and is based in PDO, supporting different database types.
- -- Located in /Log/Database.php (line 75) -
- - - - -Returns an instance of this class
-This method allows the passed argument to be either an instance of IDS_Init or an array.
- - -Constructor
-Prepares the SQL statement
- - -Stores given data into the database
- - - - -- Documentation generated on Mon, 22 Dec 2008 13:36:42 +0100 by phpDocumentor 1.4.2 -
-- Implements interfaces: -
- - -Email logging wrapper
-The Email wrapper is designed to send reports via email. It implements the singleton pattern.
- -- Located in /Log/Email.php (line 52) -
- - - - -Returns an instance of this class
-This method allows the passed argument to be either an instance of IDS_Init or an array.
- - -Constructor
- - -Sends the report to registered recipients
- - - - -Detects spam attempts
-To avoid mail spam through this logging class this function is used to detect such attempts based on the alert frequency.
- - -Prepares data
-Converts given data into a format that can be read in an email. You might edit this method to your requirements.
- - -Sends an email
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:43 +0100 by phpDocumentor 1.4.2 -
-- Implements interfaces: -
- - -File logging wrapper
-The file wrapper is designed to store data into a flatfile. It implements the singleton pattern.
- -- Located in /Log/File.php (line 52) -
- - - - -Returns an instance of this class
-This method allows the passed argument to be either an instance of IDS_Init or a path to a log file. Due to the singleton pattern only one instance for each file can be initiated.
- - -Constructor
- - -Stores given data into a file
- - - - -Prepares data
-Converts given data into a format that can be stored into a file. You might edit this method to your requirements.
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 -
-Interface for logging wrappers
- -- Located in /Log/Interface.php (line 47) -
- - - - -Interface method
- - - - -- Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 -
-Monitoring engine
-This class represents the core of the frameworks attack detection mechanism and provides functions to scan incoming data for malicious appearing script fragments.
- -- Located in /Monitor.php (line 51) -
- - - - -Constructor
- - - - -Adds a value to the html array
- - -Adds a value to the json array
- - -Returns exception array
- - -Returns html array
- - -Returns json array
- - -Returns report object providing various functions to work with detected results. Also the centrifuge data is being set as property of the report object.
- - -Returns storage container
- - -Starts the scan mechanism
- - -Sets exception array
- - -Sets html array
- - -Sets json array
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:50 +0100 by phpDocumentor 1.4.2 -
-- Implements interfaces: -
PHPIDS report object
-The report objects collects a number of events and thereby presents the detected results. It provides a convenient API to work with the results.
Note that this class implements Countable, IteratorAggregate and a __toString() method
- -- Located in /Report.php (line 53) -
- - - - -Centrifuge data
-This variable - initiated as an empty array - carries all information about the centrifuge data if available
- - - - - - -Event container
- - - - - - -Impact level
-The impact level is calculated on demand by adding the results of the event objects on IDS_Report->getImpact()
- - - - - - -List of affected tags
-This list of tags is collected from the collected event objects on demand when IDS_Report->getTags() is called
- - - - - - -Constructor
- - -Adds an IDS_Event object to the report
- - - - -Clears calculated/collected values
- - -Returns total amount of events
- - -This method returns the centrifuge property or null if not filled with data
- - -Get event by name
-In most cases an event is identified by the key of the variable that contained maliciously appearing content
- - -Returns total impact
-Each stored IDS_Event object and its IDS_Filter sub-object are called to calculate the overall impact level of this request
- - -Return iterator object
-In order to provide the possibility to directly iterate over the IDS_Event object the IteratorAggregate is implemented. One can easily use foreach() to iterate through all stored IDS_Event objects.
- - -Returns list of affected tags
- - -Checks if a specific event with given name exists
- - -Checks if any events are registered
- - -This method sets the centrifuge property
- - -Directly outputs all available information
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:52 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Caching_Database - | -- Database caching wrapper - | -
PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:42 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Caching - | -- Caching factory - | -
- Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Caching_File - | -- File caching wrapper - | -
PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Caching_Interface - | -- Caching wrapper interface - | -
- Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Caching_Memcached - | -- File caching wrapper - | -
PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:50 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Caching_Session - | -- File caching wrapper - | -
PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:53 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Converter - | -- PHPIDS specific utility class to convert charsets manually - | -
- Documentation generated on Mon, 22 Dec 2008 13:36:41 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Event - | -- PHPIDS event object - | -
- Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 -
-PHPIDS Requirements: PHP5, SimpleXML
-Copyright (c) 2007 PHPIDS group (http://php-ids.org)
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; version 2 of the license.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
- -| Class | -Description | -
|---|---|
| - IDS_Filter - | -- PHPIDS Filter object - | -
- Documentation generated on Mon, 24 Sep 2007 20:06:51 +0200 by phpDocumentor 1.4.0 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2007 PHPIDS (http://php-ids.org)
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; version 2 of the license.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
- -| Class | -Description | -
|---|---|
| - IDS_Filter_Storage_Abstract - | -- Abstract Filter Storage - | -
- Documentation generated on Thu, 13 Sep 2007 22:36:58 +0200 by phpDocumentor 1.4.0 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Filter_Storage - | -- Filter Storage - | -
- Documentation generated on Mon, 22 Dec 2008 13:36:53 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Filter - | -- PHPIDS Filter object - | -
- Documentation generated on Mon, 22 Dec 2008 13:36:45 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Init - | -- Framework initiation - | -
- Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Log_Composite - | -- Log Composite - | -
PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:40 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Log_Database - | -- Database logging wrapper - | -
PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:42 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Log_Email - | -- Email logging wrapper - | -
PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:43 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Log_File - | -- File logging wrapper - | -
PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -- Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Log_Interface - | -- Interface for logging wrappers - | -
- Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Monitor - | -- Monitoring engine - | -
- Documentation generated on Mon, 22 Dec 2008 13:36:50 +0100 by phpDocumentor 1.4.2 -
-PHPIDS
-Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
- - -| Class | -Description | -
|---|---|
| - IDS_Report - | -- PHPIDS report object - | -
- Documentation generated on Mon, 22 Dec 2008 13:36:52 +0100 by phpDocumentor 1.4.2 -
-- Documentation generated on Mon, 22 Dec 2008 13:36:38 +0100 by phpDocumentor 1.4.2 -
- - \ No newline at end of file diff --git a/dvwa/external/phpids/0.6/docs/phpdocumentor/elementindex.html b/dvwa/external/phpids/0.6/docs/phpdocumentor/elementindex.html deleted file mode 100644 index 7c0c521..0000000 --- a/dvwa/external/phpids/0.6/docs/phpdocumentor/elementindex.html +++ /dev/null @@ -1,10897 +0,0 @@ - - - - - -- Documentation generated on Mon, 22 Dec 2008 13:36:56 +0100 by phpDocumentor 1.4.2 -
- - \ No newline at end of file diff --git a/dvwa/external/phpids/0.6/docs/phpdocumentor/index.html b/dvwa/external/phpids/0.6/docs/phpdocumentor/index.html deleted file mode 100644 index 823da12..0000000 --- a/dvwa/external/phpids/0.6/docs/phpdocumentor/index.html +++ /dev/null @@ -1,24 +0,0 @@ - - - - - -to
- foreach ($definition->info[$token->name]->attr_transform_pre as $transform) { - $attr = $transform->transform($o = $attr, $config, $context); - if ($e) { - if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); - } - } - - // create alias to this element's attribute definition array, see - // also $d_defs (global attribute definition array) - // DEFINITION CALL - $defs = $definition->info[$token->name]->attr; - - $attr_key = false; - $context->register('CurrentAttr', $attr_key); - - // iterate through all the attribute keypairs - // Watch out for name collisions: $key has previously been used - foreach ($attr as $attr_key => $value) { - - // call the definition - if ( isset($defs[$attr_key]) ) { - // there is a local definition defined - if ($defs[$attr_key] === false) { - // We've explicitly been told not to allow this element. - // This is usually when there's a global definition - // that must be overridden. - // Theoretically speaking, we could have a - // AttrDef_DenyAll, but this is faster! - $result = false; - } else { - // validate according to the element's definition - $result = $defs[$attr_key]->validate( - $value, $config, $context - ); - } - } elseif ( isset($d_defs[$attr_key]) ) { - // there is a global definition defined, validate according - // to the global definition - $result = $d_defs[$attr_key]->validate( - $value, $config, $context - ); - } else { - // system never heard of the attribute? DELETE! - $result = false; - } - - // put the results into effect - if ($result === false || $result === null) { - // this is a generic error message that should replaced - // with more specific ones when possible - if ($e) $e->send(E_ERROR, 'AttrValidator: Attribute removed'); - - // remove the attribute - unset($attr[$attr_key]); - } elseif (is_string($result)) { - // generally, if a substitution is happening, there - // was some sort of implicit correction going on. We'll - // delegate it to the attribute classes to say exactly what. - - // simple substitution - $attr[$attr_key] = $result; - } else { - // nothing happens - } - - // we'd also want slightly more complicated substitution - // involving an array as the return value, - // although we're not sure how colliding attributes would - // resolve (certain ones would be completely overriden, - // others would prepend themselves). - } - - $context->destroy('CurrentAttr'); - - // post transforms - - // global (error reporting untested) - foreach ($definition->info_attr_transform_post as $transform) { - $attr = $transform->transform($o = $attr, $config, $context); - if ($e) { - if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); - } - } - - // local (error reporting untested) - foreach ($definition->info[$token->name]->attr_transform_post as $transform) { - $attr = $transform->transform($o = $attr, $config, $context); - if ($e) { - if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); - } - } - - $token->attr = $attr; - - // destroy CurrentToken if we made it ourselves - if (!$current_token) $context->destroy('CurrentToken'); - - } - - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Bootstrap.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Bootstrap.php deleted file mode 100644 index f7c3dab..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Bootstrap.php +++ /dev/null @@ -1,96 +0,0 @@ - -if (!defined('PHP_EOL')) { - switch (strtoupper(substr(PHP_OS, 0, 3))) { - case 'WIN': - define('PHP_EOL', "\r\n"); - break; - case 'DAR': - define('PHP_EOL', "\r"); - break; - default: - define('PHP_EOL', "\n"); - } -} - -/** - * Bootstrap class that contains meta-functionality for HTML Purifier such as - * the autoload function. - * - * @note - * This class may be used without any other files from HTML Purifier. - */ -class HTMLPurifier_Bootstrap -{ - - /** - * Autoload function for HTML Purifier - * @param $class Class to load - */ - public static function autoload($class) { - $file = HTMLPurifier_Bootstrap::getPath($class); - if (!$file) return false; - require HTMLPURIFIER_PREFIX . '/' . $file; - return true; - } - - /** - * Returns the path for a specific class. - */ - public static function getPath($class) { - if (strncmp('HTMLPurifier', $class, 12) !== 0) return false; - // Custom implementations - if (strncmp('HTMLPurifier_Language_', $class, 22) === 0) { - $code = str_replace('_', '-', substr($class, 22)); - $file = 'HTMLPurifier/Language/classes/' . $code . '.php'; - } else { - $file = str_replace('_', '/', $class) . '.php'; - } - if (!file_exists(HTMLPURIFIER_PREFIX . '/' . $file)) return false; - return $file; - } - - /** - * "Pre-registers" our autoloader on the SPL stack. - */ - public static function registerAutoload() { - $autoload = array('HTMLPurifier_Bootstrap', 'autoload'); - if ( ($funcs = spl_autoload_functions()) === false ) { - spl_autoload_register($autoload); - } elseif (function_exists('spl_autoload_unregister')) { - $compat = version_compare(PHP_VERSION, '5.1.2', '<=') && - version_compare(PHP_VERSION, '5.1.0', '>='); - foreach ($funcs as $func) { - if (is_array($func)) { - // :TRICKY: There are some compatibility issues and some - // places where we need to error out - $reflector = new ReflectionMethod($func[0], $func[1]); - if (!$reflector->isStatic()) { - throw new Exception(' - HTML Purifier autoloader registrar is not compatible - with non-static object methods due to PHP Bug #44144; - Please do not use HTMLPurifier.autoload.php (or any - file that includes this file); instead, place the code: - spl_autoload_register(array(\'HTMLPurifier_Bootstrap\', \'autoload\')) - after your own autoloaders. - '); - } - // Suprisingly, spl_autoload_register supports the - // Class::staticMethod callback format, although call_user_func doesn't - if ($compat) $func = implode('::', $func); - } - spl_autoload_unregister($func); - } - spl_autoload_register($autoload); - foreach ($funcs as $func) spl_autoload_register($func); - } - } - -} diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/CSSDefinition.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/CSSDefinition.php deleted file mode 100644 index 663eacc..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/CSSDefinition.php +++ /dev/null @@ -1,290 +0,0 @@ -info['text-align'] = new HTMLPurifier_AttrDef_Enum( - array('left', 'right', 'center', 'justify'), false); - - $border_style = - $this->info['border-bottom-style'] = - $this->info['border-right-style'] = - $this->info['border-left-style'] = - $this->info['border-top-style'] = new HTMLPurifier_AttrDef_Enum( - array('none', 'hidden', 'dotted', 'dashed', 'solid', 'double', - 'groove', 'ridge', 'inset', 'outset'), false); - - $this->info['border-style'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_style); - - $this->info['clear'] = new HTMLPurifier_AttrDef_Enum( - array('none', 'left', 'right', 'both'), false); - $this->info['float'] = new HTMLPurifier_AttrDef_Enum( - array('none', 'left', 'right'), false); - $this->info['font-style'] = new HTMLPurifier_AttrDef_Enum( - array('normal', 'italic', 'oblique'), false); - $this->info['font-variant'] = new HTMLPurifier_AttrDef_Enum( - array('normal', 'small-caps'), false); - - $uri_or_none = new HTMLPurifier_AttrDef_CSS_Composite( - array( - new HTMLPurifier_AttrDef_Enum(array('none')), - new HTMLPurifier_AttrDef_CSS_URI() - ) - ); - - $this->info['list-style-position'] = new HTMLPurifier_AttrDef_Enum( - array('inside', 'outside'), false); - $this->info['list-style-type'] = new HTMLPurifier_AttrDef_Enum( - array('disc', 'circle', 'square', 'decimal', 'lower-roman', - 'upper-roman', 'lower-alpha', 'upper-alpha', 'none'), false); - $this->info['list-style-image'] = $uri_or_none; - - $this->info['list-style'] = new HTMLPurifier_AttrDef_CSS_ListStyle($config); - - $this->info['text-transform'] = new HTMLPurifier_AttrDef_Enum( - array('capitalize', 'uppercase', 'lowercase', 'none'), false); - $this->info['color'] = new HTMLPurifier_AttrDef_CSS_Color(); - - $this->info['background-image'] = $uri_or_none; - $this->info['background-repeat'] = new HTMLPurifier_AttrDef_Enum( - array('repeat', 'repeat-x', 'repeat-y', 'no-repeat') - ); - $this->info['background-attachment'] = new HTMLPurifier_AttrDef_Enum( - array('scroll', 'fixed') - ); - $this->info['background-position'] = new HTMLPurifier_AttrDef_CSS_BackgroundPosition(); - - $border_color = - $this->info['border-top-color'] = - $this->info['border-bottom-color'] = - $this->info['border-left-color'] = - $this->info['border-right-color'] = - $this->info['background-color'] = new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_Enum(array('transparent')), - new HTMLPurifier_AttrDef_CSS_Color() - )); - - $this->info['background'] = new HTMLPurifier_AttrDef_CSS_Background($config); - - $this->info['border-color'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_color); - - $border_width = - $this->info['border-top-width'] = - $this->info['border-bottom-width'] = - $this->info['border-left-width'] = - $this->info['border-right-width'] = new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_Enum(array('thin', 'medium', 'thick')), - new HTMLPurifier_AttrDef_CSS_Length('0') //disallow negative - )); - - $this->info['border-width'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_width); - - $this->info['letter-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_Enum(array('normal')), - new HTMLPurifier_AttrDef_CSS_Length() - )); - - $this->info['word-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_Enum(array('normal')), - new HTMLPurifier_AttrDef_CSS_Length() - )); - - $this->info['font-size'] = new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_Enum(array('xx-small', 'x-small', - 'small', 'medium', 'large', 'x-large', 'xx-large', - 'larger', 'smaller')), - new HTMLPurifier_AttrDef_CSS_Percentage(), - new HTMLPurifier_AttrDef_CSS_Length() - )); - - $this->info['line-height'] = new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_Enum(array('normal')), - new HTMLPurifier_AttrDef_CSS_Number(true), // no negatives - new HTMLPurifier_AttrDef_CSS_Length('0'), - new HTMLPurifier_AttrDef_CSS_Percentage(true) - )); - - $margin = - $this->info['margin-top'] = - $this->info['margin-bottom'] = - $this->info['margin-left'] = - $this->info['margin-right'] = new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_CSS_Length(), - new HTMLPurifier_AttrDef_CSS_Percentage(), - new HTMLPurifier_AttrDef_Enum(array('auto')) - )); - - $this->info['margin'] = new HTMLPurifier_AttrDef_CSS_Multiple($margin); - - // non-negative - $padding = - $this->info['padding-top'] = - $this->info['padding-bottom'] = - $this->info['padding-left'] = - $this->info['padding-right'] = new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_CSS_Length('0'), - new HTMLPurifier_AttrDef_CSS_Percentage(true) - )); - - $this->info['padding'] = new HTMLPurifier_AttrDef_CSS_Multiple($padding); - - $this->info['text-indent'] = new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_CSS_Length(), - new HTMLPurifier_AttrDef_CSS_Percentage() - )); - - $trusted_wh = new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_CSS_Length('0'), - new HTMLPurifier_AttrDef_CSS_Percentage(true), - new HTMLPurifier_AttrDef_Enum(array('auto')) - )); - $max = $config->get('CSS', 'MaxImgLength'); - - $this->info['width'] = - $this->info['height'] = - $max === null ? - $trusted_wh : - new HTMLPurifier_AttrDef_Switch('img', - // For img tags: - new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_CSS_Length('0', $max), - new HTMLPurifier_AttrDef_Enum(array('auto')) - )), - // For everyone else: - $trusted_wh - ); - - $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration(); - - $this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily(); - - // this could use specialized code - $this->info['font-weight'] = new HTMLPurifier_AttrDef_Enum( - array('normal', 'bold', 'bolder', 'lighter', '100', '200', '300', - '400', '500', '600', '700', '800', '900'), false); - - // MUST be called after other font properties, as it references - // a CSSDefinition object - $this->info['font'] = new HTMLPurifier_AttrDef_CSS_Font($config); - - // same here - $this->info['border'] = - $this->info['border-bottom'] = - $this->info['border-top'] = - $this->info['border-left'] = - $this->info['border-right'] = new HTMLPurifier_AttrDef_CSS_Border($config); - - $this->info['border-collapse'] = new HTMLPurifier_AttrDef_Enum(array( - 'collapse', 'separate')); - - $this->info['caption-side'] = new HTMLPurifier_AttrDef_Enum(array( - 'top', 'bottom')); - - $this->info['table-layout'] = new HTMLPurifier_AttrDef_Enum(array( - 'auto', 'fixed')); - - $this->info['vertical-align'] = new HTMLPurifier_AttrDef_CSS_Composite(array( - new HTMLPurifier_AttrDef_Enum(array('baseline', 'sub', 'super', - 'top', 'text-top', 'middle', 'bottom', 'text-bottom')), - new HTMLPurifier_AttrDef_CSS_Length(), - new HTMLPurifier_AttrDef_CSS_Percentage() - )); - - $this->info['border-spacing'] = new HTMLPurifier_AttrDef_CSS_Multiple(new HTMLPurifier_AttrDef_CSS_Length(), 2); - - // partial support - $this->info['white-space'] = new HTMLPurifier_AttrDef_Enum(array('nowrap')); - - if ($config->get('CSS', 'Proprietary')) { - $this->doSetupProprietary($config); - } - - if ($config->get('CSS', 'AllowTricky')) { - $this->doSetupTricky($config); - } - - $allow_important = $config->get('CSS', 'AllowImportant'); - // wrap all attr-defs with decorator that handles !important - foreach ($this->info as $k => $v) { - $this->info[$k] = new HTMLPurifier_AttrDef_CSS_ImportantDecorator($v, $allow_important); - } - - $this->setupConfigStuff($config); - } - - protected function doSetupProprietary($config) { - // Internet Explorer only scrollbar colors - $this->info['scrollbar-arrow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); - $this->info['scrollbar-base-color'] = new HTMLPurifier_AttrDef_CSS_Color(); - $this->info['scrollbar-darkshadow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); - $this->info['scrollbar-face-color'] = new HTMLPurifier_AttrDef_CSS_Color(); - $this->info['scrollbar-highlight-color'] = new HTMLPurifier_AttrDef_CSS_Color(); - $this->info['scrollbar-shadow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); - - // technically not proprietary, but CSS3, and no one supports it - $this->info['opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); - $this->info['-moz-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); - $this->info['-khtml-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); - - // only opacity, for now - $this->info['filter'] = new HTMLPurifier_AttrDef_CSS_Filter(); - - } - - protected function doSetupTricky($config) { - $this->info['display'] = new HTMLPurifier_AttrDef_Enum(array( - 'inline', 'block', 'list-item', 'run-in', 'compact', - 'marker', 'table', 'inline-table', 'table-row-group', - 'table-header-group', 'table-footer-group', 'table-row', - 'table-column-group', 'table-column', 'table-cell', 'table-caption', 'none' - )); - $this->info['visibility'] = new HTMLPurifier_AttrDef_Enum(array( - 'visible', 'hidden', 'collapse' - )); - } - - - /** - * Performs extra config-based processing. Based off of - * HTMLPurifier_HTMLDefinition. - * @todo Refactor duplicate elements into common class (probably using - * composition, not inheritance). - */ - protected function setupConfigStuff($config) { - - // setup allowed elements - $support = "(for information on implementing this, see the ". - "support forums) "; - $allowed_attributes = $config->get('CSS', 'AllowedProperties'); - if ($allowed_attributes !== null) { - foreach ($this->info as $name => $d) { - if(!isset($allowed_attributes[$name])) unset($this->info[$name]); - unset($allowed_attributes[$name]); - } - // emit errors - foreach ($allowed_attributes as $name => $d) { - // :TODO: Is this htmlspecialchars() call really necessary? - $name = htmlspecialchars($name); - trigger_error("Style attribute '$name' is not supported $support", E_USER_WARNING); - } - } - - } -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef.php deleted file mode 100644 index de0b1b9..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef.php +++ /dev/null @@ -1,48 +0,0 @@ -elements; - } - - /** - * Validates nodes according to definition and returns modification. - * - * @param $tokens_of_children Array of HTMLPurifier_Token - * @param $config HTMLPurifier_Config object - * @param $context HTMLPurifier_Context object - * @return bool true to leave nodes as is - * @return bool false to remove parent node - * @return array of replacement child tokens - */ - abstract public function validateChildren($tokens_of_children, $config, $context); -} - - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Chameleon.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Chameleon.php deleted file mode 100644 index 2890ef1..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Chameleon.php +++ /dev/null @@ -1,47 +0,0 @@ -inline = new HTMLPurifier_ChildDef_Optional($inline); - $this->block = new HTMLPurifier_ChildDef_Optional($block); - $this->elements = $this->block->elements; - } - - public function validateChildren($tokens_of_children, $config, $context) { - if ($context->get('IsInline') === false) { - return $this->block->validateChildren( - $tokens_of_children, $config, $context); - } else { - return $this->inline->validateChildren( - $tokens_of_children, $config, $context); - } - } -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Custom.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Custom.php deleted file mode 100644 index 05c5d0c..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Custom.php +++ /dev/null @@ -1,89 +0,0 @@ -dtd_regex = $dtd_regex; - $this->_compileRegex(); - } - /** - * Compiles the PCRE regex from a DTD regex ($dtd_regex to $_pcre_regex) - */ - protected function _compileRegex() { - $raw = str_replace(' ', '', $this->dtd_regex); - if ($raw{0} != '(') { - $raw = "($raw)"; - } - $el = '[#a-zA-Z0-9_.-]+'; - $reg = $raw; - - // COMPLICATED! AND MIGHT BE BUGGY! I HAVE NO CLUE WHAT I'M - // DOING! Seriously: if there's problems, please report them. - - // collect all elements into the $elements array - preg_match_all("/$el/", $reg, $matches); - foreach ($matches[0] as $match) { - $this->elements[$match] = true; - } - - // setup all elements as parentheticals with leading commas - $reg = preg_replace("/$el/", '(,\\0)', $reg); - - // remove commas when they were not solicited - $reg = preg_replace("/([^,(|]\(+),/", '\\1', $reg); - - // remove all non-paranthetical commas: they are handled by first regex - $reg = preg_replace("/,\(/", '(', $reg); - - $this->_pcre_regex = $reg; - } - public function validateChildren($tokens_of_children, $config, $context) { - $list_of_children = ''; - $nesting = 0; // depth into the nest - foreach ($tokens_of_children as $token) { - if (!empty($token->is_whitespace)) continue; - - $is_child = ($nesting == 0); // direct - - if ($token instanceof HTMLPurifier_Token_Start) { - $nesting++; - } elseif ($token instanceof HTMLPurifier_Token_End) { - $nesting--; - } - - if ($is_child) { - $list_of_children .= $token->name . ','; - } - } - // add leading comma to deal with stray comma declarations - $list_of_children = ',' . rtrim($list_of_children, ','); - $okay = - preg_match( - '/^,?'.$this->_pcre_regex.'$/', - $list_of_children - ); - - return (bool) $okay; - } -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Empty.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Empty.php deleted file mode 100644 index cbfd750..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Empty.php +++ /dev/null @@ -1,19 +0,0 @@ - $x) { - $elements[$i] = true; - if (empty($i)) unset($elements[$i]); // remove blank - } - } - $this->elements = $elements; - } - public $allow_empty = false; - public $type = 'required'; - public function validateChildren($tokens_of_children, $config, $context) { - // if there are no tokens, delete parent node - if (empty($tokens_of_children)) return false; - - // the new set of children - $result = array(); - - // current depth into the nest - $nesting = 0; - - // whether or not we're deleting a node - $is_deleting = false; - - // whether or not parsed character data is allowed - // this controls whether or not we silently drop a tag - // or generate escaped HTML from it - $pcdata_allowed = isset($this->elements['#PCDATA']); - - // a little sanity check to make sure it's not ALL whitespace - $all_whitespace = true; - - // some configuration - $escape_invalid_children = $config->get('Core', 'EscapeInvalidChildren'); - - // generator - $gen = new HTMLPurifier_Generator($config, $context); - - foreach ($tokens_of_children as $token) { - if (!empty($token->is_whitespace)) { - $result[] = $token; - continue; - } - $all_whitespace = false; // phew, we're not talking about whitespace - - $is_child = ($nesting == 0); - - if ($token instanceof HTMLPurifier_Token_Start) { - $nesting++; - } elseif ($token instanceof HTMLPurifier_Token_End) { - $nesting--; - } - - if ($is_child) { - $is_deleting = false; - if (!isset($this->elements[$token->name])) { - $is_deleting = true; - if ($pcdata_allowed && $token instanceof HTMLPurifier_Token_Text) { - $result[] = $token; - } elseif ($pcdata_allowed && $escape_invalid_children) { - $result[] = new HTMLPurifier_Token_Text( - $gen->generateFromToken($token) - ); - } - continue; - } - } - if (!$is_deleting || ($pcdata_allowed && $token instanceof HTMLPurifier_Token_Text)) { - $result[] = $token; - } elseif ($pcdata_allowed && $escape_invalid_children) { - $result[] = - new HTMLPurifier_Token_Text( - $gen->generateFromToken($token) - ); - } else { - // drop silently - } - } - if (empty($result)) return false; - if ($all_whitespace) return false; - if ($tokens_of_children == $result) return true; - return $result; - } -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/StrictBlockquote.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/StrictBlockquote.php deleted file mode 100644 index 3ac834c..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/StrictBlockquote.php +++ /dev/null @@ -1,87 +0,0 @@ -init($config); - return $this->fake_elements; - } - - public function validateChildren($tokens_of_children, $config, $context) { - - $this->init($config); - - // trick the parent class into thinking it allows more - $this->elements = $this->fake_elements; - $result = parent::validateChildren($tokens_of_children, $config, $context); - $this->elements = $this->real_elements; - - if ($result === false) return array(); - if ($result === true) $result = $tokens_of_children; - - $def = $config->getHTMLDefinition(); - $block_wrap_start = new HTMLPurifier_Token_Start($def->info_block_wrapper); - $block_wrap_end = new HTMLPurifier_Token_End( $def->info_block_wrapper); - $is_inline = false; - $depth = 0; - $ret = array(); - - // assuming that there are no comment tokens - foreach ($result as $i => $token) { - $token = $result[$i]; - // ifs are nested for readability - if (!$is_inline) { - if (!$depth) { - if ( - ($token instanceof HTMLPurifier_Token_Text && !$token->is_whitespace) || - (!$token instanceof HTMLPurifier_Token_Text && !isset($this->elements[$token->name])) - ) { - $is_inline = true; - $ret[] = $block_wrap_start; - } - } - } else { - if (!$depth) { - // starting tokens have been inline text / empty - if ($token instanceof HTMLPurifier_Token_Start || $token instanceof HTMLPurifier_Token_Empty) { - if (isset($this->elements[$token->name])) { - // ended - $ret[] = $block_wrap_end; - $is_inline = false; - } - } - } - } - $ret[] = $token; - if ($token instanceof HTMLPurifier_Token_Start) $depth++; - if ($token instanceof HTMLPurifier_Token_End) $depth--; - } - if ($is_inline) $ret[] = $block_wrap_end; - return $ret; - } - - private function init($config) { - if (!$this->init) { - $def = $config->getHTMLDefinition(); - // allow all inline elements - $this->real_elements = $this->elements; - $this->fake_elements = $def->info_content_sets['Flow']; - $this->fake_elements['#PCDATA'] = true; - $this->init = true; - } - } -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Table.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Table.php deleted file mode 100644 index 50ad115..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Table.php +++ /dev/null @@ -1,141 +0,0 @@ - true, 'tbody' => true, 'thead' => true, - 'tfoot' => true, 'caption' => true, 'colgroup' => true, 'col' => true); - public function __construct() {} - public function validateChildren($tokens_of_children, $config, $context) { - if (empty($tokens_of_children)) return false; - - // this ensures that the loop gets run one last time before closing - // up. It's a little bit of a hack, but it works! Just make sure you - // get rid of the token later. - $tokens_of_children[] = false; - - // only one of these elements is allowed in a table - $caption = false; - $thead = false; - $tfoot = false; - - // as many of these as you want - $cols = array(); - $content = array(); - - $nesting = 0; // current depth so we can determine nodes - $is_collecting = false; // are we globbing together tokens to package - // into one of the collectors? - $collection = array(); // collected nodes - $tag_index = 0; // the first node might be whitespace, - // so this tells us where the start tag is - - foreach ($tokens_of_children as $token) { - $is_child = ($nesting == 0); - - if ($token === false) { - // terminating sequence started - } elseif ($token instanceof HTMLPurifier_Token_Start) { - $nesting++; - } elseif ($token instanceof HTMLPurifier_Token_End) { - $nesting--; - } - - // handle node collection - if ($is_collecting) { - if ($is_child) { - // okay, let's stash the tokens away - // first token tells us the type of the collection - switch ($collection[$tag_index]->name) { - case 'tr': - case 'tbody': - $content[] = $collection; - break; - case 'caption': - if ($caption !== false) break; - $caption = $collection; - break; - case 'thead': - case 'tfoot': - // access the appropriate variable, $thead or $tfoot - $var = $collection[$tag_index]->name; - if ($$var === false) { - $$var = $collection; - } else { - // transmutate the first and less entries into - // tbody tags, and then put into content - $collection[$tag_index]->name = 'tbody'; - $collection[count($collection)-1]->name = 'tbody'; - $content[] = $collection; - } - break; - case 'colgroup': - $cols[] = $collection; - break; - } - $collection = array(); - $is_collecting = false; - $tag_index = 0; - } else { - // add the node to the collection - $collection[] = $token; - } - } - - // terminate - if ($token === false) break; - - if ($is_child) { - // determine what we're dealing with - if ($token->name == 'col') { - // the only empty tag in the possie, we can handle it - // immediately - $cols[] = array_merge($collection, array($token)); - $collection = array(); - $tag_index = 0; - continue; - } - switch($token->name) { - case 'caption': - case 'colgroup': - case 'thead': - case 'tfoot': - case 'tbody': - case 'tr': - $is_collecting = true; - $collection[] = $token; - continue; - default: - if ($token instanceof HTMLPurifier_Token_Text && $token->is_whitespace) { - $collection[] = $token; - $tag_index++; - } - continue; - } - } - } - - if (empty($content)) return false; - - $ret = array(); - if ($caption !== false) $ret = array_merge($ret, $caption); - if ($cols !== false) foreach ($cols as $token_array) $ret = array_merge($ret, $token_array); - if ($thead !== false) $ret = array_merge($ret, $thead); - if ($tfoot !== false) $ret = array_merge($ret, $tfoot); - foreach ($content as $token_array) $ret = array_merge($ret, $token_array); - if (!empty($collection) && $is_collecting == false){ - // grab the trailing space - $ret = array_merge($ret, $collection); - } - - array_pop($tokens_of_children); // remove phantom token - - return ($ret === $tokens_of_children) ? true : $ret; - - } -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Config.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Config.php deleted file mode 100644 index d259153..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Config.php +++ /dev/null @@ -1,492 +0,0 @@ -conf = $definition->defaults; // set up, copy in defaults - $this->def = $definition; // keep a copy around for checking - $this->parser = new HTMLPurifier_VarParser_Flexible(); - } - - /** - * Convenience constructor that creates a config object based on a mixed var - * @param mixed $config Variable that defines the state of the config - * object. Can be: a HTMLPurifier_Config() object, - * an array of directives based on loadArray(), - * or a string filename of an ini file. - * @param HTMLPurifier_ConfigSchema Schema object - * @return Configured HTMLPurifier_Config object - */ - public static function create($config, $schema = null) { - if ($config instanceof HTMLPurifier_Config) { - // pass-through - return $config; - } - if (!$schema) { - $ret = HTMLPurifier_Config::createDefault(); - } else { - $ret = new HTMLPurifier_Config($schema); - } - if (is_string($config)) $ret->loadIni($config); - elseif (is_array($config)) $ret->loadArray($config); - return $ret; - } - - /** - * Convenience constructor that creates a default configuration object. - * @return Default HTMLPurifier_Config object. - */ - public static function createDefault() { - $definition = HTMLPurifier_ConfigSchema::instance(); - $config = new HTMLPurifier_Config($definition); - return $config; - } - - /** - * Retreives a value from the configuration. - * @param $namespace String namespace - * @param $key String key - */ - public function get($namespace, $key) { - if (!$this->finalized && $this->autoFinalize) $this->finalize(); - if (!isset($this->def->info[$namespace][$key])) { - // can't add % due to SimpleTest bug - trigger_error('Cannot retrieve value of undefined directive ' . htmlspecialchars("$namespace.$key"), - E_USER_WARNING); - return; - } - if (isset($this->def->info[$namespace][$key]->isAlias)) { - $d = $this->def->info[$namespace][$key]; - trigger_error('Cannot get value from aliased directive, use real name ' . $d->namespace . '.' . $d->name, - E_USER_ERROR); - return; - } - return $this->conf[$namespace][$key]; - } - - /** - * Retreives an array of directives to values from a given namespace - * @param $namespace String namespace - */ - public function getBatch($namespace) { - if (!$this->finalized && $this->autoFinalize) $this->finalize(); - if (!isset($this->def->info[$namespace])) { - trigger_error('Cannot retrieve undefined namespace ' . htmlspecialchars($namespace), - E_USER_WARNING); - return; - } - return $this->conf[$namespace]; - } - - /** - * Returns a md5 signature of a segment of the configuration object - * that uniquely identifies that particular configuration - * @note Revision is handled specially and is removed from the batch - * before processing! - * @param $namespace Namespace to get serial for - */ - public function getBatchSerial($namespace) { - if (empty($this->serials[$namespace])) { - $batch = $this->getBatch($namespace); - unset($batch['DefinitionRev']); - $this->serials[$namespace] = md5(serialize($batch)); - } - return $this->serials[$namespace]; - } - - /** - * Returns a md5 signature for the entire configuration object - * that uniquely identifies that particular configuration - */ - public function getSerial() { - if (empty($this->serial)) { - $this->serial = md5(serialize($this->getAll())); - } - return $this->serial; - } - - /** - * Retrieves all directives, organized by namespace - */ - public function getAll() { - if (!$this->finalized && $this->autoFinalize) $this->finalize(); - return $this->conf; - } - - /** - * Sets a value to configuration. - * @param $namespace String namespace - * @param $key String key - * @param $value Mixed value - */ - public function set($namespace, $key, $value, $from_alias = false) { - if ($this->isFinalized('Cannot set directive after finalization')) return; - if (!isset($this->def->info[$namespace][$key])) { - trigger_error('Cannot set undefined directive ' . htmlspecialchars("$namespace.$key") . ' to value', - E_USER_WARNING); - return; - } - $def = $this->def->info[$namespace][$key]; - - if (isset($def->isAlias)) { - if ($from_alias) { - trigger_error('Double-aliases not allowed, please fix '. - 'ConfigSchema bug with' . "$namespace.$key", E_USER_ERROR); - return; - } - $this->set($new_ns = $def->namespace, - $new_dir = $def->name, - $value, true); - trigger_error("$namespace.$key is an alias, preferred directive name is $new_ns.$new_dir", E_USER_NOTICE); - return; - } - - // Raw type might be negative when using the fully optimized form - // of stdclass, which indicates allow_null == true - $rtype = is_int($def) ? $def : $def->type; - if ($rtype < 0) { - $type = -$rtype; - $allow_null = true; - } else { - $type = $rtype; - $allow_null = isset($def->allow_null); - } - - try { - $value = $this->parser->parse($value, $type, $allow_null); - } catch (HTMLPurifier_VarParserException $e) { - trigger_error('Value for ' . "$namespace.$key" . ' is of invalid type, should be ' . HTMLPurifier_VarParser::getTypeName($type), E_USER_WARNING); - return; - } - if (is_string($value) && is_object($def)) { - // resolve value alias if defined - if (isset($def->aliases[$value])) { - $value = $def->aliases[$value]; - } - // check to see if the value is allowed - if (isset($def->allowed) && !isset($def->allowed[$value])) { - trigger_error('Value not supported, valid values are: ' . - $this->_listify($def->allowed), E_USER_WARNING); - return; - } - } - $this->conf[$namespace][$key] = $value; - - // reset definitions if the directives they depend on changed - // this is a very costly process, so it's discouraged - // with finalization - if ($namespace == 'HTML' || $namespace == 'CSS') { - $this->definitions[$namespace] = null; - } - - $this->serials[$namespace] = false; - } - - /** - * Convenience function for error reporting - */ - private function _listify($lookup) { - $list = array(); - foreach ($lookup as $name => $b) $list[] = $name; - return implode(', ', $list); - } - - /** - * Retrieves object reference to the HTML definition. - * @param $raw Return a copy that has not been setup yet. Must be - * called before it's been setup, otherwise won't work. - */ - public function getHTMLDefinition($raw = false) { - return $this->getDefinition('HTML', $raw); - } - - /** - * Retrieves object reference to the CSS definition - * @param $raw Return a copy that has not been setup yet. Must be - * called before it's been setup, otherwise won't work. - */ - public function getCSSDefinition($raw = false) { - return $this->getDefinition('CSS', $raw); - } - - /** - * Retrieves a definition - * @param $type Type of definition: HTML, CSS, etc - * @param $raw Whether or not definition should be returned raw - */ - public function getDefinition($type, $raw = false) { - if (!$this->finalized && $this->autoFinalize) $this->finalize(); - $factory = HTMLPurifier_DefinitionCacheFactory::instance(); - $cache = $factory->create($type, $this); - if (!$raw) { - // see if we can quickly supply a definition - if (!empty($this->definitions[$type])) { - if (!$this->definitions[$type]->setup) { - $this->definitions[$type]->setup($this); - $cache->set($this->definitions[$type], $this); - } - return $this->definitions[$type]; - } - // memory check missed, try cache - $this->definitions[$type] = $cache->get($this); - if ($this->definitions[$type]) { - // definition in cache, return it - return $this->definitions[$type]; - } - } elseif ( - !empty($this->definitions[$type]) && - !$this->definitions[$type]->setup - ) { - // raw requested, raw in memory, quick return - return $this->definitions[$type]; - } - // quick checks failed, let's create the object - if ($type == 'HTML') { - $this->definitions[$type] = new HTMLPurifier_HTMLDefinition(); - } elseif ($type == 'CSS') { - $this->definitions[$type] = new HTMLPurifier_CSSDefinition(); - } elseif ($type == 'URI') { - $this->definitions[$type] = new HTMLPurifier_URIDefinition(); - } else { - throw new HTMLPurifier_Exception("Definition of $type type not supported"); - } - // quick abort if raw - if ($raw) { - if (is_null($this->get($type, 'DefinitionID'))) { - // fatally error out if definition ID not set - throw new HTMLPurifier_Exception("Cannot retrieve raw version without specifying %$type.DefinitionID"); - } - return $this->definitions[$type]; - } - // set it up - $this->definitions[$type]->setup($this); - // save in cache - $cache->set($this->definitions[$type], $this); - return $this->definitions[$type]; - } - - /** - * Loads configuration values from an array with the following structure: - * Namespace.Directive => Value - * @param $config_array Configuration associative array - */ - public function loadArray($config_array) { - if ($this->isFinalized('Cannot load directives after finalization')) return; - foreach ($config_array as $key => $value) { - $key = str_replace('_', '.', $key); - if (strpos($key, '.') !== false) { - // condensed form - list($namespace, $directive) = explode('.', $key); - $this->set($namespace, $directive, $value); - } else { - $namespace = $key; - $namespace_values = $value; - foreach ($namespace_values as $directive => $value) { - $this->set($namespace, $directive, $value); - } - } - } - } - - /** - * Returns a list of array(namespace, directive) for all directives - * that are allowed in a web-form context as per an allowed - * namespaces/directives list. - * @param $allowed List of allowed namespaces/directives - */ - public static function getAllowedDirectivesForForm($allowed, $schema = null) { - if (!$schema) { - $schema = HTMLPurifier_ConfigSchema::instance(); - } - if ($allowed !== true) { - if (is_string($allowed)) $allowed = array($allowed); - $allowed_ns = array(); - $allowed_directives = array(); - $blacklisted_directives = array(); - foreach ($allowed as $ns_or_directive) { - if (strpos($ns_or_directive, '.') !== false) { - // directive - if ($ns_or_directive[0] == '-') { - $blacklisted_directives[substr($ns_or_directive, 1)] = true; - } else { - $allowed_directives[$ns_or_directive] = true; - } - } else { - // namespace - $allowed_ns[$ns_or_directive] = true; - } - } - } - $ret = array(); - foreach ($schema->info as $ns => $keypairs) { - foreach ($keypairs as $directive => $def) { - if ($allowed !== true) { - if (isset($blacklisted_directives["$ns.$directive"])) continue; - if (!isset($allowed_directives["$ns.$directive"]) && !isset($allowed_ns[$ns])) continue; - } - if (isset($def->isAlias)) continue; - if ($directive == 'DefinitionID' || $directive == 'DefinitionRev') continue; - $ret[] = array($ns, $directive); - } - } - return $ret; - } - - /** - * Loads configuration values from $_GET/$_POST that were posted - * via ConfigForm - * @param $array $_GET or $_POST array to import - * @param $index Index/name that the config variables are in - * @param $allowed List of allowed namespaces/directives - * @param $mq_fix Boolean whether or not to enable magic quotes fix - * @param $schema Instance of HTMLPurifier_ConfigSchema to use, if not global copy - */ - public static function loadArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true, $schema = null) { - $ret = HTMLPurifier_Config::prepareArrayFromForm($array, $index, $allowed, $mq_fix, $schema); - $config = HTMLPurifier_Config::create($ret, $schema); - return $config; - } - - /** - * Merges in configuration values from $_GET/$_POST to object. NOT STATIC. - * @note Same parameters as loadArrayFromForm - */ - public function mergeArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true) { - $ret = HTMLPurifier_Config::prepareArrayFromForm($array, $index, $allowed, $mq_fix, $this->def); - $this->loadArray($ret); - } - - /** - * Prepares an array from a form into something usable for the more - * strict parts of HTMLPurifier_Config - */ - public static function prepareArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true, $schema = null) { - if ($index !== false) $array = (isset($array[$index]) && is_array($array[$index])) ? $array[$index] : array(); - $mq = $mq_fix && function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc(); - - $allowed = HTMLPurifier_Config::getAllowedDirectivesForForm($allowed, $schema); - $ret = array(); - foreach ($allowed as $key) { - list($ns, $directive) = $key; - $skey = "$ns.$directive"; - if (!empty($array["Null_$skey"])) { - $ret[$ns][$directive] = null; - continue; - } - if (!isset($array[$skey])) continue; - $value = $mq ? stripslashes($array[$skey]) : $array[$skey]; - $ret[$ns][$directive] = $value; - } - return $ret; - } - - /** - * Loads configuration values from an ini file - * @param $filename Name of ini file - */ - public function loadIni($filename) { - if ($this->isFinalized('Cannot load directives after finalization')) return; - $array = parse_ini_file($filename, true); - $this->loadArray($array); - } - - /** - * Checks whether or not the configuration object is finalized. - * @param $error String error message, or false for no error - */ - public function isFinalized($error = false) { - if ($this->finalized && $error) { - trigger_error($error, E_USER_ERROR); - } - return $this->finalized; - } - - /** - * Finalizes configuration only if auto finalize is on and not - * already finalized - */ - public function autoFinalize() { - if (!$this->finalized && $this->autoFinalize) $this->finalize(); - } - - /** - * Finalizes a configuration object, prohibiting further change - */ - public function finalize() { - $this->finalized = true; - } - -} - - - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef.php deleted file mode 100644 index b632e7c..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef.php +++ /dev/null @@ -1,9 +0,0 @@ -type = $type; - if ( $allow_null !== null) $this->allow_null = $allow_null; - if ( $allowed !== null) $this->allowed = $allowed; - if ( $aliases !== null) $this->aliases = $aliases; - } - - /** - * Allowed type of the directive. Values are: - * - string - * - istring (case insensitive string) - * - int - * - float - * - bool - * - lookup (array of value => true) - * - list (regular numbered index array) - * - hash (array of key => value) - * - mixed (anything goes) - */ - public $type = 'mixed'; - - /** - * Is null allowed? Has no effect for mixed type. - * @bool - */ - public $allow_null = false; - - /** - * Lookup table of allowed values of the element, bool true if all allowed. - */ - public $allowed = true; - - /** - * Hash of value aliases, i.e. values that are equivalent. - */ - public $aliases = array(); - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/DirectiveAlias.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/DirectiveAlias.php deleted file mode 100644 index ccb0d3d..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/DirectiveAlias.php +++ /dev/null @@ -1,24 +0,0 @@ -namespace = $namespace; - $this->name = $name; - } -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/Namespace.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/Namespace.php deleted file mode 100644 index 155e3e5..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/Namespace.php +++ /dev/null @@ -1,10 +0,0 @@ - array( - * 'Directive' => new stdclass(), - * ) - * ) - * - * The stdclass may have the following properties: - * - * - If isAlias isn't set: - * - type: Integer type of directive, see HTMLPurifier_VarParser for definitions - * - allow_null: If set, this directive allows null values - * - aliases: If set, an associative array of value aliases to real values - * - allowed: If set, a lookup array of allowed (string) values - * - If isAlias is set: - * - namespace: Namespace this directive aliases to - * - name: Directive name this directive aliases to - * - * In certain degenerate cases, stdclass will actually be an integer. In - * that case, the value is equivalent to an stdclass with the type - * property set to the integer. If the integer is negative, type is - * equal to the absolute value of integer, and allow_null is true. - * - * This class is friendly with HTMLPurifier_Config. If you need introspection - * about the schema, you're better of using the ConfigSchema_Interchange, - * which uses more memory but has much richer information. - */ - public $info = array(); - - /** - * Application-wide singleton - */ - static protected $singleton; - - /** - * Unserializes the default ConfigSchema. - */ - public static function makeFromSerial() { - return unserialize(file_get_contents(HTMLPURIFIER_PREFIX . '/HTMLPurifier/ConfigSchema/schema.ser')); - } - - /** - * Retrieves an instance of the application-wide configuration definition. - */ - public static function instance($prototype = null) { - if ($prototype !== null) { - HTMLPurifier_ConfigSchema::$singleton = $prototype; - } elseif (HTMLPurifier_ConfigSchema::$singleton === null || $prototype === true) { - HTMLPurifier_ConfigSchema::$singleton = HTMLPurifier_ConfigSchema::makeFromSerial(); - } - return HTMLPurifier_ConfigSchema::$singleton; - } - - /** - * Defines a directive for configuration - * @warning Will fail of directive's namespace is defined. - * @warning This method's signature is slightly different from the legacy - * define() static method! Beware! - * @param $namespace Namespace the directive is in - * @param $name Key of directive - * @param $default Default value of directive - * @param $type Allowed type of the directive. See - * HTMLPurifier_DirectiveDef::$type for allowed values - * @param $allow_null Whether or not to allow null values - */ - public function add($namespace, $name, $default, $type, $allow_null) { - $obj = new stdclass(); - $obj->type = is_int($type) ? $type : HTMLPurifier_VarParser::$types[$type]; - if ($allow_null) $obj->allow_null = true; - $this->info[$namespace][$name] = $obj; - $this->defaults[$namespace][$name] = $default; - } - - /** - * Defines a namespace for directives to be put into. - * @warning This is slightly different from the corresponding static - * method. - * @param $namespace Namespace's name - */ - public function addNamespace($namespace) { - $this->info[$namespace] = array(); - $this->defaults[$namespace] = array(); - } - - /** - * Defines a directive value alias. - * - * Directive value aliases are convenient for developers because it lets - * them set a directive to several values and get the same result. - * @param $namespace Directive's namespace - * @param $name Name of Directive - * @param $aliases Hash of aliased values to the real alias - */ - public function addValueAliases($namespace, $name, $aliases) { - if (!isset($this->info[$namespace][$name]->aliases)) { - $this->info[$namespace][$name]->aliases = array(); - } - foreach ($aliases as $alias => $real) { - $this->info[$namespace][$name]->aliases[$alias] = $real; - } - } - - /** - * Defines a set of allowed values for a directive. - * @warning This is slightly different from the corresponding static - * method definition. - * @param $namespace Namespace of directive - * @param $name Name of directive - * @param $allowed Lookup array of allowed values - */ - public function addAllowedValues($namespace, $name, $allowed) { - $this->info[$namespace][$name]->allowed = $allowed; - } - - /** - * Defines a directive alias for backwards compatibility - * @param $namespace - * @param $name Directive that will be aliased - * @param $new_namespace - * @param $new_name Directive that the alias will be to - */ - public function addAlias($namespace, $name, $new_namespace, $new_name) { - $obj = new stdclass; - $obj->namespace = $new_namespace; - $obj->name = $new_name; - $obj->isAlias = true; - $this->info[$namespace][$name] = $obj; - } - - /** - * Replaces any stdclass that only has the type property with type integer. - */ - public function postProcess() { - foreach ($this->info as $namespace => $info) { - foreach ($info as $directive => $v) { - if (count((array) $v) == 1) { - $this->info[$namespace][$directive] = $v->type; - } elseif (count((array) $v) == 2 && isset($v->allow_null)) { - $this->info[$namespace][$directive] = -$v->type; - } - } - } - } - - // DEPRECATED METHODS - - /** @see HTMLPurifier_ConfigSchema->set() */ - public static function define($namespace, $name, $default, $type, $description) { - HTMLPurifier_ConfigSchema::deprecated(__METHOD__); - $type_values = explode('/', $type, 2); - $type = $type_values[0]; - $modifier = isset($type_values[1]) ? $type_values[1] : false; - $allow_null = ($modifier === 'null'); - $def = HTMLPurifier_ConfigSchema::instance(); - $def->add($namespace, $name, $default, $type, $allow_null); - } - - /** @see HTMLPurifier_ConfigSchema->addNamespace() */ - public static function defineNamespace($namespace, $description) { - HTMLPurifier_ConfigSchema::deprecated(__METHOD__); - $def = HTMLPurifier_ConfigSchema::instance(); - $def->addNamespace($namespace); - } - - /** @see HTMLPurifier_ConfigSchema->addValueAliases() */ - public static function defineValueAliases($namespace, $name, $aliases) { - HTMLPurifier_ConfigSchema::deprecated(__METHOD__); - $def = HTMLPurifier_ConfigSchema::instance(); - $def->addValueAliases($namespace, $name, $aliases); - } - - /** @see HTMLPurifier_ConfigSchema->addAllowedValues() */ - public static function defineAllowedValues($namespace, $name, $allowed_values) { - HTMLPurifier_ConfigSchema::deprecated(__METHOD__); - $allowed = array(); - foreach ($allowed_values as $value) { - $allowed[$value] = true; - } - $def = HTMLPurifier_ConfigSchema::instance(); - $def->addAllowedValues($namespace, $name, $allowed); - } - - /** @see HTMLPurifier_ConfigSchema->addAlias() */ - public static function defineAlias($namespace, $name, $new_namespace, $new_name) { - HTMLPurifier_ConfigSchema::deprecated(__METHOD__); - $def = HTMLPurifier_ConfigSchema::instance(); - $def->addAlias($namespace, $name, $new_namespace, $new_name); - } - - /** @deprecated, use HTMLPurifier_VarParser->parse() */ - public function validate($a, $b, $c = false) { - trigger_error("HTMLPurifier_ConfigSchema->validate deprecated, use HTMLPurifier_VarParser->parse instead", E_USER_NOTICE); - $parser = new HTMLPurifier_VarParser(); - return $parser->parse($a, $b, $c); - } - - /** - * Throws an E_USER_NOTICE stating that a method is deprecated. - */ - private static function deprecated($method) { - trigger_error("Static HTMLPurifier_ConfigSchema::$method deprecated, use add*() method instead", E_USER_NOTICE); - } - -} - - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php deleted file mode 100644 index c1423bb..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php +++ /dev/null @@ -1,50 +0,0 @@ -namespaces as $n) { - $schema->addNamespace($n->namespace); - } - foreach ($interchange->directives as $d) { - $schema->add( - $d->id->namespace, - $d->id->directive, - $d->default, - $d->type, - $d->typeAllowsNull - ); - if ($d->allowed !== null) { - $schema->addAllowedValues( - $d->id->namespace, - $d->id->directive, - $d->allowed - ); - } - foreach ($d->aliases as $alias) { - $schema->addAlias( - $alias->namespace, - $alias->directive, - $d->id->namespace, - $d->id->directive - ); - } - if ($d->valueAliases !== null) { - $schema->addValueAliases( - $d->id->namespace, - $d->id->directive, - $d->valueAliases - ); - } - } - $schema->postProcess(); - return $schema; - } - -} diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/Xml.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/Xml.php deleted file mode 100644 index 32a724c..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/Xml.php +++ /dev/null @@ -1,106 +0,0 @@ -startElement('div'); - - $purifier = HTMLPurifier::getInstance(); - $html = $purifier->purify($html); - $this->writeAttribute('xmlns', 'http://www.w3.org/1999/xhtml'); - $this->writeRaw($html); - - $this->endElement(); // div - } - - protected function export($var) { - if ($var === array()) return 'array()'; - return var_export($var, true); - } - - public function build($interchange) { - // global access, only use as last resort - $this->interchange = $interchange; - - $this->setIndent(true); - $this->startDocument('1.0', 'UTF-8'); - $this->startElement('configdoc'); - $this->writeElement('title', $interchange->name); - - foreach ($interchange->namespaces as $namespace) { - $this->buildNamespace($namespace); - } - - $this->endElement(); // configdoc - $this->flush(); - } - - public function buildNamespace($namespace) { - $this->startElement('namespace'); - $this->writeAttribute('id', $namespace->namespace); - - $this->writeElement('name', $namespace->namespace); - $this->startElement('description'); - $this->writeHTMLDiv($namespace->description); - $this->endElement(); // description - - foreach ($this->interchange->directives as $directive) { - if ($directive->id->namespace !== $namespace->namespace) continue; - $this->buildDirective($directive); - } - - $this->endElement(); // namespace - } - - public function buildDirective($directive) { - $this->startElement('directive'); - $this->writeAttribute('id', $directive->id->toString()); - - $this->writeElement('name', $directive->id->directive); - - $this->startElement('aliases'); - foreach ($directive->aliases as $alias) $this->writeElement('alias', $alias->toString()); - $this->endElement(); // aliases - - $this->startElement('constraints'); - if ($directive->version) $this->writeElement('version', $directive->version); - $this->startElement('type'); - if ($directive->typeAllowsNull) $this->writeAttribute('allow-null', 'yes'); - $this->text($directive->type); - $this->endElement(); // type - if ($directive->allowed) { - $this->startElement('allowed'); - foreach ($directive->allowed as $value => $x) $this->writeElement('value', $value); - $this->endElement(); // allowed - } - $this->writeElement('default', $this->export($directive->default)); - $this->writeAttribute('xml:space', 'preserve'); - if ($directive->external) { - $this->startElement('external'); - foreach ($directive->external as $project) $this->writeElement('project', $project); - $this->endElement(); - } - $this->endElement(); // constraints - - if ($directive->deprecatedVersion) { - $this->startElement('deprecated'); - $this->writeElement('version', $directive->deprecatedVersion); - $this->writeElement('use', $directive->deprecatedUse->toString()); - $this->endElement(); // deprecated - } - - $this->startElement('description'); - $this->writeHTMLDiv($directive->description); - $this->endElement(); // description - - $this->endElement(); // directive - } - -} diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Exception.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Exception.php deleted file mode 100644 index 3a34460..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Exception.php +++ /dev/null @@ -1,9 +0,0 @@ - array(namespace info) - */ - public $namespaces = array(); - - /** - * Array of Directive ID => array(directive info) - */ - public $directives = array(); - - /** - * Adds a namespace array to $namespaces - */ - public function addNamespace($namespace) { - if (isset($this->namespaces[$i = $namespace->namespace])) { - throw new HTMLPurifier_ConfigSchema_Exception("Cannot redefine namespace '$i'"); - } - $this->namespaces[$i] = $namespace; - } - - /** - * Adds a directive array to $directives - */ - public function addDirective($directive) { - if (isset($this->directives[$i = $directive->id->toString()])) { - throw new HTMLPurifier_ConfigSchema_Exception("Cannot redefine directive '$i'"); - } - $this->directives[$i] = $directive; - } - - /** - * Convenience function to perform standard validation. Throws exception - * on failed validation. - */ - public function validate() { - $validator = new HTMLPurifier_ConfigSchema_Validator(); - return $validator->validate($this); - } - -} diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Directive.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Directive.php deleted file mode 100644 index bbfe8c4..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Directive.php +++ /dev/null @@ -1,75 +0,0 @@ - true). - * Null if all values are allowed. - */ - public $allowed; - - /** - * List of aliases for the directive, - * e.g. array(new HTMLPurifier_ConfigSchema_Interchange_Id('Ns', 'Dir'))). - */ - public $aliases = array(); - - /** - * Hash of value aliases, e.g. array('alt' => 'real'). Null if value - * aliasing is disabled (necessary for non-scalar types). - */ - public $valueAliases; - - /** - * Version of HTML Purifier the directive was introduced, e.g. '1.3.1'. - * Null if the directive has always existed. - */ - public $version; - - /** - * ID of directive that supercedes this old directive, is an instance - * of HTMLPurifier_ConfigSchema_Interchange_Id. Null if not deprecated. - */ - public $deprecatedUse; - - /** - * Version of HTML Purifier this directive was deprecated. Null if not - * deprecated. - */ - public $deprecatedVersion; - - /** - * List of external projects this directive depends on, e.g. array('CSSTidy'). - */ - public $external = array(); - -} diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Id.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Id.php deleted file mode 100644 index b4803e7..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Id.php +++ /dev/null @@ -1,29 +0,0 @@ -namespace = $namespace; - $this->directive = $directive; - } - - /** - * @warning This is NOT magic, to ensure that people don't abuse SPL and - * cause problems for PHP 5.0 support. - */ - public function toString() { - return $this->namespace . '.' . $this->directive; - } - - public static function make($id) { - list($namespace, $directive) = explode('.', $id); - return new HTMLPurifier_ConfigSchema_Interchange_Id($namespace, $directive); - } - -} diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Namespace.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Namespace.php deleted file mode 100644 index b4fd002..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Namespace.php +++ /dev/null @@ -1,19 +0,0 @@ -varParser = $varParser ? $varParser : new HTMLPurifier_VarParser_Native(); - } - - public static function buildFromDirectory($dir = null) { - $parser = new HTMLPurifier_StringHashParser(); - $builder = new HTMLPurifier_ConfigSchema_InterchangeBuilder(); - $interchange = new HTMLPurifier_ConfigSchema_Interchange(); - - if (!$dir) $dir = HTMLPURIFIER_PREFIX . '/HTMLPurifier/ConfigSchema/schema/'; - $info = parse_ini_file($dir . 'info.ini'); - $interchange->name = $info['name']; - - $files = array(); - $dh = opendir($dir); - while (false !== ($file = readdir($dh))) { - if (!$file || $file[0] == '.' || strrchr($file, '.') !== '.txt') { - continue; - } - $files[] = $file; - } - closedir($dh); - - sort($files); - foreach ($files as $file) { - $builder->build( - $interchange, - new HTMLPurifier_StringHash( $parser->parseFile($dir . $file) ) - ); - } - - return $interchange; - } - - /** - * Builds an interchange object based on a hash. - * @param $interchange HTMLPurifier_ConfigSchema_Interchange object to build - * @param $hash HTMLPurifier_ConfigSchema_StringHash source data - */ - public function build($interchange, $hash) { - if (!$hash instanceof HTMLPurifier_StringHash) { - $hash = new HTMLPurifier_StringHash($hash); - } - if (!isset($hash['ID'])) { - throw new HTMLPurifier_ConfigSchema_Exception('Hash does not have any ID'); - } - if (strpos($hash['ID'], '.') === false) { - $this->buildNamespace($interchange, $hash); - } else { - $this->buildDirective($interchange, $hash); - } - $this->_findUnused($hash); - } - - public function buildNamespace($interchange, $hash) { - $namespace = new HTMLPurifier_ConfigSchema_Interchange_Namespace(); - $namespace->namespace = $hash->offsetGet('ID'); - if (isset($hash['DESCRIPTION'])) { - $namespace->description = $hash->offsetGet('DESCRIPTION'); - } - $interchange->addNamespace($namespace); - } - - public function buildDirective($interchange, $hash) { - $directive = new HTMLPurifier_ConfigSchema_Interchange_Directive(); - - // These are required elements: - $directive->id = $this->id($hash->offsetGet('ID')); - $id = $directive->id->toString(); // convenience - - if (isset($hash['TYPE'])) { - $type = explode('/', $hash->offsetGet('TYPE')); - if (isset($type[1])) $directive->typeAllowsNull = true; - $directive->type = $type[0]; - } else { - throw new HTMLPurifier_ConfigSchema_Exception("TYPE in directive hash '$id' not defined"); - } - - if (isset($hash['DEFAULT'])) { - try { - $directive->default = $this->varParser->parse($hash->offsetGet('DEFAULT'), $directive->type, $directive->typeAllowsNull); - } catch (HTMLPurifier_VarParserException $e) { - throw new HTMLPurifier_ConfigSchema_Exception($e->getMessage() . " in DEFAULT in directive hash '$id'"); - } - } - - if (isset($hash['DESCRIPTION'])) { - $directive->description = $hash->offsetGet('DESCRIPTION'); - } - - if (isset($hash['ALLOWED'])) { - $directive->allowed = $this->lookup($this->evalArray($hash->offsetGet('ALLOWED'))); - } - - if (isset($hash['VALUE-ALIASES'])) { - $directive->valueAliases = $this->evalArray($hash->offsetGet('VALUE-ALIASES')); - } - - if (isset($hash['ALIASES'])) { - $raw_aliases = trim($hash->offsetGet('ALIASES')); - $aliases = preg_split('/\s*,\s*/', $raw_aliases); - foreach ($aliases as $alias) { - $directive->aliases[] = $this->id($alias); - } - } - - if (isset($hash['VERSION'])) { - $directive->version = $hash->offsetGet('VERSION'); - } - - if (isset($hash['DEPRECATED-USE'])) { - $directive->deprecatedUse = $this->id($hash->offsetGet('DEPRECATED-USE')); - } - - if (isset($hash['DEPRECATED-VERSION'])) { - $directive->deprecatedVersion = $hash->offsetGet('DEPRECATED-VERSION'); - } - - if (isset($hash['EXTERNAL'])) { - $directive->external = preg_split('/\s*,\s*/', trim($hash->offsetGet('EXTERNAL'))); - } - - $interchange->addDirective($directive); - } - - /** - * Evaluates an array PHP code string without array() wrapper - */ - protected function evalArray($contents) { - return eval('return array('. $contents .');'); - } - - /** - * Converts an array list into a lookup array. - */ - protected function lookup($array) { - $ret = array(); - foreach ($array as $val) $ret[$val] = true; - return $ret; - } - - /** - * Convenience function that creates an HTMLPurifier_ConfigSchema_Interchange_Id - * object based on a string Id. - */ - protected function id($id) { - return HTMLPurifier_ConfigSchema_Interchange_Id::make($id); - } - - /** - * Triggers errors for any unused keys passed in the hash; such keys - * may indicate typos, missing values, etc. - * @param $hash Instance of ConfigSchema_StringHash to check. - */ - protected function _findUnused($hash) { - $accessed = $hash->getAccessed(); - foreach ($hash as $k => $v) { - if (!isset($accessed[$k])) { - trigger_error("String hash key '$k' not used by builder", E_USER_NOTICE); - } - } - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Validator.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Validator.php deleted file mode 100644 index eff487f..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Validator.php +++ /dev/null @@ -1,223 +0,0 @@ -parser = new HTMLPurifier_VarParser(); - } - - /** - * Validates a fully-formed interchange object. Throws an - * HTMLPurifier_ConfigSchema_Exception if there's a problem. - */ - public function validate($interchange) { - $this->interchange = $interchange; - $this->aliases = array(); - // PHP is a bit lax with integer <=> string conversions in - // arrays, so we don't use the identical !== comparison - foreach ($interchange->namespaces as $i => $namespace) { - if ($i != $namespace->namespace) $this->error(false, "Integrity violation: key '$i' does not match internal id '{$namespace->namespace}'"); - $this->validateNamespace($namespace); - } - foreach ($interchange->directives as $i => $directive) { - $id = $directive->id->toString(); - if ($i != $id) $this->error(false, "Integrity violation: key '$i' does not match internal id '$id'"); - $this->validateDirective($directive); - } - return true; - } - - /** - * Validates a HTMLPurifier_ConfigSchema_Interchange_Namespace object. - */ - public function validateNamespace($n) { - $this->context[] = "namespace '{$n->namespace}'"; - $this->with($n, 'namespace') - ->assertNotEmpty() - ->assertAlnum(); // implicit assertIsString handled by InterchangeBuilder - $this->with($n, 'description') - ->assertNotEmpty() - ->assertIsString(); // handled by InterchangeBuilder - array_pop($this->context); - } - - /** - * Validates a HTMLPurifier_ConfigSchema_Interchange_Id object. - */ - public function validateId($id) { - $id_string = $id->toString(); - $this->context[] = "id '$id_string'"; - if (!$id instanceof HTMLPurifier_ConfigSchema_Interchange_Id) { - // handled by InterchangeBuilder - $this->error(false, 'is not an instance of HTMLPurifier_ConfigSchema_Interchange_Id'); - } - if (!isset($this->interchange->namespaces[$id->namespace])) { - $this->error('namespace', 'does not exist'); // assumes that the namespace was validated already - } - $this->with($id, 'directive') - ->assertNotEmpty() - ->assertAlnum(); // implicit assertIsString handled by InterchangeBuilder - array_pop($this->context); - } - - /** - * Validates a HTMLPurifier_ConfigSchema_Interchange_Directive object. - */ - public function validateDirective($d) { - $id = $d->id->toString(); - $this->context[] = "directive '$id'"; - $this->validateId($d->id); - - $this->with($d, 'description') - ->assertNotEmpty(); - - // BEGIN - handled by InterchangeBuilder - $this->with($d, 'type') - ->assertNotEmpty(); - $this->with($d, 'typeAllowsNull') - ->assertIsBool(); - try { - // This also tests validity of $d->type - $this->parser->parse($d->default, $d->type, $d->typeAllowsNull); - } catch (HTMLPurifier_VarParserException $e) { - $this->error('default', 'had error: ' . $e->getMessage()); - } - // END - handled by InterchangeBuilder - - if (!is_null($d->allowed) || !empty($d->valueAliases)) { - // allowed and valueAliases require that we be dealing with - // strings, so check for that early. - $d_int = HTMLPurifier_VarParser::$types[$d->type]; - if (!isset(HTMLPurifier_VarParser::$stringTypes[$d_int])) { - $this->error('type', 'must be a string type when used with allowed or value aliases'); - } - } - - $this->validateDirectiveAllowed($d); - $this->validateDirectiveValueAliases($d); - $this->validateDirectiveAliases($d); - - array_pop($this->context); - } - - /** - * Extra validation if $allowed member variable of - * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. - */ - public function validateDirectiveAllowed($d) { - if (is_null($d->allowed)) return; - $this->with($d, 'allowed') - ->assertNotEmpty() - ->assertIsLookup(); // handled by InterchangeBuilder - if (is_string($d->default) && !isset($d->allowed[$d->default])) { - $this->error('default', 'must be an allowed value'); - } - $this->context[] = 'allowed'; - foreach ($d->allowed as $val => $x) { - if (!is_string($val)) $this->error("value $val", 'must be a string'); - } - array_pop($this->context); - } - - /** - * Extra validation if $valueAliases member variable of - * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. - */ - public function validateDirectiveValueAliases($d) { - if (is_null($d->valueAliases)) return; - $this->with($d, 'valueAliases') - ->assertIsArray(); // handled by InterchangeBuilder - $this->context[] = 'valueAliases'; - foreach ($d->valueAliases as $alias => $real) { - if (!is_string($alias)) $this->error("alias $alias", 'must be a string'); - if (!is_string($real)) $this->error("alias target $real from alias '$alias'", 'must be a string'); - if ($alias === $real) { - $this->error("alias '$alias'", "must not be an alias to itself"); - } - } - if (!is_null($d->allowed)) { - foreach ($d->valueAliases as $alias => $real) { - if (isset($d->allowed[$alias])) { - $this->error("alias '$alias'", 'must not be an allowed value'); - } elseif (!isset($d->allowed[$real])) { - $this->error("alias '$alias'", 'must be an alias to an allowed value'); - } - } - } - array_pop($this->context); - } - - /** - * Extra validation if $aliases member variable of - * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. - */ - public function validateDirectiveAliases($d) { - $this->with($d, 'aliases') - ->assertIsArray(); // handled by InterchangeBuilder - $this->context[] = 'aliases'; - foreach ($d->aliases as $alias) { - $this->validateId($alias); - $s = $alias->toString(); - if (isset($this->interchange->directives[$s])) { - $this->error("alias '$s'", 'collides with another directive'); - } - if (isset($this->aliases[$s])) { - $other_directive = $this->aliases[$s]; - $this->error("alias '$s'", "collides with alias for directive '$other_directive'"); - } - $this->aliases[$s] = $d->id->toString(); - } - array_pop($this->context); - } - - // protected helper functions - - /** - * Convenience function for generating HTMLPurifier_ConfigSchema_ValidatorAtom - * for validating simple member variables of objects. - */ - protected function with($obj, $member) { - return new HTMLPurifier_ConfigSchema_ValidatorAtom($this->getFormattedContext(), $obj, $member); - } - - /** - * Emits an error, providing helpful context. - */ - protected function error($target, $msg) { - if ($target !== false) $prefix = ucfirst($target) . ' in ' . $this->getFormattedContext(); - else $prefix = ucfirst($this->getFormattedContext()); - throw new HTMLPurifier_ConfigSchema_Exception(trim($prefix . ' ' . $msg)); - } - - /** - * Returns a formatted context string. - */ - protected function getFormattedContext() { - return implode(' in ', array_reverse($this->context)); - } - -} diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/ValidatorAtom.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/ValidatorAtom.php deleted file mode 100644 index 5d77903..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/ValidatorAtom.php +++ /dev/null @@ -1,66 +0,0 @@ -context = $context; - $this->obj = $obj; - $this->member = $member; - $this->contents =& $obj->$member; - } - - public function assertIsString() { - if (!is_string($this->contents)) $this->error('must be a string'); - return $this; - } - - public function assertIsBool() { - if (!is_bool($this->contents)) $this->error('must be a boolean'); - return $this; - } - - public function assertIsArray() { - if (!is_array($this->contents)) $this->error('must be an array'); - return $this; - } - - public function assertNotNull() { - if ($this->contents === null) $this->error('must not be null'); - return $this; - } - - public function assertAlnum() { - $this->assertIsString(); - if (!ctype_alnum($this->contents)) $this->error('must be alphanumeric'); - return $this; - } - - public function assertNotEmpty() { - if (empty($this->contents)) $this->error('must not be empty'); - return $this; - } - - public function assertIsLookup() { - $this->assertIsArray(); - foreach ($this->contents as $v) { - if ($v !== true) $this->error('must be a lookup array'); - } - return $this; - } - - protected function error($msg) { - throw new HTMLPurifier_ConfigSchema_Exception(ucfirst($this->member) . ' in ' . $this->context . ' ' . $msg); - } - -} - - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser deleted file mode 100644 index 1ac5ff6..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser +++ /dev/null @@ -1 +0,0 @@ -O:25:"HTMLPurifier_ConfigSchema":2:{s:8:"defaults";a:12:{s:4:"Attr";a:12:{s:19:"AllowedFrameTargets";a:0:{}s:10:"AllowedRel";a:0:{}s:10:"AllowedRev";a:0:{}s:15:"DefaultImageAlt";N;s:19:"DefaultInvalidImage";s:0:"";s:22:"DefaultInvalidImageAlt";s:13:"Invalid image";s:14:"DefaultTextDir";s:3:"ltr";s:8:"EnableID";b:0;s:11:"IDBlacklist";a:0:{}s:17:"IDBlacklistRegexp";N;s:8:"IDPrefix";s:0:"";s:13:"IDPrefixLocal";s:0:"";}s:10:"AutoFormat";a:6:{s:13:"AutoParagraph";b:0;s:6:"Custom";a:0:{}s:14:"DisplayLinkURI";b:0;s:7:"Linkify";b:0;s:15:"PurifierLinkify";b:0;s:11:"RemoveEmpty";b:0;}s:15:"AutoFormatParam";a:1:{s:21:"PurifierLinkifyDocURL";s:3:"#%s";}s:3:"CSS";a:6:{s:14:"AllowImportant";b:0;s:11:"AllowTricky";b:0;s:17:"AllowedProperties";N;s:13:"DefinitionRev";i:1;s:12:"MaxImgLength";s:6:"1200px";s:11:"Proprietary";b:0;}s:5:"Cache";a:2:{s:14:"DefinitionImpl";s:10:"Serializer";s:14:"SerializerPath";N;}s:4:"Core";a:15:{s:17:"AggressivelyFixLt";b:1;s:13:"CollectErrors";b:0;s:13:"ColorKeywords";a:17:{s:6:"maroon";s:7:"#800000";s:3:"red";s:7:"#FF0000";s:6:"orange";s:7:"#FFA500";s:6:"yellow";s:7:"#FFFF00";s:5:"olive";s:7:"#808000";s:6:"purple";s:7:"#800080";s:7:"fuchsia";s:7:"#FF00FF";s:5:"white";s:7:"#FFFFFF";s:4:"lime";s:7:"#00FF00";s:5:"green";s:7:"#008000";s:4:"navy";s:7:"#000080";s:4:"blue";s:7:"#0000FF";s:4:"aqua";s:7:"#00FFFF";s:4:"teal";s:7:"#008080";s:5:"black";s:7:"#000000";s:6:"silver";s:7:"#C0C0C0";s:4:"gray";s:7:"#808080";}s:25:"ConvertDocumentToFragment";b:1;s:31:"DirectLexLineNumberSyncInterval";i:0;s:8:"Encoding";s:5:"utf-8";s:21:"EscapeInvalidChildren";b:0;s:17:"EscapeInvalidTags";b:0;s:24:"EscapeNonASCIICharacters";b:0;s:14:"HiddenElements";a:2:{s:6:"script";b:1;s:5:"style";b:1;}s:8:"Language";s:2:"en";s:9:"LexerImpl";N;s:19:"MaintainLineNumbers";N;s:16:"RemoveInvalidImg";b:1;s:20:"RemoveScriptContents";N;}s:6:"Filter";a:3:{s:6:"Custom";a:0:{}s:18:"ExtractStyleBlocks";b:0;s:7:"YouTube";b:0;}s:11:"FilterParam";a:3:{s:26:"ExtractStyleBlocksEscaping";b:1;s:23:"ExtractStyleBlocksScope";N;s:26:"ExtractStyleBlocksTidyImpl";N;}s:4:"HTML";a:23:{s:7:"Allowed";N;s:17:"AllowedAttributes";N;s:15:"AllowedElements";N;s:14:"AllowedModules";N;s:12:"BlockWrapper";s:1:"p";s:11:"CoreModules";a:7:{s:9:"Structure";b:1;s:4:"Text";b:1;s:9:"Hypertext";b:1;s:4:"List";b:1;s:22:"NonXMLCommonAttributes";b:1;s:19:"XMLCommonAttributes";b:1;s:16:"CommonAttributes";b:1;}s:13:"CustomDoctype";N;s:12:"DefinitionID";N;s:13:"DefinitionRev";i:1;s:7:"Doctype";N;s:19:"ForbiddenAttributes";a:0:{}s:17:"ForbiddenElements";a:0:{}s:12:"MaxImgLength";i:1200;s:6:"Parent";s:3:"div";s:11:"Proprietary";b:0;s:9:"SafeEmbed";b:0;s:10:"SafeObject";b:0;s:6:"Strict";b:0;s:7:"TidyAdd";a:0:{}s:9:"TidyLevel";s:6:"medium";s:10:"TidyRemove";a:0:{}s:7:"Trusted";b:0;s:5:"XHTML";b:1;}s:6:"Output";a:4:{s:21:"CommentScriptContents";b:1;s:7:"Newline";N;s:8:"SortAttr";b:0;s:10:"TidyFormat";b:0;}s:4:"Test";a:1:{s:12:"ForceNoIconv";b:0;}s:3:"URI";a:16:{s:14:"AllowedSchemes";a:6:{s:4:"http";b:1;s:5:"https";b:1;s:6:"mailto";b:1;s:3:"ftp";b:1;s:4:"nntp";b:1;s:4:"news";b:1;}s:4:"Base";N;s:13:"DefaultScheme";s:4:"http";s:12:"DefinitionID";N;s:13:"DefinitionRev";i:1;s:7:"Disable";b:0;s:15:"DisableExternal";b:0;s:24:"DisableExternalResources";b:0;s:16:"DisableResources";b:0;s:4:"Host";N;s:13:"HostBlacklist";a:0:{}s:12:"MakeAbsolute";b:0;s:5:"Munge";N;s:14:"MungeResources";b:0;s:14:"MungeSecretKey";N;s:22:"OverrideAllowedSchemes";b:1;}}s:4:"info";a:12:{s:4:"Attr";a:13:{s:19:"AllowedFrameTargets";i:8;s:10:"AllowedRel";i:8;s:10:"AllowedRev";i:8;s:15:"DefaultImageAlt";i:-1;s:19:"DefaultInvalidImage";i:1;s:22:"DefaultInvalidImageAlt";i:1;s:14:"DefaultTextDir";O:8:"stdClass":2:{s:4:"type";i:1;s:7:"allowed";a:2:{s:3:"ltr";b:1;s:3:"rtl";b:1;}}s:8:"EnableID";i:7;s:11:"IDBlacklist";i:9;s:17:"IDBlacklistRegexp";i:-1;s:8:"IDPrefix";i:1;s:13:"IDPrefixLocal";i:1;s:10:"DisableURI";O:8:"stdClass":3:{s:9:"namespace";s:3:"URI";s:4:"name";s:7:"Disable";s:7:"isAlias";b:1;}}s:10:"AutoFormat";a:6:{s:13:"AutoParagraph";i:7;s:6:"Custom";i:9;s:14:"DisplayLinkURI";i:7;s:7:"Linkify";i:7;s:15:"PurifierLinkify";i:7;s:11:"RemoveEmpty";i:7;}s:15:"AutoFormatParam";a:1:{s:21:"PurifierLinkifyDocURL";i:1;}s:3:"CSS";a:6:{s:14:"AllowImportant";i:7;s:11:"AllowTricky";i:7;s:17:"AllowedProperties";i:-8;s:13:"DefinitionRev";i:5;s:12:"MaxImgLength";i:-1;s:11:"Proprietary";i:7;}s:5:"Cache";a:2:{s:14:"DefinitionImpl";i:-1;s:14:"SerializerPath";i:-1;}s:4:"Core";a:20:{s:15:"DefinitionCache";O:8:"stdClass":3:{s:9:"namespace";s:5:"Cache";s:4:"name";s:14:"DefinitionImpl";s:7:"isAlias";b:1;}s:17:"AggressivelyFixLt";i:7;s:13:"CollectErrors";i:7;s:13:"ColorKeywords";i:10;s:25:"ConvertDocumentToFragment";i:7;s:19:"AcceptFullDocuments";O:8:"stdClass":3:{s:9:"namespace";s:4:"Core";s:4:"name";s:25:"ConvertDocumentToFragment";s:7:"isAlias";b:1;}s:31:"DirectLexLineNumberSyncInterval";i:5;s:8:"Encoding";i:2;s:21:"EscapeInvalidChildren";i:7;s:17:"EscapeInvalidTags";i:7;s:24:"EscapeNonASCIICharacters";i:7;s:14:"HiddenElements";i:8;s:8:"Language";i:1;s:9:"LexerImpl";i:-11;s:19:"MaintainLineNumbers";i:-7;s:16:"RemoveInvalidImg";i:7;s:20:"RemoveScriptContents";i:-7;s:5:"XHTML";O:8:"stdClass":3:{s:9:"namespace";s:4:"HTML";s:4:"name";s:5:"XHTML";s:7:"isAlias";b:1;}s:21:"CommentScriptContents";O:8:"stdClass":3:{s:9:"namespace";s:6:"Output";s:4:"name";s:21:"CommentScriptContents";s:7:"isAlias";b:1;}s:10:"TidyFormat";O:8:"stdClass":3:{s:9:"namespace";s:6:"Output";s:4:"name";s:10:"TidyFormat";s:7:"isAlias";b:1;}}s:6:"Filter";a:5:{s:6:"Custom";i:9;s:18:"ExtractStyleBlocks";i:7;s:7:"YouTube";i:7;s:26:"ExtractStyleBlocksEscaping";O:8:"stdClass":3:{s:9:"namespace";s:11:"FilterParam";s:4:"name";s:26:"ExtractStyleBlocksEscaping";s:7:"isAlias";b:1;}s:23:"ExtractStyleBlocksScope";O:8:"stdClass":3:{s:9:"namespace";s:11:"FilterParam";s:4:"name";s:23:"ExtractStyleBlocksScope";s:7:"isAlias";b:1;}}s:11:"FilterParam";a:3:{s:26:"ExtractStyleBlocksEscaping";i:7;s:23:"ExtractStyleBlocksScope";i:-1;s:26:"ExtractStyleBlocksTidyImpl";i:-11;}s:4:"HTML";a:24:{s:12:"EnableAttrID";O:8:"stdClass":3:{s:9:"namespace";s:4:"Attr";s:4:"name";s:8:"EnableID";s:7:"isAlias";b:1;}s:7:"Allowed";i:-4;s:17:"AllowedAttributes";i:-8;s:15:"AllowedElements";i:-8;s:14:"AllowedModules";i:-8;s:12:"BlockWrapper";i:1;s:11:"CoreModules";i:8;s:13:"CustomDoctype";i:-1;s:12:"DefinitionID";i:-1;s:13:"DefinitionRev";i:5;s:7:"Doctype";O:8:"stdClass":3:{s:4:"type";i:1;s:10:"allow_null";b:1;s:7:"allowed";a:5:{s:22:"HTML 4.01 Transitional";b:1;s:16:"HTML 4.01 Strict";b:1;s:22:"XHTML 1.0 Transitional";b:1;s:16:"XHTML 1.0 Strict";b:1;s:9:"XHTML 1.1";b:1;}}s:19:"ForbiddenAttributes";i:8;s:17:"ForbiddenElements";i:8;s:12:"MaxImgLength";i:-5;s:6:"Parent";i:1;s:11:"Proprietary";i:7;s:9:"SafeEmbed";i:7;s:10:"SafeObject";i:7;s:6:"Strict";i:7;s:7:"TidyAdd";i:8;s:9:"TidyLevel";O:8:"stdClass":2:{s:4:"type";i:1;s:7:"allowed";a:4:{s:4:"none";b:1;s:5:"light";b:1;s:6:"medium";b:1;s:5:"heavy";b:1;}}s:10:"TidyRemove";i:8;s:7:"Trusted";i:7;s:5:"XHTML";i:7;}s:6:"Output";a:4:{s:21:"CommentScriptContents";i:7;s:7:"Newline";i:-1;s:8:"SortAttr";i:7;s:10:"TidyFormat";i:7;}s:4:"Test";a:1:{s:12:"ForceNoIconv";i:7;}s:3:"URI";a:16:{s:14:"AllowedSchemes";i:8;s:4:"Base";i:-1;s:13:"DefaultScheme";i:1;s:12:"DefinitionID";i:-1;s:13:"DefinitionRev";i:5;s:7:"Disable";i:7;s:15:"DisableExternal";i:7;s:24:"DisableExternalResources";i:7;s:16:"DisableResources";i:7;s:4:"Host";i:-1;s:13:"HostBlacklist";i:9;s:12:"MakeAbsolute";i:7;s:5:"Munge";i:-1;s:14:"MungeResources";i:7;s:14:"MungeSecretKey";i:-1;s:22:"OverrideAllowedSchemes";i:7;}}} \ No newline at end of file diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt deleted file mode 100644 index 6cecfa2..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt +++ /dev/null @@ -1,11 +0,0 @@ -Attr.AllowedFrameTargets -TYPE: lookup -DEFAULT: array() ---DESCRIPTION-- -Lookup table of all allowed link frame targets. Some commonly used link -targets include _blank, _self, _parent and _top. Values should be -lowercase, as validation will be done in a case-sensitive manner despite -W3C's recommendation. XHTML 1.0 Strict does not permit the target attribute -so this directive will have no effect in that doctype. XHTML 1.1 does not -enable the Target module by default, you will have to manually enable it -(see the module documentation for more details.) diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt deleted file mode 100644 index 26bbc37..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt +++ /dev/null @@ -1,8 +0,0 @@ -Attr.AllowedRel -TYPE: lookup -VERSION: 1.6.0 -DEFAULT: array() ---DESCRIPTION-- -List of allowed forward document relationships in the rel attribute. Common -values may be nofollow or print. By default, this is empty, meaning that no -document relationships are allowed. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt deleted file mode 100644 index b007bc5..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt +++ /dev/null @@ -1,8 +0,0 @@ -Attr.AllowedRev -TYPE: lookup -VERSION: 1.6.0 -DEFAULT: array() ---DESCRIPTION-- -List of allowed reverse document relationships in the rev attribute. This -attribute is a bit of an edge-case; if you don't know what it is for, stay -away. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt deleted file mode 100644 index f474a9c..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt +++ /dev/null @@ -1,9 +0,0 @@ -Attr.DefaultImageAlt -TYPE: string/null -DEFAULT: null ---DESCRIPTION-- -This is the content of the alt tag of an image if the user had not -previously specified an alt attribute. This applies to all images without -a valid alt attribute, as opposed to %Attr.DefaultInvalidImageAlt, which -only applies to invalid images, and overrides in the case of an invalid image. -Default behavior with null is to use the basename of the src tag for the alt. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt deleted file mode 100644 index 3d5c45d..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt +++ /dev/null @@ -1,8 +0,0 @@ -Attr.DefaultInvalidImage -TYPE: string -DEFAULT: '' ---DESCRIPTION-- -This is the default image an img tag will be pointed to if it does not have -a valid src attribute. In future versions, we may allow the image tag to -be removed completely, but due to design issues, this is not possible right -now. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt deleted file mode 100644 index cfc9f90..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt +++ /dev/null @@ -1,7 +0,0 @@ -Attr.DefaultInvalidImageAlt -TYPE: string -DEFAULT: 'Invalid image' ---DESCRIPTION-- -This is the content of the alt tag of an invalid image if the user had not -previously specified an alt attribute. It has no effect when the image is -valid but there was no alt attribute present. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt deleted file mode 100644 index 80296fc..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt +++ /dev/null @@ -1,9 +0,0 @@ -Attr.DefaultTextDir -TYPE: string -DEFAULT: 'ltr' ---DESCRIPTION-- -Defines the default text direction (ltr or rtl) of the document being -parsed. This generally is the same as the value of the dir attribute in -HTML, or ltr if that is not specified. ---ALLOWED-- -'ltr', 'rtl' diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt deleted file mode 100644 index 358d6d0..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt +++ /dev/null @@ -1,15 +0,0 @@ -Attr.EnableID -TYPE: bool -DEFAULT: false -VERSION: 1.2.0 ---DESCRIPTION-- -Allows the ID attribute in HTML. This is disabled by default due to the -fact that without proper configuration user input can easily break the -validation of a webpage by specifying an ID that is already on the -surrounding HTML. If you don't mind throwing caution to the wind, enable -this directive, but I strongly recommend you also consider blacklisting IDs -you use (%Attr.IDBlacklist) or prefixing all user supplied IDs -(%Attr.IDPrefix). When set to true HTML Purifier reverts to the behavior of -pre-1.2.0 versions. ---ALIASES-- -HTML.EnableAttrID diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt deleted file mode 100644 index 16fc46e..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt +++ /dev/null @@ -1,4 +0,0 @@ -Attr.IDBlacklist -TYPE: list -DEFAULT: array() -DESCRIPTION: Array of IDs not allowed in the document. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt deleted file mode 100644 index 98f7c5a..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt +++ /dev/null @@ -1,8 +0,0 @@ -Attr.IDBlacklistRegexp -TYPE: string/null -VERSION: 1.6.0 -DEFAULT: NULL ---DESCRIPTION-- -PCRE regular expression to be matched against all IDs. If the expression is -matches, the ID is rejected. Use this with care: may cause significant -degradation. ID matching is done after all other validation. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt deleted file mode 100644 index f996c08..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt +++ /dev/null @@ -1,11 +0,0 @@ -Attr.IDPrefix -TYPE: string -VERSION: 1.2.0 -DEFAULT: '' ---DESCRIPTION-- -String to prefix to IDs. If you have no idea what IDs your pages may use, -you may opt to simply add a prefix to all user-submitted ID attributes so -that they are still usable, but will not conflict with core page IDs. -Example: setting the directive to 'user_' will result in a user submitted -'foo' to become 'user_foo' Be sure to set %HTML.EnableAttrID to true -before using this. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt deleted file mode 100644 index b403fa9..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt +++ /dev/null @@ -1,13 +0,0 @@ -Attr.IDPrefixLocal -TYPE: string -VERSION: 1.2.0 -DEFAULT: '' ---DESCRIPTION-- -Temporary prefix for IDs used in conjunction with %Attr.IDPrefix. If you -need to allow multiple sets of user content on web page, you may need to -have a seperate prefix that changes with each iteration. This way, -seperately submitted user content displayed on the same page doesn't -clobber each other. Ideal values are unique identifiers for the content it -represents (i.e. the id of the row in the database). Be sure to add a -seperator (like an underscore) at the end. Warning: this directive will -not work unless %Attr.IDPrefix is set to a non-empty value! diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.txt deleted file mode 100644 index fb18894..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.txt +++ /dev/null @@ -1,2 +0,0 @@ -Attr -DESCRIPTION: Features regarding attribute validation. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt deleted file mode 100644 index e1f7a47..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt +++ /dev/null @@ -1,30 +0,0 @@ -AutoFormat.AutoParagraph -TYPE: bool -VERSION: 2.0.1 -DEFAULT: false ---DESCRIPTION-- - -
- This directive turns on auto-paragraphing, where double newlines are - converted in to paragraphs whenever possible. Auto-paragraphing: -
-
- p tags must be allowed for this directive to take effect.
- We do not use br tags for paragraphing, as that is
- semantically incorrect.
-
- To prevent auto-paragraphing as a content-producer, refrain from using
- double-newlines except to specify a new paragraph or in contexts where
- it has special meaning (whitespace usually has no meaning except in
- tags like pre, so this should not be difficult.) To prevent
- the paragraphing of inline text adjacent to block elements, wrap them
- in div tags (the behavior is slightly different outside of
- the root node.)
-
- This directive can be used to add custom auto-format injectors. - Specify an array of injector names (class name minus the prefix) - or concrete implementations. Injector class must exist. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt deleted file mode 100644 index 5d3e9d3..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt +++ /dev/null @@ -1,10 +0,0 @@ -AutoFormat.DisplayLinkURI -TYPE: bool -VERSION: 3.2.0 -DEFAULT: false ---DESCRIPTION-- -- This directive turns on the in-text display of URIs in <a> tags, and disables - those links. For example, example becomes - example (http://example.com). -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt deleted file mode 100644 index 554086f..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt +++ /dev/null @@ -1,12 +0,0 @@ -AutoFormat.Linkify -TYPE: bool -VERSION: 2.0.1 -DEFAULT: false ---DESCRIPTION-- - -
- This directive turns on linkification, auto-linking http, ftp and
- https URLs. a tags with the href attribute
- must be allowed.
-
- Internal auto-formatter that converts configuration directives in
- syntax %Namespace.Directive to links. a tags
- with the href attribute must be allowed.
-
- When enabled, HTML Purifier will attempt to remove empty elements that - contribute no semantic information to the document. The following types - of nodes will be removed: -
-<a></a> but not
- <br />), and
- colgroup element, orid or name attribute,
- when those attributes are permitted on those elements.
- - Please be very careful when using this functionality; while it may not - seem that empty elements contain useful information, they can alter the - layout of a document given appropriate styling. This directive is most - useful when you are processing machine-generated HTML, please avoid using - it on regular user HTML. -
-- Elements that contain only whitespace will be treated as empty. Non-breaking - spaces, however, do not count as whitespace. -
-- This algorithm is not perfect; you may still notice some empty tags, - particularly if a node had elements, but those elements were later removed - because they were not permitted in that context, or tags that, after - being auto-closed by another tag, where empty. This is for safety reasons - to prevent clever code from breaking validation. The general rule of thumb: - if a tag looked empty on the way end, it will get removed; if HTML Purifier - made it empty, it will stay. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.txt deleted file mode 100644 index 4a7b552..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.txt +++ /dev/null @@ -1,2 +0,0 @@ -AutoFormat -DESCRIPTION: Configuration for activating auto-formatting functionality (also known asInjectors)
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.PurifierLinkifyDocURL.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.PurifierLinkifyDocURL.txt
deleted file mode 100644
index 79d3358..0000000
--- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.PurifierLinkifyDocURL.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-AutoFormatParam.PurifierLinkifyDocURL
-TYPE: string
-VERSION: 2.0.1
-DEFAULT: '#%s'
---DESCRIPTION--
-
-- Location of configuration documentation to link to, let %s substitute - into the configuration's namespace and directive names sans the percent - sign. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.txt deleted file mode 100644 index 0ed7884..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.txt +++ /dev/null @@ -1,2 +0,0 @@ -AutoFormatParam -DESCRIPTION: Configuration for customizing auto-formatting functionality diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt deleted file mode 100644 index 68f6990..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt +++ /dev/null @@ -1,7 +0,0 @@ -CSS.AllowImportant -TYPE: bool -DEFAULT: false -VERSION: 3.1.0 ---DESCRIPTION-- -This parameter determines whether or not !important cascade modifiers should -be allowed in user CSS. If false, !important will stripped. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt deleted file mode 100644 index 82ce132..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt +++ /dev/null @@ -1,10 +0,0 @@ -CSS.AllowTricky -TYPE: bool -DEFAULT: false -VERSION: 3.1.0 ---DESCRIPTION-- -This parameter determines whether or not to allow "tricky" CSS properties and -values. Tricky CSS properties/values can drastically modify page layout or -be used for deceptive practices but do not directly constitute a security risk. -For example,display:none; is considered a tricky property that
-will only be allowed if this directive is set to true.
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt
deleted file mode 100644
index 82558f1..0000000
--- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-CSS.AllowedProperties
-TYPE: lookup/null
-VERSION: 3.1.0
-DEFAULT: NULL
---DESCRIPTION--
-
-- If HTML Purifier's style attributes set is unsatisfactory for your needs, - you can overload it with your own list of tags to allow. Note that this - method is subtractive: it does its job by taking away from HTML Purifier - usual feature set, so you cannot add an attribute that HTML Purifier never - supported in the first place. -
-- Warning: If another directive conflicts with the - elements here, that directive will win and override. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt deleted file mode 100644 index e1e5992..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt +++ /dev/null @@ -1,11 +0,0 @@ -CSS.DefinitionRev -TYPE: int -VERSION: 2.0.0 -DEFAULT: 1 ---DESCRIPTION-- - -- Revision identifier for your custom definition. See - %HTML.DefinitionRev for details. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt deleted file mode 100644 index abe08fa..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt +++ /dev/null @@ -1,15 +0,0 @@ -CSS.MaxImgLength -TYPE: string/null -DEFAULT: '1200px' -VERSION: 3.1.1 ---DESCRIPTION-- -
- This parameter sets the maximum allowed length on img tags,
- effectively the width and height properties.
- Only absolute units of measurement (in, pt, pc, mm, cm) and pixels (px) are allowed. This is
- in place to prevent imagecrash attacks, disable with null at your own risk.
- This directive is similar to %HTML.MaxImgLength, and both should be
- concurrently edited, although there are
- subtle differences in the input format (the CSS max is a number with
- a unit).
-
- Whether or not to allow safe, proprietary CSS values. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.txt deleted file mode 100644 index 060f5d3..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.txt +++ /dev/null @@ -1,2 +0,0 @@ -CSS -DESCRIPTION: Configuration regarding allowed CSS. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt deleted file mode 100644 index e9fa699..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt +++ /dev/null @@ -1,13 +0,0 @@ -Cache.DefinitionImpl -TYPE: string/null -VERSION: 2.0.0 -DEFAULT: 'Serializer' ---DESCRIPTION-- - -This directive defines which method to use when caching definitions, -the complex data-type that makes HTML Purifier tick. Set to null -to disable caching (not recommended, as you will see a definite -performance degradation). - ---ALIASES-- -Core.DefinitionCache diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt deleted file mode 100644 index 3682cbb..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt +++ /dev/null @@ -1,13 +0,0 @@ -Cache.SerializerPath -TYPE: string/null -VERSION: 2.0.0 -DEFAULT: NULL ---DESCRIPTION-- - -- Absolute path with no trailing slash to store serialized definitions in. - Default is within the - HTML Purifier library inside DefinitionCache/Serializer. This - path must be writable by the webserver. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.txt deleted file mode 100644 index 2f7aaa2..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.txt +++ /dev/null @@ -1,2 +0,0 @@ -Cache -DESCRIPTION: Configuration for DefinitionCache and related subclasses. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt deleted file mode 100644 index 552bb6d..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt +++ /dev/null @@ -1,17 +0,0 @@ -Core.AggressivelyFixLt -TYPE: bool -VERSION: 2.1.0 -DEFAULT: true ---DESCRIPTION-- -- This directive enables aggressive pre-filter fixes HTML Purifier can - perform in order to ensure that open angled-brackets do not get killed - during parsing stage. Enabling this will result in two preg_replace_callback - calls and at least two preg_replace calls for every HTML document parsed; - if your users make very well-formed HTML, you can set this directive false. - This has no effect when DirectLex is used. -
-- Notice: This directive's default turned from false to true - in HTML Purifier 3.2.0. -
\ No newline at end of file diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt deleted file mode 100644 index dcf2056..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt +++ /dev/null @@ -1,11 +0,0 @@ -Core.CollectErrors -TYPE: bool -VERSION: 2.0.0 -DEFAULT: false ---DESCRIPTION-- - -Whether or not to collect errors found while filtering the document. This -is a useful way to give feedback to your users. Warning: -Currently this feature is very patchy and experimental, with lots of -possible error messages not yet implemented. It will not cause any -problems, but it may not help your users either. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt deleted file mode 100644 index 28c9682..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt +++ /dev/null @@ -1,29 +0,0 @@ -Core.ColorKeywords -TYPE: hash -VERSION: 2.0.0 ---DEFAULT-- -array ( - 'maroon' => '#800000', - 'red' => '#FF0000', - 'orange' => '#FFA500', - 'yellow' => '#FFFF00', - 'olive' => '#808000', - 'purple' => '#800080', - 'fuchsia' => '#FF00FF', - 'white' => '#FFFFFF', - 'lime' => '#00FF00', - 'green' => '#008000', - 'navy' => '#000080', - 'blue' => '#0000FF', - 'aqua' => '#00FFFF', - 'teal' => '#008080', - 'black' => '#000000', - 'silver' => '#C0C0C0', - 'gray' => '#808080', -) ---DESCRIPTION-- - -Lookup array of color names to six digit hexadecimal number corresponding -to color, with preceding hash mark. Used when parsing colors. - - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt deleted file mode 100644 index 0f03d3a..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt +++ /dev/null @@ -1,13 +0,0 @@ -Core.ConvertDocumentToFragment -TYPE: bool -DEFAULT: true ---DESCRIPTION-- - -This parameter determines whether or not the filter should convert -input that is a full document with html and body tags to a fragment -of just the contents of a body tag. This parameter is simply something -HTML Purifier can do during an edge-case: for most inputs, this -processing is not necessary. - ---ALIASES-- -Core.AcceptFullDocuments diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt deleted file mode 100644 index 392adb5..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt +++ /dev/null @@ -1,17 +0,0 @@ -Core.DirectLexLineNumberSyncInterval -TYPE: int -VERSION: 2.0.0 -DEFAULT: 0 ---DESCRIPTION-- - -- Specifies the number of tokens the DirectLex line number tracking - implementations should process before attempting to resyncronize the - current line count by manually counting all previous new-lines. When - at 0, this functionality is disabled. Lower values will decrease - performance, and this is only strictly necessary if the counting - algorithm is buggy (in which case you should report it as a bug). - This has no effect when %Core.MaintainLineNumbers is disabled or DirectLex is - not being used. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt deleted file mode 100644 index 9bca95c..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt +++ /dev/null @@ -1,14 +0,0 @@ -Core.Encoding -TYPE: istring -DEFAULT: 'utf-8' ---DESCRIPTION-- -If for some reason you are unable to convert all webpages to UTF-8, you can -use this directive as a stop-gap compatibility change to let HTML Purifier -deal with non UTF-8 input. This technique has notable deficiencies: -absolutely no characters outside of the selected character encoding will be -preserved, not even the ones that have been ampersand escaped (this is due -to a UTF-8 specific feature that automatically resolves all -entities), making it pretty useless for anything except the most I18N-blind -applications, although %Core.EscapeNonASCIICharacters offers fixes this -trouble with another tradeoff. This directive only accepts ISO-8859-1 if -iconv is not enabled. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt deleted file mode 100644 index cca96c6..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt +++ /dev/null @@ -1,9 +0,0 @@ -Core.EscapeInvalidChildren -TYPE: bool -DEFAULT: false ---DESCRIPTION-- -When true, a child is found that is not allowed in the context of the -parent element will be transformed into text as if it were ASCII. When -false, that element and all internal tags will be dropped, though text will -be preserved. There is no option for dropping the element but preserving -child nodes. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt deleted file mode 100644 index 6e02a19..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt +++ /dev/null @@ -1,6 +0,0 @@ -Core.EscapeInvalidTags -TYPE: bool -DEFAULT: false ---DESCRIPTION-- -When true, invalid tags will be written back to the document as plain text. -Otherwise, they are silently dropped. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt deleted file mode 100644 index f8b7d38..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt +++ /dev/null @@ -1,12 +0,0 @@ -Core.EscapeNonASCIICharacters -TYPE: bool -VERSION: 1.4.0 -DEFAULT: false ---DESCRIPTION-- -This directive overcomes a deficiency in %Core.Encoding by blindly -converting all non-ASCII characters into decimal numeric entities before -converting it to its native encoding. This means that even characters that -can be expressed in the non-UTF-8 encoding will be entity-ized, which can -be a real downer for encodings like Big5. It also assumes that the ASCII -repetoire is available, although this is the case for almost all encodings. -Anyway, use UTF-8! diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt deleted file mode 100644 index 0a86d96..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt +++ /dev/null @@ -1,19 +0,0 @@ -Core.HiddenElements -TYPE: lookup ---DEFAULT-- -array ( - 'script' => true, - 'style' => true, -) ---DESCRIPTION-- - -
- This directive is a lookup array of elements which should have their
- contents removed when they are not allowed by the HTML definition.
- For example, the contents of a script tag are not
- normally shown in a document, so if script tags are to be removed,
- their contents should be removed to. This is opposed to a b
- tag, which defines some presentational changes but does not hide its
- contents.
-
- This parameter determines what lexer implementation can be used. The - valid values are: -
-HTMLPurifier_Lexer.
- I may remove this option simply because I don't expect anyone
- to use it.
- - If true, HTML Purifier will add line number information to all tokens. - This is useful when error reporting is turned on, but can result in - significant performance degradation and should not be used when - unnecessary. This directive must be used with the DirectLex lexer, - as the DOMLex lexer does not (yet) support this functionality. - If the value is null, an appropriate value will be selected based - on other configuration. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt deleted file mode 100644 index 7ac86b3..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt +++ /dev/null @@ -1,12 +0,0 @@ -Core.RemoveInvalidImg -TYPE: bool -DEFAULT: true -VERSION: 1.3.0 ---DESCRIPTION-- - -
- This directive enables pre-emptive URI checking in img
- tags, as the attribute validation strategy is not authorized to
- remove elements from the document. Revert to pre-1.3.0 behavior by setting to false.
-
- This directive enables HTML Purifier to remove not only script tags - but all of their contents. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.txt deleted file mode 100644 index 3240014..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.txt +++ /dev/null @@ -1,2 +0,0 @@ -Core -DESCRIPTION: Core features that are always available. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt deleted file mode 100644 index be67d63..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt +++ /dev/null @@ -1,10 +0,0 @@ -Filter.Custom -TYPE: list -VERSION: 3.1.0 -DEFAULT: array() ---DESCRIPTION-- -
- This directive can be used to add custom filters; it is nearly the
- equivalent of the now deprecated HTMLPurifier->addFilter()
- method. Specify an array of concrete implementations.
-
- This directive turns on the style block extraction filter, which removes
- style blocks from input HTML, cleans them up with CSSTidy,
- and places them in the StyleBlocks context variable, for further
- use by you, usually to be placed in an external stylesheet, or a
- style block in the head of your document.
-
- Sample usage: -
-'; -?> - - - --Filter.ExtractStyleBlocks -body {color:#F00;} Some text'; - - $config = HTMLPurifier_Config::createDefault(); - $config->set('Filter', 'ExtractStyleBlocks', true); - $purifier = new HTMLPurifier($config); - - $html = $purifier->purify($dirty); - - // This implementation writes the stylesheets to the styles/ directory. - // You can also echo the styles inside the document, but it's a bit - // more difficult to make sure they get interpreted properly by - // browsers; try the usual CSS armoring techniques. - $styles = $purifier->context->get('StyleBlocks'); - $dir = 'styles/'; - if (!is_dir($dir)) mkdir($dir); - $hash = sha1($_GET['html']); - foreach ($styles as $i => $style) { - file_put_contents($name = $dir . $hash . "_$i"); - echo ''; - } -?> - - -- -- - -]]>
- Warning: It is possible for a user to mount an - imagecrash attack using this CSS. Counter-measures are difficult; - it is not simply enough to limit the range of CSS lengths (using - relative lengths with many nesting levels allows for large values - to be attained without actually specifying them in the stylesheet), - and the flexible nature of selectors makes it difficult to selectively - disable lengths on image tags (HTML Purifier, however, does disable - CSS width and height in inline styling). There are probably two effective - counter measures: an explicit width and height set to auto in all - images in your document (unlikely) or the disabling of width and - height (somewhat reasonable). Whether or not these measures should be - used is left to the reader. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt deleted file mode 100644 index cdcb379..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt +++ /dev/null @@ -1,10 +0,0 @@ -Filter.YouTube -TYPE: bool -VERSION: 3.1.0 -DEFAULT: false ---DESCRIPTION-- -- This directive enables YouTube video embedding in HTML Purifier. Check - this document - on embedding videos for more information on what this filter does. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.txt deleted file mode 100644 index 9fad43a..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.txt +++ /dev/null @@ -1,2 +0,0 @@ -Filter -DESCRIPTION: Directives for turning filters on and off, or specifying custom filters. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksEscaping.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksEscaping.txt deleted file mode 100644 index d20010c..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksEscaping.txt +++ /dev/null @@ -1,14 +0,0 @@ -FilterParam.ExtractStyleBlocksEscaping -TYPE: bool -VERSION: 3.0.0 -DEFAULT: true -ALIASES: Filter.ExtractStyleBlocksEscaping ---DESCRIPTION-- - -- Whether or not to escape the dangerous characters <, > and & - as \3C, \3E and \26, respectively. This is can be safely set to false - if the contents of StyleBlocks will be placed in an external stylesheet, - where there is no risk of it being interpreted as HTML. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksScope.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksScope.txt deleted file mode 100644 index ec29078..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksScope.txt +++ /dev/null @@ -1,28 +0,0 @@ -FilterParam.ExtractStyleBlocksScope -TYPE: string/null -VERSION: 3.0.0 -DEFAULT: NULL -ALIASES: Filter.ExtractStyleBlocksScope ---DESCRIPTION-- - -
- If you would like users to be able to define external stylesheets, but
- only allow them to specify CSS declarations for a specific node and
- prevent them from fiddling with other elements, use this directive.
- It accepts any valid CSS selector, and will prepend this to any
- CSS declaration extracted from the document. For example, if this
- directive is set to #user-content and a user uses the
- selector a:hover, the final selector will be
- #user-content a:hover.
-
- The comma shorthand may be used; consider the above example, with
- #user-content, #user-content2, the final selector will
- be #user-content a:hover, #user-content2 a:hover.
-
- Warning: It is possible for users to bypass this measure - using a naughty + selector. This is a bug in CSS Tidy 1.3, not HTML - Purifier, and I am working to get it fixed. Until then, HTML Purifier - performs a basic check to prevent this. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksTidyImpl.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksTidyImpl.txt deleted file mode 100644 index 07250bf..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksTidyImpl.txt +++ /dev/null @@ -1,14 +0,0 @@ -FilterParam.ExtractStyleBlocksTidyImpl -TYPE: mixed/null -VERSION: 3.1.0 -DEFAULT: NULL ---DESCRIPTION-- -
- If left NULL, HTML Purifier will attempt to instantiate a csstidy
- class to use for internal cleaning. This will usually be good enough.
-
- However, for trusted user input, you can set this to false to
- disable cleaning. In addition, you can supply your own concrete implementation
- of Tidy's interface to use, although I don't know why you'd want to do that.
-
- This is a convenience directive that rolls the functionality of
- %HTML.AllowedElements and %HTML.AllowedAttributes into one directive.
- Specify elements and attributes that are allowed using:
- element1[attr1|attr2],element2.... You can also use
- newlines instead of commas to separate elements.
-
- Warning:
- All of the constraints on the component directives are still enforced.
- The syntax is a subset of TinyMCE's valid_elements
- whitelist: directly copy-pasting it here will probably result in
- broken whitelists. If %HTML.AllowedElements or %HTML.AllowedAttributes
- are set, this directive has no effect.
-
- If HTML Purifier's attribute set is unsatisfactory, overload it! - The syntax is "tag.attr" or "*.attr" for the global attributes - (style, id, class, dir, lang, xml:lang). -
-- Warning: If another directive conflicts with the - elements here, that directive will win and override. For - example, %HTML.EnableAttrID will take precedence over *.id in this - directive. You must set that directive to true before you can use - IDs at all. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt deleted file mode 100644 index 031a300..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt +++ /dev/null @@ -1,18 +0,0 @@ -HTML.AllowedElements -TYPE: lookup/null -VERSION: 1.3.0 -DEFAULT: NULL ---DESCRIPTION-- -- If HTML Purifier's tag set is unsatisfactory for your needs, you - can overload it with your own list of tags to allow. Note that this - method is subtractive: it does its job by taking away from HTML Purifier - usual feature set, so you cannot add a tag that HTML Purifier never - supported in the first place (like embed, form or head). If you - change this, you probably also want to change %HTML.AllowedAttributes. -
-- Warning: If another directive conflicts with the - elements here, that directive will win and override. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt deleted file mode 100644 index 7b8367e..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt +++ /dev/null @@ -1,20 +0,0 @@ -HTML.AllowedModules -TYPE: lookup/null -VERSION: 2.0.0 -DEFAULT: NULL ---DESCRIPTION-- - -- A doctype comes with a set of usual modules to use. Without having - to mucking about with the doctypes, you can quickly activate or - disable these modules by specifying which modules you wish to allow - with this directive. This is most useful for unit testing specific - modules, although end users may find it useful for their own ends. -
-- If you specify a module that does not exist, the manager will silently - fail to use it, so be careful! User-defined modules are not affected - by this directive. Modules defined in %HTML.CoreModules are not - affected by this directive. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt deleted file mode 100644 index 47fe143..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt +++ /dev/null @@ -1,18 +0,0 @@ -HTML.BlockWrapper -TYPE: string -VERSION: 1.3.0 -DEFAULT: 'p' ---DESCRIPTION-- - -- String name of element to wrap inline elements that are inside a block - context. This only occurs in the children of blockquote in strict mode. -
-
- Example: by default value,
- <blockquote>Foo</blockquote> would become
- <blockquote><p>Foo</p></blockquote>.
- The <p> tags can be replaced with whatever you desire,
- as long as it is a block level element.
-
- Certain modularized doctypes (XHTML, namely), have certain modules - that must be included for the doctype to be an conforming document - type: put those modules here. By default, XHTML's core modules - are used. You can set this to a blank array to disable core module - protection, but this is not recommended. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt deleted file mode 100644 index 4b6d39c..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt +++ /dev/null @@ -1,10 +0,0 @@ -HTML.CustomDoctype -TYPE: string/null -VERSION: 2.0.1 -DEFAULT: NULL ---DESCRIPTION-- - -A custom doctype for power-users who defined there own document -type. This directive only applies when %HTML.Doctype is blank. - - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt deleted file mode 100644 index 07f6b67..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt +++ /dev/null @@ -1,33 +0,0 @@ -HTML.DefinitionID -TYPE: string/null -DEFAULT: NULL -VERSION: 2.0.0 ---DESCRIPTION-- - -- Unique identifier for a custom-built HTML definition. If you edit - the raw version of the HTMLDefinition, introducing changes that the - configuration object does not reflect, you must specify this variable. - If you change your custom edits, you should change this directive, or - clear your cache. Example: -
-
-$config = HTMLPurifier_Config::createDefault();
-$config->set('HTML', 'DefinitionID', '1');
-$def = $config->getHTMLDefinition();
-$def->addAttribute('a', 'tabindex', 'Number');
-
-- In the above example, the configuration is still at the defaults, but - using the advanced API, an extra attribute has been added. The - configuration object normally has no way of knowing that this change - has taken place, so it needs an extra directive: %HTML.DefinitionID. - If someone else attempts to use the default configuration, these two - pieces of code will not clobber each other in the cache, since one has - an extra directive attached to it. -
-- You must specify a value to this directive to use the - advanced API features. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt deleted file mode 100644 index dfee8e7..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt +++ /dev/null @@ -1,16 +0,0 @@ -HTML.DefinitionRev -TYPE: int -VERSION: 2.0.0 -DEFAULT: 1 ---DESCRIPTION-- - -- Revision identifier for your custom definition specified in - %HTML.DefinitionID. This serves the same purpose: uniquely identifying - your custom definition, but this one does so in a chronological - context: revision 3 is more up-to-date then revision 2. Thus, when - this gets incremented, the cache handling is smart enough to clean - up any older revisions of your definition as well as flush the - cache. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt deleted file mode 100644 index 1c58e2a..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt +++ /dev/null @@ -1,10 +0,0 @@ -HTML.Doctype -TYPE: string/null -DEFAULT: NULL ---DESCRIPTION-- -Doctype to use during filtering. Technically speaking this is not actually -a doctype (as it does not identify a corresponding DTD), but we are using -this name for sake of simplicity. When non-blank, this will override any -older directives like %HTML.XHTML or %HTML.Strict. ---ALLOWED-- -'HTML 4.01 Transitional', 'HTML 4.01 Strict', 'XHTML 1.0 Transitional', 'XHTML 1.0 Strict', 'XHTML 1.1' diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt deleted file mode 100644 index 6a05388..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt +++ /dev/null @@ -1,20 +0,0 @@ -HTML.ForbiddenAttributes -TYPE: lookup -VERSION: 3.1.0 -DEFAULT: array() ---DESCRIPTION-- -
- While this directive is similar to %HTML.AllowedAttributes, for
- forwards-compatibility with XML, this attribute has a different syntax. Instead of
- tag.attr, use tag@attr. To disallow href
- attributes in a tags, set this directive to
- a@href. You can also disallow an attribute globally with
- attr or *@attr (either syntax is fine; the latter
- is provided for consistency with %HTML.AllowedAttributes).
-
- Warning: This directive complements %HTML.ForbiddenElements, - accordingly, check - out that directive for a discussion of why you - should think twice before using this directive. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt deleted file mode 100644 index 328eecf..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt +++ /dev/null @@ -1,19 +0,0 @@ -HTML.ForbiddenElements -TYPE: lookup -VERSION: 3.1.0 -DEFAULT: array() ---DESCRIPTION-- -- This was, perhaps, the most requested feature ever in HTML - Purifier. Please don't abuse it! This is the logical inverse of - %HTML.AllowedElements, and it will override that directive, or any - other directive. -
-
- If possible, %HTML.Allowed is recommended over this directive, because it
- can sometimes be difficult to tell whether or not you've forbidden all of
- the behavior you would like to disallow. If you forbid img
- with the expectation of preventing images on your site, you'll be in for
- a nasty surprise when people start using the background-image
- CSS property.
-
- This directive controls the maximum number of pixels in the width and
- height attributes in img tags. This is
- in place to prevent imagecrash attacks, disable with null at your own risk.
- This directive is similar to %CSS.MaxImgLength, and both should be
- concurrently edited, although there are
- subtle differences in the input format (the HTML max is an integer).
-
- String name of element that HTML fragment passed to library will be - inserted in. An interesting variation would be using span as the - parent element, meaning that only inline tags would be allowed. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt deleted file mode 100644 index 34b3203..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt +++ /dev/null @@ -1,11 +0,0 @@ -HTML.Proprietary -TYPE: bool -VERSION: 3.1.0 -DEFAULT: false ---DESCRIPTION-- -
- Whether or not to allow proprietary elements and attributes in your
- documents, as per HTMLPurifier_HTMLModule_Proprietary.
- Warning: This can cause your documents to stop
- validating!
-
- Whether or not to permit embed tags in documents, with a number of extra - security features added to prevent script execution. This is similar to - what websites like MySpace do to embed tags. Embed is a proprietary - element and will cause your website to stop validating. You probably want - to enable this with %HTML.SafeObject. - Highly experimental. -
\ No newline at end of file diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt deleted file mode 100644 index 7470999..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt +++ /dev/null @@ -1,13 +0,0 @@ -HTML.SafeObject -TYPE: bool -VERSION: 3.1.1 -DEFAULT: false ---DESCRIPTION-- -- Whether or not to permit object tags in documents, with a number of extra - security features added to prevent script execution. This is similar to - what websites like MySpace do to object tags. You may also want to - enable %HTML.SafeEmbed for maximum interoperability with Internet Explorer, - although embed tags will cause your website to stop validating. - Highly experimental. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt deleted file mode 100644 index 39f8179..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt +++ /dev/null @@ -1,8 +0,0 @@ -HTML.Strict -TYPE: bool -VERSION: 1.3.0 -DEFAULT: false -DEPRECATED-VERSION: 1.7.0 -DEPRECATED-USE: HTML.Doctype ---DESCRIPTION-- -Determines whether or not to use Transitional (loose) or Strict rulesets. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt deleted file mode 100644 index 7bf3c6d..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt +++ /dev/null @@ -1,8 +0,0 @@ -HTML.TidyAdd -TYPE: lookup -VERSION: 2.0.0 -DEFAULT: array() ---DESCRIPTION-- - -Fixes to add to the default set of Tidy fixes as per your level. - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt deleted file mode 100644 index 7b98bc7..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt +++ /dev/null @@ -1,23 +0,0 @@ -HTML.TidyLevel -TYPE: string -VERSION: 2.0.0 -DEFAULT: 'medium' ---DESCRIPTION-- - -General level of cleanliness the Tidy module should enforce. -There are four allowed values:
-- Newline string to format final output with. If left null, HTML Purifier - will auto-detect the default newline type of the system and use that; - you can manually override it here. Remember, \r\n is Windows, \r - is Mac, and \n is Unix. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt deleted file mode 100644 index c8c4e83..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt +++ /dev/null @@ -1,13 +0,0 @@ -Output.SortAttr -TYPE: bool -VERSION: 3.2.0 -DEFAULT: false ---DESCRIPTION-- -
- If true, HTML Purifier will sort attributes by name before writing them back
- to the document, converting a tag like: <el b="" a="" c="" />
- to <el a="" b="" c="" />. This is a workaround for
- a bug in FCKeditor which causes it to swap attributes order, adding noise
- to text diffs. If you're not seeing this bug, chances are, you don't need
- this directive.
-
- Determines whether or not to run Tidy on the final output for pretty - formatting reasons, such as indentation and wrap. -
-- This can greatly improve readability for editors who are hand-editing - the HTML, but is by no means necessary as HTML Purifier has already - fixed all major errors the HTML may have had. Tidy is a non-default - extension, and this directive will silently fail if Tidy is not - available. -
-- If you are looking to make the overall look of your page's source - better, I recommend running Tidy on the entire page rather than just - user-content (after all, the indentation relative to the containing - blocks will be incorrect). -
---ALIASES-- -Core.TidyFormat diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.txt deleted file mode 100644 index 134e141..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.txt +++ /dev/null @@ -1,2 +0,0 @@ -Output -DESCRIPTION: Configuration relating to the generation of (X)HTML. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt deleted file mode 100644 index 9933762..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt +++ /dev/null @@ -1,6 +0,0 @@ -Test.ForceNoIconv -TYPE: bool -DEFAULT: false ---DESCRIPTION-- -When set to true, HTMLPurifier_Encoder will act as if iconv does not exist -and use only pure PHP implementations. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.txt deleted file mode 100644 index fec6f8d..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.txt +++ /dev/null @@ -1,2 +0,0 @@ -Test -DESCRIPTION: Developer testing configuration for our unit tests. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt deleted file mode 100644 index 2686bac..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt +++ /dev/null @@ -1,14 +0,0 @@ -URI.AllowedSchemes -TYPE: lookup ---DEFAULT-- -array ( - 'http' => true, - 'https' => true, - 'mailto' => true, - 'ftp' => true, - 'nntp' => true, - 'news' => true, -) ---DESCRIPTION-- -Whitelist that defines the schemes that a URI is allowed to have. This -prevents XSS attacks from using pseudo-schemes like javascript or mocha. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Base.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Base.txt deleted file mode 100644 index a0f8d97..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Base.txt +++ /dev/null @@ -1,17 +0,0 @@ -URI.Base -TYPE: string/null -VERSION: 2.1.0 -DEFAULT: NULL ---DESCRIPTION-- - -- The base URI is the URI of the document this purified HTML will be - inserted into. This information is important if HTML Purifier needs - to calculate absolute URIs from relative URIs, such as when %URI.MakeAbsolute - is on. You may use a non-absolute URI for this value, but behavior - may vary (%URI.MakeAbsolute deals nicely with both absolute and - relative paths, but forwards-compatibility is not guaranteed). - Warning: If set, the scheme on this URI - overrides the one specified by %URI.DefaultScheme. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt deleted file mode 100644 index 2f39c2f..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt +++ /dev/null @@ -1,10 +0,0 @@ -URI.DefaultScheme -TYPE: string -DEFAULT: 'http' ---DESCRIPTION-- - -- Defines through what scheme the output will be served, in order to - select the proper object validator when no scheme information is present. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt deleted file mode 100644 index 20bfc1d..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt +++ /dev/null @@ -1,11 +0,0 @@ -URI.DefinitionID -TYPE: string/null -VERSION: 2.1.0 -DEFAULT: NULL ---DESCRIPTION-- - -- Unique identifier for a custom-built URI definition. If you want - to add custom URIFilters, you must specify this value. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt deleted file mode 100644 index 7dabdc6..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt +++ /dev/null @@ -1,11 +0,0 @@ -URI.DefinitionRev -TYPE: int -VERSION: 2.1.0 -DEFAULT: 1 ---DESCRIPTION-- - -- Revision identifier for your custom definition. See - %HTML.DefinitionRev for details. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt deleted file mode 100644 index a97b2e2..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt +++ /dev/null @@ -1,13 +0,0 @@ -URI.Disable -TYPE: bool -VERSION: 1.3.0 -DEFAULT: false ---DESCRIPTION-- - -- Disables all URIs in all forms. Not sure why you'd want to do that - (after all, the Internet's founded on the notion of a hyperlink). -
- ---ALIASES-- -Attr.DisableURI diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt deleted file mode 100644 index 6d3ceba..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt +++ /dev/null @@ -1,10 +0,0 @@ -URI.DisableExternal -TYPE: bool -VERSION: 1.2.0 -DEFAULT: false ---DESCRIPTION-- -Disables links to external websites. This is a highly effective anti-spam -and anti-pagerank-leech measure, but comes at a hefty price: nolinks or -images outside of your domain will be allowed. Non-linkified URIs will -still be preserved. If you want to be able to link to subdomains or use -absolute URIs, specify %URI.Host for your website. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt deleted file mode 100644 index 37f5d13..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt +++ /dev/null @@ -1,12 +0,0 @@ -URI.DisableExternalResources -TYPE: bool -VERSION: 1.3.0 -DEFAULT: false ---DESCRIPTION-- -Disables the embedding of external resources, preventing users from -embedding things like images from other hosts. This prevents access -tracking (good for email viewers), bandwidth leeching, cross-site request -forging, goatse.cx posting, and other nasties, but also results in a loss -of end-user functionality (they can't directly post a pic they posted from -Flickr anymore). Use it if you don't have a robust user-content moderation -team. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt deleted file mode 100644 index a456051..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt +++ /dev/null @@ -1,12 +0,0 @@ -URI.DisableResources -TYPE: bool -VERSION: 1.3.0 -DEFAULT: false ---DESCRIPTION-- - -- Disables embedding resources, essentially meaning no pictures. You can - still link to them though. See %URI.DisableExternalResources for why - this might be a good idea. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Host.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Host.txt deleted file mode 100644 index 15356ac..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Host.txt +++ /dev/null @@ -1,19 +0,0 @@ -URI.Host -TYPE: string/null -VERSION: 1.2.0 -DEFAULT: NULL ---DESCRIPTION-- - -- Defines the domain name of the server, so we can determine whether or - an absolute URI is from your website or not. Not strictly necessary, - as users should be using relative URIs to reference resources on your - website. It will, however, let you use absolute URIs to link to - subdomains of the domain you post here: i.e. example.com will allow - sub.example.com. However, higher up domains will still be excluded: - if you set %URI.Host to sub.example.com, example.com will be blocked. - Note: This directive overrides %URI.Base because - a given page may be on a sub-domain, but you wish HTML Purifier to be - more relaxed and allow some of the parent domains too. -
- diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt deleted file mode 100644 index 5f5cbc5..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt +++ /dev/null @@ -1,8 +0,0 @@ -URI.HostBlacklist -TYPE: list -VERSION: 1.3.0 -DEFAULT: array() ---DESCRIPTION-- -List of strings that are forbidden in the host of any URI. Use it to kill -domain names of spam, etc. Note that it will catch anything in the domain, -so moo.com will catch moo.com.example.com. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt deleted file mode 100644 index 2d2b40a..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt +++ /dev/null @@ -1,12 +0,0 @@ -URI.MakeAbsolute -TYPE: bool -VERSION: 2.1.0 -DEFAULT: false ---DESCRIPTION-- - -- Converts all URIs into absolute forms. This is useful when the HTML - being filtered assumes a specific base path, but will actually be - viewed in a different context (and setting an alternate base URI is - not possible). %URI.Base must be set for this directive to work. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt deleted file mode 100644 index 7743ac2..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt +++ /dev/null @@ -1,82 +0,0 @@ -URI.Munge -TYPE: string/null -VERSION: 1.3.0 -DEFAULT: NULL ---DESCRIPTION-- - -
- Munges all browsable (usually http, https and ftp)
- absolute URIs into another URI, usually a URI redirection service.
- This directive accepts a URI, formatted with a %s where
- the url-encoded original URI should be inserted (sample:
- http://www.google.com/url?q=%s).
-
- Uses for this directive: -
-
- Prior to HTML Purifier 3.1.1, this directive also enabled the munging
- of browsable external resources, which could break things if your redirection
- script was a splash page or used meta tags. To revert to
- previous behavior, please use %URI.MungeResources.
-
- You may want to also use %URI.MungeSecretKey along with this directive - in order to enforce what URIs your redirector script allows. Open - redirector scripts can be a security risk and negatively affect the - reputation of your domain name. -
-- Starting with HTML Purifier 3.1.1, there is also these substitutions: -
-| Key | -Description | -Example <a href=""> |
-
|---|---|---|
| %r | -1 - The URI embeds a resource (blank) - The URI is merely a link |
- - |
| %n | -The name of the tag this URI came from | -a | -
| %m | -The name of the attribute this URI came from | -href | -
| %p | -The name of the CSS property this URI came from, or blank if irrelevant | -- |
- Admittedly, these letters are somewhat arbitrary; the only stipulation - was that they couldn't be a through f. r is for resource (I would have preferred - e, but you take what you can get), n is for name, m - was picked because it came after n (and I couldn't use a), p is for - property. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt deleted file mode 100644 index f86c3e0..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt +++ /dev/null @@ -1,16 +0,0 @@ -URI.MungeResources -TYPE: bool -VERSION: 3.1.1 -DEFAULT: false ---DESCRIPTION-- -
- If true, any URI munging directives like %URI.Munge
- will also apply to embedded resources, such as <img src="">.
- Be careful enabling this directive if you have a redirector script
- that does not use the Location HTTP header; all of your images
- and other embedded resources will break.
-
- Warning: It is strongly advised you use this in conjunction - %URI.MungeSecretKey to mitigate the security risk of an open redirector. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt deleted file mode 100644 index d52ccf4..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt +++ /dev/null @@ -1,29 +0,0 @@ -URI.MungeSecretKey -TYPE: string/null -VERSION: 3.1.1 -DEFAULT: NULL ---DESCRIPTION-- -- This directive enables secure checksum generation along with %URI.Munge. - It should be set to a secure key that is not shared with anyone else. - The checksum can be placed in the URI using %t. Use of this checksum - affords an additional level of protection by allowing a redirector - to check if a URI has passed through HTML Purifier with this line: -
- -$checksum === sha1($secret_key . ':' . $url)- -
- If the output is TRUE, the redirector script should accept the URI. -
- -- Please note that it would still be possible for an attacker to procure - secure hashes en-mass by abusing your website's Preview feature or the - like, but this service affords an additional level of protection - that should be combined with website blacklisting. -
- -- Remember this has no effect if %URI.Munge is not on. -
diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt deleted file mode 100644 index c75b133..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt +++ /dev/null @@ -1,8 +0,0 @@ -URI.OverrideAllowedSchemes -TYPE: bool -DEFAULT: true ---DESCRIPTION-- -If this is set to true (which it is by default), you can override -%URI.AllowedSchemes by simply registering a HTMLPurifier_URIScheme to the -registry. If false, you will also have to update that directive in order -to add more schemes. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.txt b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.txt deleted file mode 100644 index 114ecb1..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.txt +++ /dev/null @@ -1,2 +0,0 @@ -URI -DESCRIPTION: Features regarding Uniform Resource Identifiers. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/info.ini b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/info.ini deleted file mode 100644 index d189704..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/info.ini +++ /dev/null @@ -1 +0,0 @@ -name = "HTML Purifier" diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ContentSets.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ContentSets.php deleted file mode 100644 index 070b6f2..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ContentSets.php +++ /dev/null @@ -1,154 +0,0 @@ - true) indexed by name. - * @note This is in HTMLPurifier_HTMLDefinition->info_content_sets - */ - public $lookup = array(); - - /** - * Synchronized list of defined content sets (keys of info) - */ - protected $keys = array(); - /** - * Synchronized list of defined content values (values of info) - */ - protected $values = array(); - - /** - * Merges in module's content sets, expands identifiers in the content - * sets and populates the keys, values and lookup member variables. - * @param $modules List of HTMLPurifier_HTMLModule - */ - public function __construct($modules) { - if (!is_array($modules)) $modules = array($modules); - // populate content_sets based on module hints - // sorry, no way of overloading - foreach ($modules as $module_i => $module) { - foreach ($module->content_sets as $key => $value) { - $temp = $this->convertToLookup($value); - if (isset($this->lookup[$key])) { - // add it into the existing content set - $this->lookup[$key] = array_merge($this->lookup[$key], $temp); - } else { - $this->lookup[$key] = $temp; - } - } - } - $old_lookup = false; - while ($old_lookup !== $this->lookup) { - $old_lookup = $this->lookup; - foreach ($this->lookup as $i => $set) { - $add = array(); - foreach ($set as $element => $x) { - if (isset($this->lookup[$element])) { - $add += $this->lookup[$element]; - unset($this->lookup[$i][$element]); - } - } - $this->lookup[$i] += $add; - } - } - - foreach ($this->lookup as $key => $lookup) { - $this->info[$key] = implode(' | ', array_keys($lookup)); - } - $this->keys = array_keys($this->info); - $this->values = array_values($this->info); - } - - /** - * Accepts a definition; generates and assigns a ChildDef for it - * @param $def HTMLPurifier_ElementDef reference - * @param $module Module that defined the ElementDef - */ - public function generateChildDef(&$def, $module) { - if (!empty($def->child)) return; // already done! - $content_model = $def->content_model; - if (is_string($content_model)) { - // Assume that $this->keys is alphanumeric - $def->content_model = preg_replace_callback( - '/\b(' . implode('|', $this->keys) . ')\b/', - array($this, 'generateChildDefCallback'), - $content_model - ); - //$def->content_model = str_replace( - // $this->keys, $this->values, $content_model); - } - $def->child = $this->getChildDef($def, $module); - } - - public function generateChildDefCallback($matches) { - return $this->info[$matches[0]]; - } - - /** - * Instantiates a ChildDef based on content_model and content_model_type - * member variables in HTMLPurifier_ElementDef - * @note This will also defer to modules for custom HTMLPurifier_ChildDef - * subclasses that need content set expansion - * @param $def HTMLPurifier_ElementDef to have ChildDef extracted - * @return HTMLPurifier_ChildDef corresponding to ElementDef - */ - public function getChildDef($def, $module) { - $value = $def->content_model; - if (is_object($value)) { - trigger_error( - 'Literal object child definitions should be stored in '. - 'ElementDef->child not ElementDef->content_model', - E_USER_NOTICE - ); - return $value; - } - switch ($def->content_model_type) { - case 'required': - return new HTMLPurifier_ChildDef_Required($value); - case 'optional': - return new HTMLPurifier_ChildDef_Optional($value); - case 'empty': - return new HTMLPurifier_ChildDef_Empty(); - case 'custom': - return new HTMLPurifier_ChildDef_Custom($value); - } - // defer to its module - $return = false; - if ($module->defines_child_def) { // save a func call - $return = $module->getChildDef($def); - } - if ($return !== false) return $return; - // error-out - trigger_error( - 'Could not determine which ChildDef class to instantiate', - E_USER_ERROR - ); - return false; - } - - /** - * Converts a string list of elements separated by pipes into - * a lookup array. - * @param $string List of elements - * @return Lookup array of elements - */ - protected function convertToLookup($string) { - $array = explode('|', str_replace(' ', '', $string)); - $ret = array(); - foreach ($array as $i => $k) { - $ret[$k] = true; - } - return $ret; - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Context.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Context.php deleted file mode 100644 index f213372..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Context.php +++ /dev/null @@ -1,81 +0,0 @@ -_storage[$name])) { - trigger_error("Name $name produces collision, cannot re-register", - E_USER_ERROR); - return; - } - $this->_storage[$name] =& $ref; - } - - /** - * Retrieves a variable reference from the context. - * @param $name String name - * @param $ignore_error Boolean whether or not to ignore error - */ - public function &get($name, $ignore_error = false) { - if (!isset($this->_storage[$name])) { - if (!$ignore_error) { - trigger_error("Attempted to retrieve non-existent variable $name", - E_USER_ERROR); - } - $var = null; // so we can return by reference - return $var; - } - return $this->_storage[$name]; - } - - /** - * Destorys a variable in the context. - * @param $name String name - */ - public function destroy($name) { - if (!isset($this->_storage[$name])) { - trigger_error("Attempted to destroy non-existent variable $name", - E_USER_ERROR); - return; - } - unset($this->_storage[$name]); - } - - /** - * Checks whether or not the variable exists. - * @param $name String name - */ - public function exists($name) { - return isset($this->_storage[$name]); - } - - /** - * Loads a series of variables from an associative array - * @param $context_array Assoc array of variables to load - */ - public function loadArray($context_array) { - foreach ($context_array as $key => $discard) { - $this->register($key, $context_array[$key]); - } - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Definition.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Definition.php deleted file mode 100644 index ecbae63..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Definition.php +++ /dev/null @@ -1,38 +0,0 @@ -setup) return; - $this->setup = true; - $this->doSetup($config); - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache.php deleted file mode 100644 index a318a8e..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache.php +++ /dev/null @@ -1,107 +0,0 @@ -type = $type; - } - - /** - * Generates a unique identifier for a particular configuration - * @param Instance of HTMLPurifier_Config - */ - public function generateKey($config) { - return $config->version . ',' . // possibly replace with function calls - $config->getBatchSerial($this->type) . ',' . - $config->get($this->type, 'DefinitionRev'); - } - - /** - * Tests whether or not a key is old with respect to the configuration's - * version and revision number. - * @param $key Key to test - * @param $config Instance of HTMLPurifier_Config to test against - */ - public function isOld($key, $config) { - if (substr_count($key, ',') < 2) return true; - list($version, $hash, $revision) = explode(',', $key, 3); - $compare = version_compare($version, $config->version); - // version mismatch, is always old - if ($compare != 0) return true; - // versions match, ids match, check revision number - if ( - $hash == $config->getBatchSerial($this->type) && - $revision < $config->get($this->type, 'DefinitionRev') - ) return true; - return false; - } - - /** - * Checks if a definition's type jives with the cache's type - * @note Throws an error on failure - * @param $def Definition object to check - * @return Boolean true if good, false if not - */ - public function checkDefType($def) { - if ($def->type !== $this->type) { - trigger_error("Cannot use definition of type {$def->type} in cache for {$this->type}"); - return false; - } - return true; - } - - /** - * Adds a definition object to the cache - */ - abstract public function add($def, $config); - - /** - * Unconditionally saves a definition object to the cache - */ - abstract public function set($def, $config); - - /** - * Replace an object in the cache - */ - abstract public function replace($def, $config); - - /** - * Retrieves a definition object from the cache - */ - abstract public function get($config); - - /** - * Removes a definition object to the cache - */ - abstract public function remove($config); - - /** - * Clears all objects from cache - */ - abstract public function flush($config); - - /** - * Clears all expired (older version or revision) objects from cache - * @note Be carefuly implementing this method as flush. Flush must - * not interfere with other Definition types, and cleanup() - * should not be repeatedly called by userland code. - */ - abstract public function cleanup($config); - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator.php deleted file mode 100644 index 46de132..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator.php +++ /dev/null @@ -1,61 +0,0 @@ -copy(); - // reference is necessary for mocks in PHP 4 - $decorator->cache =& $cache; - $decorator->type = $cache->type; - return $decorator; - } - - /** - * Cross-compatible clone substitute - */ - public function copy() { - return new HTMLPurifier_DefinitionCache_Decorator(); - } - - public function add($def, $config) { - return $this->cache->add($def, $config); - } - - public function set($def, $config) { - return $this->cache->set($def, $config); - } - - public function replace($def, $config) { - return $this->cache->replace($def, $config); - } - - public function get($config) { - return $this->cache->get($config); - } - - public function remove($config) { - return $this->cache->remove($config); - } - - public function flush($config) { - return $this->cache->flush($config); - } - - public function cleanup($config) { - return $this->cache->cleanup($config); - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php deleted file mode 100644 index e2d8aa1..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php +++ /dev/null @@ -1,42 +0,0 @@ -definitions[$this->generateKey($config)] = $def; - return $status; - } - - public function set($def, $config) { - $status = parent::set($def, $config); - if ($status) $this->definitions[$this->generateKey($config)] = $def; - return $status; - } - - public function replace($def, $config) { - $status = parent::replace($def, $config); - if ($status) $this->definitions[$this->generateKey($config)] = $def; - return $status; - } - - public function get($config) { - $key = $this->generateKey($config); - if (isset($this->definitions[$key])) return $this->definitions[$key]; - $this->definitions[$key] = parent::get($config); - return $this->definitions[$key]; - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Template.php.in b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Template.php.in deleted file mode 100644 index 62235e2..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Template.php.in +++ /dev/null @@ -1,46 +0,0 @@ -checkDefType($def)) return; - $file = $this->generateFilePath($config); - if (file_exists($file)) return false; - if (!$this->_prepareDir($config)) return false; - return $this->_write($file, serialize($def)); - } - - public function set($def, $config) { - if (!$this->checkDefType($def)) return; - $file = $this->generateFilePath($config); - if (!$this->_prepareDir($config)) return false; - return $this->_write($file, serialize($def)); - } - - public function replace($def, $config) { - if (!$this->checkDefType($def)) return; - $file = $this->generateFilePath($config); - if (!file_exists($file)) return false; - if (!$this->_prepareDir($config)) return false; - return $this->_write($file, serialize($def)); - } - - public function get($config) { - $file = $this->generateFilePath($config); - if (!file_exists($file)) return false; - return unserialize(file_get_contents($file)); - } - - public function remove($config) { - $file = $this->generateFilePath($config); - if (!file_exists($file)) return false; - return unlink($file); - } - - public function flush($config) { - if (!$this->_prepareDir($config)) return false; - $dir = $this->generateDirectoryPath($config); - $dh = opendir($dir); - while (false !== ($filename = readdir($dh))) { - if (empty($filename)) continue; - if ($filename[0] === '.') continue; - unlink($dir . '/' . $filename); - } - } - - public function cleanup($config) { - if (!$this->_prepareDir($config)) return false; - $dir = $this->generateDirectoryPath($config); - $dh = opendir($dir); - while (false !== ($filename = readdir($dh))) { - if (empty($filename)) continue; - if ($filename[0] === '.') continue; - $key = substr($filename, 0, strlen($filename) - 4); - if ($this->isOld($key, $config)) unlink($dir . '/' . $filename); - } - } - - /** - * Generates the file path to the serial file corresponding to - * the configuration and definition name - * @todo Make protected - */ - public function generateFilePath($config) { - $key = $this->generateKey($config); - return $this->generateDirectoryPath($config) . '/' . $key . '.ser'; - } - - /** - * Generates the path to the directory contain this cache's serial files - * @note No trailing slash - * @todo Make protected - */ - public function generateDirectoryPath($config) { - $base = $this->generateBaseDirectoryPath($config); - return $base . '/' . $this->type; - } - - /** - * Generates path to base directory that contains all definition type - * serials - * @todo Make protected - */ - public function generateBaseDirectoryPath($config) { - $base = $config->get('Cache', 'SerializerPath'); - $base = is_null($base) ? HTMLPURIFIER_PREFIX . '/HTMLPurifier/DefinitionCache/Serializer' : $base; - return $base; - } - - /** - * Convenience wrapper function for file_put_contents - * @param $file File name to write to - * @param $data Data to write into file - * @return Number of bytes written if success, or false if failure. - */ - private function _write($file, $data) { - return file_put_contents($file, $data); - } - - /** - * Prepares the directory that this type stores the serials in - * @return True if successful - */ - private function _prepareDir($config) { - $directory = $this->generateDirectoryPath($config); - if (!is_dir($directory)) { - $base = $this->generateBaseDirectoryPath($config); - if (!is_dir($base)) { - trigger_error('Base directory '.$base.' does not exist, - please create or change using %Cache.SerializerPath', - E_USER_ERROR); - return false; - } elseif (!$this->_testPermissions($base)) { - return false; - } - $old = umask(0022); // disable group and world writes - mkdir($directory); - umask($old); - } elseif (!$this->_testPermissions($directory)) { - return false; - } - return true; - } - - /** - * Tests permissions on a directory and throws out friendly - * error messages and attempts to chmod it itself if possible - */ - private function _testPermissions($dir) { - // early abort, if it is writable, everything is hunky-dory - if (is_writable($dir)) return true; - if (!is_dir($dir)) { - // generally, you'll want to handle this beforehand - // so a more specific error message can be given - trigger_error('Directory '.$dir.' does not exist', - E_USER_ERROR); - return false; - } - if (function_exists('posix_getuid')) { - // POSIX system, we can give more specific advice - if (fileowner($dir) === posix_getuid()) { - // we can chmod it ourselves - chmod($dir, 0755); - return true; - } elseif (filegroup($dir) === posix_getgid()) { - $chmod = '775'; - } else { - // PHP's probably running as nobody, so we'll - // need to give global permissions - $chmod = '777'; - } - trigger_error('Directory '.$dir.' not writable, '. - 'please chmod to ' . $chmod, - E_USER_ERROR); - } else { - // generic error message - trigger_error('Directory '.$dir.' not writable, '. - 'please alter file permissions', - E_USER_ERROR); - } - return false; - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/README b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/README deleted file mode 100644 index 59bde5c..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/README +++ /dev/null @@ -1 +0,0 @@ -This is a dummy file to prevent Git from ignoring this empty directory. diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCacheFactory.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCacheFactory.php deleted file mode 100644 index fd6328f..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCacheFactory.php +++ /dev/null @@ -1,90 +0,0 @@ - array()); - protected $implementations = array(); - protected $decorators = array(); - - /** - * Initialize default decorators - */ - public function setup() { - $this->addDecorator('Cleanup'); - } - - /** - * Retrieves an instance of global definition cache factory. - */ - public static function instance($prototype = null) { - static $instance; - if ($prototype !== null) { - $instance = $prototype; - } elseif ($instance === null || $prototype === true) { - $instance = new HTMLPurifier_DefinitionCacheFactory(); - $instance->setup(); - } - return $instance; - } - - /** - * Registers a new definition cache object - * @param $short Short name of cache object, for reference - * @param $long Full class name of cache object, for construction - */ - public function register($short, $long) { - $this->implementations[$short] = $long; - } - - /** - * Factory method that creates a cache object based on configuration - * @param $name Name of definitions handled by cache - * @param $config Instance of HTMLPurifier_Config - */ - public function create($type, $config) { - $method = $config->get('Cache', 'DefinitionImpl'); - if ($method === null) { - return new HTMLPurifier_DefinitionCache_Null($type); - } - if (!empty($this->caches[$method][$type])) { - return $this->caches[$method][$type]; - } - if ( - isset($this->implementations[$method]) && - class_exists($class = $this->implementations[$method], false) - ) { - $cache = new $class($type); - } else { - if ($method != 'Serializer') { - trigger_error("Unrecognized DefinitionCache $method, using Serializer instead", E_USER_WARNING); - } - $cache = new HTMLPurifier_DefinitionCache_Serializer($type); - } - foreach ($this->decorators as $decorator) { - $new_cache = $decorator->decorate($cache); - // prevent infinite recursion in PHP 4 - unset($cache); - $cache = $new_cache; - } - $this->caches[$method][$type] = $cache; - return $this->caches[$method][$type]; - } - - /** - * Registers a decorator to add to all new cache objects - * @param - */ - public function addDecorator($decorator) { - if (is_string($decorator)) { - $class = "HTMLPurifier_DefinitionCache_Decorator_$decorator"; - $decorator = new $class; - } - $this->decorators[$decorator->name] = $decorator; - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Doctype.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Doctype.php deleted file mode 100644 index 63b48df..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Doctype.php +++ /dev/null @@ -1,59 +0,0 @@ -renderDoctype. - * If structure changes, please update that function. - */ -class HTMLPurifier_Doctype -{ - /** - * Full name of doctype - */ - public $name; - - /** - * List of standard modules (string identifiers or literal objects) - * that this doctype uses - */ - public $modules = array(); - - /** - * List of modules to use for tidying up code - */ - public $tidyModules = array(); - - /** - * Is the language derived from XML (i.e. XHTML)? - */ - public $xml = true; - - /** - * List of aliases for this doctype - */ - public $aliases = array(); - - /** - * Public DTD identifier - */ - public $dtdPublic; - - /** - * System DTD identifier - */ - public $dtdSystem; - - public function __construct($name = null, $xml = true, $modules = array(), - $tidyModules = array(), $aliases = array(), $dtd_public = null, $dtd_system = null - ) { - $this->name = $name; - $this->xml = $xml; - $this->modules = $modules; - $this->tidyModules = $tidyModules; - $this->aliases = $aliases; - $this->dtdPublic = $dtd_public; - $this->dtdSystem = $dtd_system; - } -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DoctypeRegistry.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DoctypeRegistry.php deleted file mode 100644 index 94c2cec..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DoctypeRegistry.php +++ /dev/null @@ -1,102 +0,0 @@ -doctypes[$doctype->name] = $doctype; - $name = $doctype->name; - // hookup aliases - foreach ($doctype->aliases as $alias) { - if (isset($this->doctypes[$alias])) continue; - $this->aliases[$alias] = $name; - } - // remove old aliases - if (isset($this->aliases[$name])) unset($this->aliases[$name]); - return $doctype; - } - - /** - * Retrieves reference to a doctype of a certain name - * @note This function resolves aliases - * @note When possible, use the more fully-featured make() - * @param $doctype Name of doctype - * @return Editable doctype object - */ - public function get($doctype) { - if (isset($this->aliases[$doctype])) $doctype = $this->aliases[$doctype]; - if (!isset($this->doctypes[$doctype])) { - trigger_error('Doctype ' . htmlspecialchars($doctype) . ' does not exist', E_USER_ERROR); - $anon = new HTMLPurifier_Doctype($doctype); - return $anon; - } - return $this->doctypes[$doctype]; - } - - /** - * Creates a doctype based on a configuration object, - * will perform initialization on the doctype - * @note Use this function to get a copy of doctype that config - * can hold on to (this is necessary in order to tell - * Generator whether or not the current document is XML - * based or not). - */ - public function make($config) { - return clone $this->get($this->getDoctypeFromConfig($config)); - } - - /** - * Retrieves the doctype from the configuration object - */ - public function getDoctypeFromConfig($config) { - // recommended test - $doctype = $config->get('HTML', 'Doctype'); - if (!empty($doctype)) return $doctype; - $doctype = $config->get('HTML', 'CustomDoctype'); - if (!empty($doctype)) return $doctype; - // backwards-compatibility - if ($config->get('HTML', 'XHTML')) { - $doctype = 'XHTML 1.0'; - } else { - $doctype = 'HTML 4.01'; - } - if ($config->get('HTML', 'Strict')) { - $doctype .= ' Strict'; - } else { - $doctype .= ' Transitional'; - } - return $doctype; - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ElementDef.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ElementDef.php deleted file mode 100644 index 460fc17..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ElementDef.php +++ /dev/null @@ -1,161 +0,0 @@ -setup(), this array may also - * contain an array at index 0 that indicates which attribute - * collections to load into the full array. It may also - * contain string indentifiers in lieu of HTMLPurifier_AttrDef, - * see HTMLPurifier_AttrTypes on how they are expanded during - * HTMLPurifier_HTMLDefinition->setup() processing. - */ - public $attr = array(); - - /** - * Indexed list of tag's HTMLPurifier_AttrTransform to be done before validation - */ - public $attr_transform_pre = array(); - - /** - * Indexed list of tag's HTMLPurifier_AttrTransform to be done after validation - */ - public $attr_transform_post = array(); - - /** - * HTMLPurifier_ChildDef of this tag. - */ - public $child; - - /** - * Abstract string representation of internal ChildDef rules. See - * HTMLPurifier_ContentSets for how this is parsed and then transformed - * into an HTMLPurifier_ChildDef. - * @warning This is a temporary variable that is not available after - * being processed by HTMLDefinition - */ - public $content_model; - - /** - * Value of $child->type, used to determine which ChildDef to use, - * used in combination with $content_model. - * @warning This must be lowercase - * @warning This is a temporary variable that is not available after - * being processed by HTMLDefinition - */ - public $content_model_type; - - - - /** - * Does the element have a content model (#PCDATA | Inline)*? This - * is important for chameleon ins and del processing in - * HTMLPurifier_ChildDef_Chameleon. Dynamically set: modules don't - * have to worry about this one. - */ - public $descendants_are_inline = false; - - /** - * List of the names of required attributes this element has. Dynamically - * populated by HTMLPurifier_HTMLDefinition::getElement - */ - public $required_attr = array(); - - /** - * Lookup table of tags excluded from all descendants of this tag. - * @note SGML permits exclusions for all descendants, but this is - * not possible with DTDs or XML Schemas. W3C has elected to - * use complicated compositions of content_models to simulate - * exclusion for children, but we go the simpler, SGML-style - * route of flat-out exclusions, which correctly apply to - * all descendants and not just children. Note that the XHTML - * Modularization Abstract Modules are blithely unaware of such - * distinctions. - */ - public $excludes = array(); - - /** - * Low-level factory constructor for creating new standalone element defs - */ - public static function create($content_model, $content_model_type, $attr) { - $def = new HTMLPurifier_ElementDef(); - $def->content_model = $content_model; - $def->content_model_type = $content_model_type; - $def->attr = $attr; - return $def; - } - - /** - * Merges the values of another element definition into this one. - * Values from the new element def take precedence if a value is - * not mergeable. - */ - public function mergeIn($def) { - - // later keys takes precedence - foreach($def->attr as $k => $v) { - if ($k === 0) { - // merge in the includes - // sorry, no way to override an include - foreach ($v as $v2) { - $this->attr[0][] = $v2; - } - continue; - } - if ($v === false) { - if (isset($this->attr[$k])) unset($this->attr[$k]); - continue; - } - $this->attr[$k] = $v; - } - $this->_mergeAssocArray($this->attr_transform_pre, $def->attr_transform_pre); - $this->_mergeAssocArray($this->attr_transform_post, $def->attr_transform_post); - $this->_mergeAssocArray($this->excludes, $def->excludes); - - if(!empty($def->content_model)) { - $this->content_model .= ' | ' . $def->content_model; - $this->child = false; - } - if(!empty($def->content_model_type)) { - $this->content_model_type = $def->content_model_type; - $this->child = false; - } - if(!is_null($def->child)) $this->child = $def->child; - if($def->descendants_are_inline) $this->descendants_are_inline = $def->descendants_are_inline; - - } - - /** - * Merges one array into another, removes values which equal false - * @param $a1 Array by reference that is merged into - * @param $a2 Array that merges into $a1 - */ - private function _mergeAssocArray(&$a1, $a2) { - foreach ($a2 as $k => $v) { - if ($v === false) { - if (isset($a1[$k])) unset($a1[$k]); - continue; - } - $a1[$k] = $v; - } - } - -} - - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Encoder.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Encoder.php deleted file mode 100644 index cb239f8..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Encoder.php +++ /dev/null @@ -1,419 +0,0 @@ - under the - * LGPL license. Notes on what changed are inside, but in general, - * the original code transformed UTF-8 text into an array of integer - * Unicode codepoints. Understandably, transforming that back to - * a string would be somewhat expensive, so the function was modded to - * directly operate on the string. However, this discourages code - * reuse, and the logic enumerated here would be useful for any - * function that needs to be able to understand UTF-8 characters. - * As of right now, only smart lossless character encoding converters - * would need that, and I'm probably not going to implement them. - * Once again, PHP 6 should solve all our problems. - */ - public static function cleanUTF8($str, $force_php = false) { - - // UTF-8 validity is checked since PHP 4.3.5 - // This is an optimization: if the string is already valid UTF-8, no - // need to do PHP stuff. 99% of the time, this will be the case. - // The regexp matches the XML char production, as well as well as excluding - // non-SGML codepoints U+007F to U+009F - if (preg_match('/^[\x{9}\x{A}\x{D}\x{20}-\x{7E}\x{A0}-\x{D7FF}\x{E000}-\x{FFFD}\x{10000}-\x{10FFFF}]*$/Du', $str)) { - return $str; - } - - $mState = 0; // cached expected number of octets after the current octet - // until the beginning of the next UTF8 character sequence - $mUcs4 = 0; // cached Unicode character - $mBytes = 1; // cached expected number of octets in the current sequence - - // original code involved an $out that was an array of Unicode - // codepoints. Instead of having to convert back into UTF-8, we've - // decided to directly append valid UTF-8 characters onto a string - // $out once they're done. $char accumulates raw bytes, while $mUcs4 - // turns into the Unicode code point, so there's some redundancy. - - $out = ''; - $char = ''; - - $len = strlen($str); - for($i = 0; $i < $len; $i++) { - $in = ord($str{$i}); - $char .= $str[$i]; // append byte to char - if (0 == $mState) { - // When mState is zero we expect either a US-ASCII character - // or a multi-octet sequence. - if (0 == (0x80 & ($in))) { - // US-ASCII, pass straight through. - if (($in <= 31 || $in == 127) && - !($in == 9 || $in == 13 || $in == 10) // save \r\t\n - ) { - // control characters, remove - } else { - $out .= $char; - } - // reset - $char = ''; - $mBytes = 1; - } elseif (0xC0 == (0xE0 & ($in))) { - // First octet of 2 octet sequence - $mUcs4 = ($in); - $mUcs4 = ($mUcs4 & 0x1F) << 6; - $mState = 1; - $mBytes = 2; - } elseif (0xE0 == (0xF0 & ($in))) { - // First octet of 3 octet sequence - $mUcs4 = ($in); - $mUcs4 = ($mUcs4 & 0x0F) << 12; - $mState = 2; - $mBytes = 3; - } elseif (0xF0 == (0xF8 & ($in))) { - // First octet of 4 octet sequence - $mUcs4 = ($in); - $mUcs4 = ($mUcs4 & 0x07) << 18; - $mState = 3; - $mBytes = 4; - } elseif (0xF8 == (0xFC & ($in))) { - // First octet of 5 octet sequence. - // - // This is illegal because the encoded codepoint must be - // either: - // (a) not the shortest form or - // (b) outside the Unicode range of 0-0x10FFFF. - // Rather than trying to resynchronize, we will carry on - // until the end of the sequence and let the later error - // handling code catch it. - $mUcs4 = ($in); - $mUcs4 = ($mUcs4 & 0x03) << 24; - $mState = 4; - $mBytes = 5; - } elseif (0xFC == (0xFE & ($in))) { - // First octet of 6 octet sequence, see comments for 5 - // octet sequence. - $mUcs4 = ($in); - $mUcs4 = ($mUcs4 & 1) << 30; - $mState = 5; - $mBytes = 6; - } else { - // Current octet is neither in the US-ASCII range nor a - // legal first octet of a multi-octet sequence. - $mState = 0; - $mUcs4 = 0; - $mBytes = 1; - $char = ''; - } - } else { - // When mState is non-zero, we expect a continuation of the - // multi-octet sequence - if (0x80 == (0xC0 & ($in))) { - // Legal continuation. - $shift = ($mState - 1) * 6; - $tmp = $in; - $tmp = ($tmp & 0x0000003F) << $shift; - $mUcs4 |= $tmp; - - if (0 == --$mState) { - // End of the multi-octet sequence. mUcs4 now contains - // the final Unicode codepoint to be output - - // Check for illegal sequences and codepoints. - - // From Unicode 3.1, non-shortest form is illegal - if (((2 == $mBytes) && ($mUcs4 < 0x0080)) || - ((3 == $mBytes) && ($mUcs4 < 0x0800)) || - ((4 == $mBytes) && ($mUcs4 < 0x10000)) || - (4 < $mBytes) || - // From Unicode 3.2, surrogate characters = illegal - (($mUcs4 & 0xFFFFF800) == 0xD800) || - // Codepoints outside the Unicode range are illegal - ($mUcs4 > 0x10FFFF) - ) { - - } elseif (0xFEFF != $mUcs4 && // omit BOM - // check for valid Char unicode codepoints - ( - 0x9 == $mUcs4 || - 0xA == $mUcs4 || - 0xD == $mUcs4 || - (0x20 <= $mUcs4 && 0x7E >= $mUcs4) || - // 7F-9F is not strictly prohibited by XML, - // but it is non-SGML, and thus we don't allow it - (0xA0 <= $mUcs4 && 0xD7FF >= $mUcs4) || - (0x10000 <= $mUcs4 && 0x10FFFF >= $mUcs4) - ) - ) { - $out .= $char; - } - // initialize UTF8 cache (reset) - $mState = 0; - $mUcs4 = 0; - $mBytes = 1; - $char = ''; - } - } else { - // ((0xC0 & (*in) != 0x80) && (mState != 0)) - // Incomplete multi-octet sequence. - // used to result in complete fail, but we'll reset - $mState = 0; - $mUcs4 = 0; - $mBytes = 1; - $char =''; - } - } - } - return $out; - } - - /** - * Translates a Unicode codepoint into its corresponding UTF-8 character. - * @note Based on Feyd's function at - *' . $this->locale->getMessage('ErrorCollector: No errors') . '
'; - } else { - return ''; - //$string .= ''; - //$string .= ''; - $ret[] = $string; - } - foreach ($current->children as $type => $array) { - $context[] = $current; - $stack = array_merge($stack, array_reverse($array, true)); - for ($i = count($array); $i > 0; $i--) { - $context_stack[] = $context; - } - } - } - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorStruct.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorStruct.php deleted file mode 100644 index c6e5472..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorStruct.php +++ /dev/null @@ -1,58 +0,0 @@ -children[$type][$id])) { - $this->children[$type][$id] = new HTMLPurifier_ErrorStruct(); - $this->children[$type][$id]->type = $type; - } - return $this->children[$type][$id]; - } - - public function addError($severity, $message) { - $this->errors[] = array($severity, $message); - } - -} diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Exception.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Exception.php deleted file mode 100644 index 4f2ebf5..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Exception.php +++ /dev/null @@ -1,11 +0,0 @@ -preFilter, - * 2->preFilter, 3->preFilter, purify, 3->postFilter, 2->postFilter, - * 1->postFilter. - * - * @note Methods are not declared abstract as it is perfectly legitimate - * for an implementation not to want anything to happen on a step - */ - -class HTMLPurifier_Filter -{ - - /** - * Name of the filter for identification purposes - */ - public $name; - - /** - * Pre-processor function, handles HTML before HTML Purifier - */ - public function preFilter($html, $config, $context) { - return $html; - } - - /** - * Post-processor function, handles HTML after HTML Purifier - */ - public function postFilter($html, $config, $context) { - return $html; - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/ExtractStyleBlocks.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/ExtractStyleBlocks.php deleted file mode 100644 index e3545e0..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/ExtractStyleBlocks.php +++ /dev/null @@ -1,134 +0,0 @@ - blocks from input HTML, cleans them up - * using CSSTidy, and then places them in $purifier->context->get('StyleBlocks') - * so they can be used elsewhere in the document. - * - * @note - * See tests/HTMLPurifier/Filter/ExtractStyleBlocksTest.php for - * sample usage. - * - * @note - * This filter can also be used on stylesheets not included in the - * document--something purists would probably prefer. Just directly - * call HTMLPurifier_Filter_ExtractStyleBlocks->cleanCSS() - */ -class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter -{ - - public $name = 'ExtractStyleBlocks'; - private $_styleMatches = array(); - private $_tidy; - - public function __construct() { - $this->_tidy = new csstidy(); - } - - /** - * Save the contents of CSS blocks to style matches - * @param $matches preg_replace style $matches array - */ - protected function styleCallback($matches) { - $this->_styleMatches[] = $matches[1]; - } - - /** - * Removes inline #isU', array($this, 'styleCallback'), $html); - $style_blocks = $this->_styleMatches; - $this->_styleMatches = array(); // reset - $context->register('StyleBlocks', $style_blocks); // $context must not be reused - if ($this->_tidy) { - foreach ($style_blocks as &$style) { - $style = $this->cleanCSS($style, $config, $context); - } - } - return $html; - } - - /** - * Takes CSS (the stuff found in in a font-family prop). - if ($config->get('FilterParam', 'ExtractStyleBlocksEscaping')) { - $css = str_replace( - array('<', '>', '&'), - array('\3C ', '\3E ', '\26 '), - $css - ); - } - return $css; - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/YouTube.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/YouTube.php deleted file mode 100644 index 3236660..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/YouTube.php +++ /dev/null @@ -1,31 +0,0 @@ -]+>.+?'. - 'http://www.youtube.com/v/([A-Za-z0-9\-_]+).+?#s'; - $pre_replace = ''; - return preg_replace($pre_regex, $pre_replace, $html); - } - - public function postFilter($html, $config, $context) { - $post_regex = '##'; - $post_replace = ''; - return preg_replace($post_regex, $post_replace, $html); - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Generator.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Generator.php deleted file mode 100644 index 0ff5ba9..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Generator.php +++ /dev/null @@ -1,182 +0,0 @@ - tags - */ - private $_scriptFix = false; - - /** - * Cache of HTMLDefinition during HTML output to determine whether or - * not attributes should be minimized. - */ - private $_def; - - /** - * Cache of %Output.SortAttr - */ - private $_sortAttr; - - /** - * Configuration for the generator - */ - protected $config; - - /** - * @param $config Instance of HTMLPurifier_Config - * @param $context Instance of HTMLPurifier_Context - */ - public function __construct($config, $context) { - $this->config = $config; - $this->_scriptFix = $config->get('Output', 'CommentScriptContents'); - $this->_sortAttr = $config->get('Output', 'SortAttr'); - $this->_def = $config->getHTMLDefinition(); - $this->_xhtml = $this->_def->doctype->xml; - } - - /** - * Generates HTML from an array of tokens. - * @param $tokens Array of HTMLPurifier_Token - * @param $config HTMLPurifier_Config object - * @return Generated HTML - */ - public function generateFromTokens($tokens) { - if (!$tokens) return ''; - - // Basic algorithm - $html = ''; - for ($i = 0, $size = count($tokens); $i < $size; $i++) { - if ($this->_scriptFix && $tokens[$i]->name === 'script' - && $i + 2 < $size && $tokens[$i+2] instanceof HTMLPurifier_Token_End) { - // script special case - // the contents of the script block must be ONE token - // for this to work. - $html .= $this->generateFromToken($tokens[$i++]); - $html .= $this->generateScriptFromToken($tokens[$i++]); - } - $html .= $this->generateFromToken($tokens[$i]); - } - - // Tidy cleanup - if (extension_loaded('tidy') && $this->config->get('Output', 'TidyFormat')) { - $tidy = new Tidy; - $tidy->parseString($html, array( - 'indent'=> true, - 'output-xhtml' => $this->_xhtml, - 'show-body-only' => true, - 'indent-spaces' => 2, - 'wrap' => 68, - ), 'utf8'); - $tidy->cleanRepair(); - $html = (string) $tidy; // explicit cast necessary - } - - // Normalize newlines to system defined value - $nl = $this->config->get('Output', 'Newline'); - if ($nl === null) $nl = PHP_EOL; - if ($nl !== "\n") $html = str_replace("\n", $nl, $html); - return $html; - } - - /** - * Generates HTML from a single token. - * @param $token HTMLPurifier_Token object. - * @return Generated HTML - */ - public function generateFromToken($token) { - if (!$token instanceof HTMLPurifier_Token) { - trigger_error('Cannot generate HTML from non-HTMLPurifier_Token object', E_USER_WARNING); - return ''; - - } elseif ($token instanceof HTMLPurifier_Token_Start) { - $attr = $this->generateAttributes($token->attr, $token->name); - return '<' . $token->name . ($attr ? ' ' : '') . $attr . '>'; - - } elseif ($token instanceof HTMLPurifier_Token_End) { - return 'name . '>'; - - } elseif ($token instanceof HTMLPurifier_Token_Empty) { - $attr = $this->generateAttributes($token->attr, $token->name); - return '<' . $token->name . ($attr ? ' ' : '') . $attr . - ( $this->_xhtml ? ' /': '' ) //
tags? - if ($this->allowsElement('p')) { - if (empty($this->currentNesting) || strpos($text, "\n\n") !== false) { - // Note that we have differing behavior when dealing with text - // in the anonymous root node, or a node inside the document. - // If the text as a double-newline, the treatment is the same; - // if it doesn't, see the next if-block if you're in the document. - - $i = $nesting = null; - if (!$this->forwardUntilEndToken($i, $current, $nesting) && $token->is_whitespace) { - // State 1.1: ... ^ (whitespace, then document end) - // ---- - // This is a degenerate case - } else { - // State 1.2: PAR1 - // ---- - - // State 1.3: PAR1\n\nPAR2 - // ------------ - - // State 1.4:
tag? - } elseif ( - !empty($this->currentNesting) && - $this->currentNesting[count($this->currentNesting)-1]->name == 'p' - ) { - // State 3.1: ...
PAR1 - // ---- - - // State 3.2: ...
PAR1\n\nPAR2 - // ------------ - $token = array(); - $this->_splitText($text, $token); - // Abort! - } else { - // State 4.1: ...PAR1 - // ---- - - // State 4.2: ...PAR1\n\nPAR2 - // ------------ - } - } - - public function handleElement(&$token) { - // We don't have to check if we're already in a
tag for block - // tokens, because the tag would have been autoclosed by MakeWellFormed. - if ($this->allowsElement('p')) { - if (!empty($this->currentNesting)) { - if ($this->_isInline($token)) { - // State 1:
PAR1
\n\n - // --- - - // Quite frankly, this should be handled by splitText - $token = array($this->_pStart(), $token); - } else { - // State 1.1.1:PAR1
- // --- - - // State 1.1.2:is needed. - if ($this->_pLookAhead()) { - // State 1.3.1:
tags. - } - } - } - } else { - // State 2.2:
- // --- - } - } - - /** - * Splits up a text in paragraph tokens and appends them - * to the result stream that will replace the original - * @param $data String text data that will be processed - * into paragraphs - * @param $result Reference to array of tokens that the - * tags will be appended onto - * @param $config Instance of HTMLPurifier_Config - * @param $context Instance of HTMLPurifier_Context - */ - private function _splitText($data, &$result) { - $raw_paragraphs = explode("\n\n", $data); - $paragraphs = array(); // without empty paragraphs - $needs_start = false; - $needs_end = false; - - $c = count($raw_paragraphs); - if ($c == 1) { - // There were no double-newlines, abort quickly. In theory this - // should never happen. - $result[] = new HTMLPurifier_Token_Text($data); - return; - } - for ($i = 0; $i < $c; $i++) { - $par = $raw_paragraphs[$i]; - if (trim($par) !== '') { - $paragraphs[] = $par; - } else { - if ($i == 0) { - // Double newline at the front - if (empty($result)) { - // The empty result indicates that the AutoParagraph - // injector did not add any start paragraph tokens. - // This means that we have been in a paragraph for - // a while, and the newline means we should start a new one. - $result[] = new HTMLPurifier_Token_End('p'); - $result[] = new HTMLPurifier_Token_Text("\n\n"); - // However, the start token should only be added if - // there is more processing to be done (i.e. there are - // real paragraphs in here). If there are none, the - // next start paragraph tag will be handled by the - // next call to the injector - $needs_start = true; - } else { - // We just started a new paragraph! - // Reinstate a double-newline for presentation's sake, since - // it was in the source code. - array_unshift($result, new HTMLPurifier_Token_Text("\n\n")); - } - } elseif ($i + 1 == $c) { - // Double newline at the end - // There should be a trailing
when we're finally done. - $needs_end = true; - } - } - } - - // Check if this was just a giant blob of whitespace. Move this earlier, - // perhaps? - if (empty($paragraphs)) { - return; - } - - // Add the start tag indicated by \n\n at the beginning of $data - if ($needs_start) { - $result[] = $this->_pStart(); - } - - // Append the paragraphs onto the result - foreach ($paragraphs as $par) { - $result[] = new HTMLPurifier_Token_Text($par); - $result[] = new HTMLPurifier_Token_End('p'); - $result[] = new HTMLPurifier_Token_Text("\n\n"); - $result[] = $this->_pStart(); - } - - // Remove trailing start token; Injector will handle this later if - // it was indeed needed. This prevents from needing to do a lookahead, - // at the cost of a lookbehind later. - array_pop($result); - - // If there is no need for an end tag, remove all of it and let - // MakeWellFormed close it later. - if (!$needs_end) { - array_pop($result); // removes \n\n - array_pop($result); // removes - } - - } - - /** - * Returns true if passed token is inline (and, ergo, allowed in - * paragraph tags) - */ - private function _isInline($token) { - return isset($this->htmlDefinition->info['p']->child->elements[$token->name]); - } - - /** - * Looks ahead in the token list and determines whether or not we need - * to insert atag. - */ - private function _pLookAhead() { - $this->current($i, $current); - if ($current instanceof HTMLPurifier_Token_Start) $nesting = 1; - else $nesting = 0; - $ok = false; - while ($this->forwardUntilEndToken($i, $current, $nesting)) { - $result = $this->_checkNeedsP($current); - if ($result !== null) { - $ok = $result; - break; - } - } - return $ok; - } - - /** - * Determines if a particular token requires an earlier inline token - * to get a paragraph. This should be used with _forwardUntilEndToken - */ - private function _checkNeedsP($current) { - if ($current instanceof HTMLPurifier_Token_Start){ - if (!$this->_isInline($current)) { - //
n"; - //echo "$n\nsigfigs = $sigfigs\nnew_log = $new_log\nlog = $log\nrp = $rp\n\n"; - - $n = $this->round($n, $sigfigs); - if (strpos($n, '.') !== false) $n = rtrim($n, '0'); - $n = rtrim($n, '.'); - - return new HTMLPurifier_Length($n, $unit); - } - - /** - * Returns the number of significant figures in a string number. - * @param string $n Decimal number - * @return int number of sigfigs - */ - public function getSigFigs($n) { - $n = ltrim($n, '0+-'); - $dp = strpos($n, '.'); // decimal position - if ($dp === false) { - $sigfigs = strlen(rtrim($n, '0')); - } else { - $sigfigs = strlen(ltrim($n, '0.')); // eliminate extra decimal character - if ($dp !== 0) $sigfigs--; - } - return $sigfigs; - } - - /** - * Adds two numbers, using arbitrary precision when available. - */ - private function add($s1, $s2, $scale) { - if ($this->bcmath) return bcadd($s1, $s2, $scale); - else return $this->scale($s1 + $s2, $scale); - } - - /** - * Multiples two numbers, using arbitrary precision when available. - */ - private function mul($s1, $s2, $scale) { - if ($this->bcmath) return bcmul($s1, $s2, $scale); - else return $this->scale($s1 * $s2, $scale); - } - - /** - * Divides two numbers, using arbitrary precision when available. - */ - private function div($s1, $s2, $scale) { - if ($this->bcmath) return bcdiv($s1, $s2, $scale); - else return $this->scale($s1 / $s2, $scale); - } - - /** - * Rounds a number according to the number of sigfigs it should have, - * using arbitrary precision when available. - */ - private function round($n, $sigfigs) { - $new_log = (int) floor(log(abs($n), 10)); // Number of digits left of decimal - 1 - $rp = $sigfigs - $new_log - 1; // Number of decimal places needed - $neg = $n < 0 ? '-' : ''; // Negative sign - if ($this->bcmath) { - if ($rp >= 0) { - $n = bcadd($n, $neg . '0.' . str_repeat('0', $rp) . '5', $rp + 1); - $n = bcdiv($n, '1', $rp); - } else { - // This algorithm partially depends on the standardized - // form of numbers that comes out of bcmath. - $n = bcadd($n, $neg . '5' . str_repeat('0', $new_log - $sigfigs), 0); - $n = substr($n, 0, $sigfigs + strlen($neg)) . str_repeat('0', $new_log - $sigfigs + 1); - } - return $n; - } else { - return $this->scale(round($n, $sigfigs - $new_log - 1), $rp + 1); - } - } - - /** - * Scales a float to $scale digits right of decimal point, like BCMath. - */ - private function scale($r, $scale) { - if ($scale < 0) { - // The f sprintf type doesn't support negative numbers, so we - // need to cludge things manually. First get the string. - $r = sprintf('%.0f', (float) $r); - // Due to floating point precision loss, $r will more than likely - // look something like 4652999999999.9234. We grab one more digit - // than we need to precise from $r and then use that to round - // appropriately. - $precise = (string) round(substr($r, 0, strlen($r) + $scale), -1); - // Now we return it, truncating the zero that was rounded off. - return substr($precise, 0, -1) . str_repeat('0', -$scale + 1); - } - return sprintf('%.' . $scale . 'f', (float) $r); - } - -} diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser.php deleted file mode 100644 index a0cd2cf..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser.php +++ /dev/null @@ -1,152 +0,0 @@ - self::STRING, - 'istring' => self::ISTRING, - 'text' => self::TEXT, - 'itext' => self::ITEXT, - 'int' => self::INT, - 'float' => self::FLOAT, - 'bool' => self::BOOL, - 'lookup' => self::LOOKUP, - 'list' => self::ALIST, - 'hash' => self::HASH, - 'mixed' => self::MIXED - ); - - /** - * Lookup table of types that are string, and can have aliases or - * allowed value lists. - */ - static public $stringTypes = array( - self::STRING => true, - self::ISTRING => true, - self::TEXT => true, - self::ITEXT => true, - ); - - /** - * Validate a variable according to type. Throws - * HTMLPurifier_VarParserException if invalid. - * It may return NULL as a valid type if $allow_null is true. - * - * @param $var Variable to validate - * @param $type Type of variable, see HTMLPurifier_VarParser->types - * @param $allow_null Whether or not to permit null as a value - * @return Validated and type-coerced variable - */ - final public function parse($var, $type, $allow_null = false) { - if (is_string($type)) { - if (!isset(HTMLPurifier_VarParser::$types[$type])) { - throw new HTMLPurifier_VarParserException("Invalid type '$type'"); - } else { - $type = HTMLPurifier_VarParser::$types[$type]; - } - } - $var = $this->parseImplementation($var, $type, $allow_null); - if ($allow_null && $var === null) return null; - // These are basic checks, to make sure nothing horribly wrong - // happened in our implementations. - switch ($type) { - case (self::STRING): - case (self::ISTRING): - case (self::TEXT): - case (self::ITEXT): - if (!is_string($var)) break; - if ($type == self::ISTRING || $type == self::ITEXT) $var = strtolower($var); - return $var; - case (self::INT): - if (!is_int($var)) break; - return $var; - case (self::FLOAT): - if (!is_float($var)) break; - return $var; - case (self::BOOL): - if (!is_bool($var)) break; - return $var; - case (self::LOOKUP): - case (self::ALIST): - case (self::HASH): - if (!is_array($var)) break; - if ($type === self::LOOKUP) { - foreach ($var as $k) if ($k !== true) $this->error('Lookup table contains value other than true'); - } elseif ($type === self::ALIST) { - $keys = array_keys($var); - if (array_keys($keys) !== $keys) $this->error('Indices for list are not uniform'); - } - return $var; - case (self::MIXED): - return $var; - default: - $this->errorInconsistent(get_class($this), $type); - } - $this->errorGeneric($var, $type); - } - - /** - * Actually implements the parsing. Base implementation is to not - * do anything to $var. Subclasses should overload this! - */ - protected function parseImplementation($var, $type, $allow_null) { - return $var; - } - - /** - * Throws an exception. - */ - protected function error($msg) { - throw new HTMLPurifier_VarParserException($msg); - } - - /** - * Throws an inconsistency exception. - * @note This should not ever be called. It would be called if we - * extend the allowed values of HTMLPurifier_VarParser without - * updating subclasses. - */ - protected function errorInconsistent($class, $type) { - throw new HTMLPurifier_Exception("Inconsistency in $class: ".HTMLPurifier_VarParser::getTypeName($type)." not implemented"); - } - - /** - * Generic error for if a type didn't work. - */ - protected function errorGeneric($var, $type) { - $vtype = gettype($var); - $this->error("Expected type ".HTMLPurifier_VarParser::getTypeName($type).", got $vtype"); - } - - static public function getTypeName($type) { - static $lookup; - if (!$lookup) { - // Lazy load the alternative lookup table - $lookup = array_flip(HTMLPurifier_VarParser::$types); - } - if (!isset($lookup[$type])) return 'unknown'; - return $lookup[$type]; - } - -} diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Flexible.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Flexible.php deleted file mode 100644 index c7e2990..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Flexible.php +++ /dev/null @@ -1,94 +0,0 @@ - $j) $var[$i] = trim($j); - if ($type === self::HASH) { - // key:value,key2:value2 - $nvar = array(); - foreach ($var as $keypair) { - $c = explode(':', $keypair, 2); - if (!isset($c[1])) continue; - $nvar[$c[0]] = $c[1]; - } - $var = $nvar; - } - } - if (!is_array($var)) break; - $keys = array_keys($var); - if ($keys === array_keys($keys)) { - if ($type == self::ALIST) return $var; - elseif ($type == self::LOOKUP) { - $new = array(); - foreach ($var as $key) { - $new[$key] = true; - } - return $new; - } else break; - } - if ($type === self::LOOKUP) { - foreach ($var as $key => $value) { - $var[$key] = true; - } - } - return $var; - default: - $this->errorInconsistent(__CLASS__, $type); - } - $this->errorGeneric($var, $type); - } - -} diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Native.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Native.php deleted file mode 100644 index 546c3b9..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Native.php +++ /dev/null @@ -1,25 +0,0 @@ -evalExpression($var); - } - - protected function evalExpression($expr) { - $var = null; - $result = eval("\$var = $expr;"); - if ($result === false) { - throw new HTMLPurifier_VarParserException("Fatal error in evaluated code"); - } - return $var; - } - -} - diff --git a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParserException.php b/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParserException.php deleted file mode 100644 index 9572e33..0000000 --- a/dvwa/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParserException.php +++ /dev/null @@ -1,9 +0,0 @@ -path = dirname(__FILE__) . '/../../lib/IDS/Config/Config.ini'; - $this->init = IDS_Init::init($this->path); - } - - function testCachingNone() { - $this->init->config['Caching']['caching'] = 'none'; - $this->assertFalse(IDS_Caching::factory($this->init, 'storage')); - } - - function testCachingFile() { - $this->init->config['Caching']['caching'] = 'file'; - $this->init->config['Caching']['expiration_time'] = 0; - $this->assertTrue(IDS_Caching::factory($this->init, 'storage') instanceof IDS_Caching_File); - } - - function testCachingFileSetCache() { - $this->init->config['Caching']['caching'] = 'file'; - $this->init->config['Caching']['expiration_time'] = 0; - $cache = IDS_Caching::factory($this->init, 'storage'); - $cache = $cache->setCache(array(1,2,3,4)); - $this->assertTrue($cache instanceof IDS_Caching_File); - } - - function testCachingFileGetCache() { - $this->init->config['Caching']['caching'] = 'file'; - $this->init->config['Caching']['path'] = dirname(__FILE__) . '/../../lib/IDS/tmp/default_filter.cache'; - $this->init->config['Caching']['expiration_time'] = 0; - $cache = IDS_Caching::factory($this->init, 'storage'); - $cache = $cache->setCache(array(1,2,3,4)); - $this->assertEquals($cache->getCache(), array(1,2,3,4)); - } - - function testCachingSession() { - $this->init->config['Caching']['caching'] = 'session'; - $this->assertTrue(IDS_Caching::factory($this->init, 'storage') instanceof IDS_Caching_Session); - } - - function testCachingSessionSetCache() { - $this->init->config['Caching']['caching'] = 'session'; - - $cache = IDS_Caching::factory($this->init, 'storage'); - $cache = $cache->setCache(array(1,2,3,4)); - $this->assertTrue($cache instanceof IDS_Caching_Session); - } - - function testCachingSessionGetCache() { - $this->init->config['Caching']['caching'] = 'session'; - - $cache = IDS_Caching::factory($this->init, 'storage'); - $cache = $cache->setCache(array(1,2,3,4)); - $this->assertEquals($cache->getCache(), array(1,2,3,4)); - } - - function testCachingSessionGetCacheDestroyed() { - $this->init->config['Caching']['caching'] = 'session'; - - $cache = IDS_Caching::factory($this->init, 'storage'); - $cache = $cache->setCache(array(1,2,3,4)); - $_SESSION['PHPIDS']['storage'] = null; - $this->assertFalse($cache->getCache()); - } - - function tearDown() { - @unlink(dirname(__FILE__) . '/../../lib/IDS/tmp/default_filter.cache'); - @unlink(dirname(__FILE__) . '/../../lib/IDS/tmp/memcache.timestamp'); - } -} - -/** - * Local variables: - * tab-width: 4 - * c-basic-offset: 4 - * End: - * vim600: sw=4 ts=4 expandtab - */ diff --git a/dvwa/external/phpids/0.6/tests/IDS/EventTest.php b/dvwa/external/phpids/0.6/tests/IDS/EventTest.php deleted file mode 100644 index da75660..0000000 --- a/dvwa/external/phpids/0.6/tests/IDS/EventTest.php +++ /dev/null @@ -1,85 +0,0 @@ -event = new IDS_Event("handled_key", "my val", - array( - new IDS_Filter(1, '^test$', 'my description', array('tag1', 'tag2'), 10), - new IDS_Filter(1, '^test2$', 'my other desc', array('tag2', 'tag3'), 4) - ) - ); - } - - public function testName() - { - $this->assertEquals('handled_key', $this->event->getName()); - $this->assertEquals("my val", $this->event->getValue()); - } - - public function testValueAggregation() - { - $this->assertEquals(14, $this->event->getImpact()); - $this->assertEquals(array('tag1', 'tag2', 'tag3'), $this->event->getTags()); - } - - public function testIterator() - { - $regexps = array('^test$', '^test2$'); - foreach ($this->event as $key => $filter) - $this->assertEquals($regexps[$key], $filter->getRule()); - foreach ($this->event->getFilters() as $key => $filter) - $this->assertEquals($regexps[$key], $filter->getRule()); - } - - public function testCount() - { - $this->assertEquals(2, count($this->event)); - } - - public function testCopy() - { - $filters = $this->event->getFilters(); - $filter[] = "foo"; - $this->assertEquals(2, count($this->event)); - } - - public function testIteratorAggregate() - { - $this->assertType('IteratorAggregate', $this->event); - $this->assertType('IteratorAggregate', $this->event->getIterator()); - } -} - -/** - * Local variables: - * tab-width: 4 - * c-basic-offset: 4 - * End: - * vim600: sw=4 ts=4 expandtab - */ diff --git a/dvwa/external/phpids/0.6/tests/IDS/ExceptionTest.php b/dvwa/external/phpids/0.6/tests/IDS/ExceptionTest.php deleted file mode 100644 index 84d5764..0000000 --- a/dvwa/external/phpids/0.6/tests/IDS/ExceptionTest.php +++ /dev/null @@ -1,112 +0,0 @@ -report = new IDS_Report(array( - new IDS_Event("key_a", 'val_b', - array( - new IDS_Filter(1, '^test_a1$', 'desc_a1', array('tag_a1', 'tag_a2'), 1), - new IDS_Filter(1, '^test_a2$', 'desc_a2', array('tag_a2', 'tag_a3'), 2) - ) - ), - new IDS_Event('key_b', 'val_b', - array( - new IDS_Filter(1, '^test_b1$', 'desc_b1', array('tag_b1', 'tag_b2'), 3), - new IDS_FIlter(1, '^test_b2$', 'desc_b2', array('tag_b2', 'tag_b3'), 4), - ) - ) - )); - - $this->path = dirname(__FILE__) . '/../../lib/IDS/Config/Config.ini'; - $this->init = IDS_Init::init($this->path); - } - - public function testEventConstructorExceptions1() { - $this->setExpectedException('InvalidArgumentException'); - new IDS_Event(array(1,2), 'val_b', - array( - new IDS_Filter(1, '^test_a1$', 'desc_a1', array('tag_a1', 'tag_a2'), 1), - new IDS_Filter(1, '^test_a2$', 'desc_a2', array('tag_a2', 'tag_a3'), 2) - ) - ); - } - - public function testEventConstructorExceptions2() { - $this->setExpectedException('InvalidArgumentException'); - new IDS_Event("key_a", array(1,2), - array( - new IDS_Filter(1, '^test_a1$', 'desc_a1', array('tag_a1', 'tag_a2'), 1), - new IDS_Filter(1, '^test_a2$', 'desc_a2', array('tag_a2', 'tag_a3'), 2) - ) - ); - } - - public function testEventConstructorExceptions3() { - $this->setExpectedException('InvalidArgumentException'); - new IDS_Event("key_a", 'val_b', array(1,2)); - } - - public function testGetEventException() { - $this->setExpectedException('InvalidArgumentException'); - $this->assertEquals($this->report->getEvent(array(1,2,3)), $this->getExpectedException()); - } - - public function testHasEventException() { - $this->setExpectedException('InvalidArgumentException'); - $this->assertEquals($this->report->hasEvent(array(1,2,3)), $this->getExpectedException()); - } - - public function testInitConfigWrongPathException() { - $this->setExpectedException('Exception'); - $this->assertEquals(IDS_Init::init('IDS/Config/Config.ini.wrong'), $this->getExpectedException()); - } - - public function testWrongXmlFilterPathException() { - $this->setExpectedException('Exception'); - $this->init->config['General']['filter_type'] = 'xml'; - $this->init->config['General']['filter_path'] = 'IDS/wrong_path'; - $this->assertEquals(new IDS_Monitor(array('test', 'bla'), $this->init), $this->getExpectedException()); - } - - public function tearDown() { - $this->init->config['General']['filter_type'] = 'xml'; - } -} - -/** - * Local variables: - * tab-width: 4 - * c-basic-offset: 4 - * End: - * vim600: sw=4 ts=4 expandtab - */ diff --git a/dvwa/external/phpids/0.6/tests/IDS/FilterTest.php b/dvwa/external/phpids/0.6/tests/IDS/FilterTest.php deleted file mode 100644 index 4d284cd..0000000 --- a/dvwa/external/phpids/0.6/tests/IDS/FilterTest.php +++ /dev/null @@ -1,97 +0,0 @@ -path = dirname(__FILE__) . '/../../lib/IDS/Config/Config.ini'; - $this->init = IDS_Init::init($this->path); - } - - public function testObjectConstruction() - { - $filter = new IDS_Filter(1, '^test$', 'My description', array('foo', 'bar'), 12); - - $this->assertTrue($filter->match('test')); - $this->assertEquals("My description", $filter->getDescription(), "Should return description"); - $this->assertEquals(array("foo", "bar"), $filter->getTags(), "Should return array/list of tags"); - $this->assertEquals('^test$', $filter->getRule()); - $this->assertEquals(12, $filter->getImpact()); - } - - public function testModificator() - { - $filter = new IDS_Filter(1, '^te.st$', 'My description', array('tag1', 'tag2'), 1); - - // Default must be - // ... case-insensitive - $this->assertTrue($filter->match('TE1ST')); - // ... dot all (\n is matched by .) - $this->assertTrue($filter->match("TE\nST")); - // .. "$" is end only #has changed since modifiers are ims - $this->assertTrue($filter->match("TE1ST\n")); - - } - - public function testExceptions() - { - $filter = new IDS_Filter(1, '^test$', 'My description', array('foo', 'bar'), 10); - - try { - $filter->match(1); - $this->fail("Expected Exception"); - } catch (Exception $e) {} - - - try { - $filter = new IDS_Filter(1, '^test$', 'my desc', array('foo'), 'test'); - $this->fail("Expected Exception"); - } catch (Exception $e) {} - - try { - $filter = new IDS_Filter(1, 1, 'my desc', array("foo"), 'bla'); - $this->fail("Excpected Exception"); - } catch (Exception $e) {} - - } - - public function testFilterSetFilterSet() { - - $this->init->config['General']['filter_type'] = 'xml'; - $this->init->config['General']['filter_path'] = dirname(__FILE__) . '/../../lib/IDS/default_filter.xml'; - $this->storage = new IDS_Filter_Storage($this->init); - $filter = array(); - $filter[] = new IDS_Filter(1, 'test', 'test2', array(), 1); - $this->assertTrue($this->storage->setFilterSet($filter) instanceof IDS_Filter_Storage); - } -} - -/** - * Local variables: - * tab-width: 4 - * c-basic-offset: 4 - * End: - * vim600: sw=4 ts=4 expandtab - */ diff --git a/dvwa/external/phpids/0.6/tests/IDS/InitTest.php b/dvwa/external/phpids/0.6/tests/IDS/InitTest.php deleted file mode 100644 index cf95eb6..0000000 --- a/dvwa/external/phpids/0.6/tests/IDS/InitTest.php +++ /dev/null @@ -1,90 +0,0 @@ -path = dirname(__FILE__) . '/../../lib/IDS/Config/Config.ini'; - $this->init = IDS_Init::init($this->path); - } - - function testInit() { - $this->assertTrue($this->init instanceof IDS_Init); - } - - function testInitConfig() { - $keys = array('General', 'Logging', 'Caching'); - $this->assertEquals($keys, array_keys($this->init->config)); - } - - function testInitClone() { - $config2 = clone $this->init; - $this->assertEquals($config2, $this->init); - } - - function testInitGetConfigPath() { - $this->assertEquals($this->init->getConfigPath(), $this->path); - } - - function testInitSetConfigOverwrite() { - $this->init->setConfig(array('General' => array('filter_type' => 'json')), true); - $this->assertEquals($this->init->config['General']['filter_type'], 'json'); - - $this->init->setConfig( - array('General' => array('exceptions' => array('foo'))), - true - ); - $this->assertSame( - array('foo', '__utmc'), - $this->init->config['General']['exceptions'] - ); - } - - function testInitSetConfigNoOverwrite() { - $this->init->setConfig(array('General' => array('filter_type' => 'xml')), true); - $this->init->setConfig(array('General' => array('filter_type' => 'json'))); - $this->assertEquals($this->init->config['General']['filter_type'], 'xml'); - } - - function testInitGetConfig() { - $data = $this->init->getConfig(); - $this->assertEquals($this->init->config, $data); - } - - function testInstanciatingInitObjectWithoutPassingConfigFile() - { - $init = IDS_Init::init(); - $this->assertType('IDS_Init', $init); - $this->assertSame($init, IDS_Init::init()); - } -} - -/** - * Local variables: - * tab-width: 4 - * c-basic-offset: 4 - * End: - * vim600: sw=4 ts=4 expandtab - */ diff --git a/dvwa/external/phpids/0.6/tests/IDS/MonitorTest.php b/dvwa/external/phpids/0.6/tests/IDS/MonitorTest.php deleted file mode 100644 index f32850e..0000000 --- a/dvwa/external/phpids/0.6/tests/IDS/MonitorTest.php +++ /dev/null @@ -1,1389 +0,0 @@ -init = IDS_Init::init($path); - $this->init->config['General']['filter_path'] = dirname(__FILE__) . '/../../lib/IDS/default_filter.xml'; - $this->init->config['General']['tmp_path'] = dirname(__FILE__) . '/../../lib/IDS/tmp'; - $this->init->config['Caching']['path'] = dirname(__FILE__) . '/../../lib/IDS/tmp/default_filter.cache'; - } - - public function testGetHTML() { - $test = new IDS_Monitor( - array('user' => 'admin
copytext
'; - $exploits['html_7'] = '| Test |
|---|
| test |
-  FEEDBACK on my thesis on Session Management: SESSION FIXATION
- |
- 81 | -1 | -euronymous | -
- 06/01/2008 04:05AM - Last Post by euronymous - |
-
copytext
-bodytext © 2008
| PHPIDS | ||||
 | ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -3 / 3 | -
-
|
- 100.00% | -10 / 10 | -
-
|
- 87.50% | -63 / 72 | -|||
| - | ||||||||||||
| Factory.php | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -17 / 17 | -|||
| File.php | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -5 / 5 | -
-
|
- 77.50% | -31 / 40 | -|||
| Interface.php | -
-
|
- 100.00% | -0 / 0 | -
-
|
- 100.00% | -0 / 0 | -
-
|
- 100.00% | -1 / 1 | -|||
| Session.php | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -4 / 4 | -
-
|
- 100.00% | -14 / 14 | -|||
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -17 / 17 | -|||
| - | ||||||||||||
| IDS_Caching | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -17 / 17 | -|||
| public static function factory($init, $type) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -17 / 17 | -||||||
-- 1 : <?php - 2 : - 3 : /** - 4 : * PHPIDS - 5 : * - 6 : * Requirements: PHP5, SimpleXML - 7 : * - 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) - 9 : * - 10 : * PHPIDS is free software; you can redistribute it and/or modify - 11 : * it under the terms of the GNU Lesser General Public License as published by - 12 : * the Free Software Foundation, version 3 of the License, or - 13 : * (at your option) any later version. - 14 : * - 15 : * PHPIDS is distributed in the hope that it will be useful, - 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of - 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - 18 : * GNU Lesser General Public License for more details. - 19 : * - 20 : * You should have received a copy of the GNU Lesser General Public License - 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. - 22 : * - 23 : * PHP version 5.1.6+ - 24 : * - 25 : * @category Security - 26 : * @package PHPIDS - 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 28 : * @author Christian Matthies <ch0012@gmail.com> - 29 : * @author Lars Strojny <lars@strojny.net> - 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 31 : * @link http://php-ids.org/ - 32 : */ - 33 : - 34 : /** - 35 : * Caching factory - 36 : * - 37 : * This class is used as a factory to load the correct concrete caching - 38 : * implementation. - 39 : * - 40 : * @category Security - 41 : * @package PHPIDS - 42 : * @author Christian Matthies <ch0012@gmail.com> - 43 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 44 : * @author Lars Strojny <lars@strojny.net> - 45 : * @copyright 2007 The PHPIDS Group - 46 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 47 : * @version Release: $Id:Factory.php 517 2007-09-15 15:04:13Z mario $ - 48 : * @link http://php-ids.org/ - 49 : * @since Version 0.4 - 50 : */ - 51 : class IDS_Caching - 52 : { - 53 : - 54 : /** - 55 : * Factory method - 56 : * - 57 : * @param array $init the IDS_Init object - 58 : * @param string $type the caching type - 59 : * - 60 : * @return object the caching facility - 61 : */ - 62 : public static function factory($init, $type) - 63 : { - 64 : - 65 50 : $object = false; - 66 50 : $wrapper = preg_replace( - 67 50 : '/\W+/m', - 68 50 : null, - 69 50 : ucfirst($init->config['Caching']['caching']) - 70 50 : ); - 71 50 : $class = 'IDS_Caching_' . $wrapper; - 72 50 : $path = dirname(__FILE__) . DIRECTORY_SEPARATOR . - 73 50 : $wrapper . '.php'; - 74 : - 75 50 : if (file_exists($path)) { - 76 49 : include_once $path; - 77 : - 78 49 : if (class_exists($class)) { - 79 49 : $object = call_user_func(array($class, 'getInstance'), - 80 49 : $type, $init); - 81 49 : } - 82 49 : } - 83 : - 84 50 : return $object; - 85 : } - 86 : } - 87 : - 88 : /* - 89 : * Local variables: - 90 : * tab-width: 4 - 91 : * c-basic-offset: 4 - 92 : * End: - -- |
-
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -5 / 5 | -
-
|
- 77.50% | -31 / 40 | -|||
| - | ||||||||||||
| IDS_Caching_File | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -5 / 5 | -
-
|
- 76.92% | -30 / 39 | -|||
| public function __construct($type, $init) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 62.50% | -5 / 8 | -||||||
| public static function getInstance($type, $init) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -4 / 4 | -||||||
| public function setCache(array $data) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 71.43% | -10 / 14 | -||||||
| public function getCache() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -5 / 5 | -||||||
| protected function readFile($filename) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 71.43% | -5 / 7 | -||||||
-- 1 : <?php - 2 : - 3 : /** - 4 : * PHPIDS - 5 : * - 6 : * Requirements: PHP5, SimpleXML - 7 : * - 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) - 9 : * - 10 : * PHPIDS is free software; you can redistribute it and/or modify - 11 : * it under the terms of the GNU Lesser General Public License as published by - 12 : * the Free Software Foundation, version 3 of the License, or - 13 : * (at your option) any later version. - 14 : * - 15 : * PHPIDS is distributed in the hope that it will be useful, - 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of - 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - 18 : * GNU Lesser General Public License for more details. - 19 : * - 20 : * You should have received a copy of the GNU Lesser General Public License - 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. - 22 : * - 23 : * PHP version 5.1.6+ - 24 : * - 25 : * @category Security - 26 : * @package PHPIDS - 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 28 : * @author Christian Matthies <ch0012@gmail.com> - 29 : * @author Lars Strojny <lars@strojny.net> - 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 31 : * @link http://php-ids.org/ - 32 : */ - 33 : - 34 1 : require_once 'IDS/Caching/Interface.php'; - 35 : - 36 : /** - 37 : * File caching wrapper - 38 : * - 39 : * This class inhabits functionality to get and set cache via a static flatfile. - 40 : * - 41 : * @category Security - 42 : * @package PHPIDS - 43 : * @author Christian Matthies <ch0012@gmail.com> - 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 45 : * @author Lars Strojny <lars@strojny.net> - 46 : * @copyright 2007 The PHPIDS Group - 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 48 : * @version Release: $Id:File.php 517 2007-09-15 15:04:13Z mario $ - 49 : * @link http://php-ids.org/ - 50 : * @since Version 0.4 - 51 : */ - 52 1 : class IDS_Caching_File implements IDS_Caching_Interface - 53 : { - 54 : - 55 : /** - 56 : * Caching type - 57 : * - 58 : * @var string - 59 : */ - 60 : private $type = null; - 61 : - 62 : /** - 63 : * Cache configuration - 64 : * - 65 : * @var array - 66 : */ - 67 : private $config = null; - 68 : - 69 : /** - 70 : * Path to cache file - 71 : * - 72 : * @var string - 73 : */ - 74 : private $path = null; - 75 : - 76 : /** - 77 : * Holds an instance of this class - 78 : * - 79 : * @var object - 80 : */ - 81 : private static $cachingInstance = null; - 82 : - 83 : /** - 84 : * Constructor - 85 : * - 86 : * @param string $type caching type - 87 : * @param array $init the IDS_Init object - 88 : * - 89 : * @return void - 90 : */ - 91 : public function __construct($type, $init) - 92 : { - 93 : - 94 1 : $this->type = $type; - 95 1 : $this->config = $init->config['Caching']; - 96 1 : $this->path = $init->getBasePath() . $this->config['path']; - 97 : - 98 1 : if (file_exists($this->path) && !is_writable($this->path)) { - 99 0 : throw new Exception('Make sure all files in ' . - 100 0 : htmlspecialchars($this->path, ENT_QUOTES, 'UTF-8') . - 101 0 : 'are writeable!'); - 102 : } - 103 1 : } - 104 : - 105 : /** - 106 : * Returns an instance of this class - 107 : * - 108 : * @param string $type caching type - 109 : * @param array $init the IDS_Init object - 110 : * - 111 : * @return object $this - 112 : */ - 113 : public static function getInstance($type, $init) - 114 : { - 115 45 : if (!self::$cachingInstance) { - 116 1 : self::$cachingInstance = new IDS_Caching_File($type, $init); - 117 1 : } - 118 : - 119 45 : return self::$cachingInstance; - 120 : } - 121 : - 122 : /** - 123 : * Writes cache data into the file - 124 : * - 125 : * @param array $data the cache data - 126 : * - 127 : * @throws Exception if cache file couldn't be created - 128 : * @return object $this - 129 : */ - 130 : public function setCache(array $data) - 131 : { - 132 44 : if (!is_writable(preg_replace('/[\/][^\/]+\.[^\/]++$/', null, - 133 44 : $this->path))) { - 134 0 : throw new Exception('Temp directory ' . - 135 0 : htmlspecialchars($this->path, ENT_QUOTES, 'UTF-8') . - 136 0 : ' seems not writable'); - 137 : } - 138 : - 139 44 : if ((!file_exists($this->path) || (time()-filectime($this->path)) > - 140 44 : $this->config['expiration_time'])) { - 141 3 : $handle = @fopen($this->path, 'w+'); - 142 : - 143 3 : if (!$handle) { - 144 0 : throw new Exception("Cache file couldn't be created"); - 145 : } - 146 : - 147 3 : fwrite($handle, serialize($data)); - 148 3 : fclose($handle); - 149 3 : } - 150 : - 151 44 : return $this; - 152 : } - 153 : - 154 : /** - 155 : * Returns the cached data - 156 : * - 157 : * Note that this method returns false if either type or file cache is - 158 : * not set - 159 : * - 160 : * @return mixed cache data or false - 161 : */ - 162 : public function getCache() - 163 : { - 164 : - 165 : // make sure filters are parsed again if cache expired - 166 43 : if (file_exists($this->path) && (time()-filectime($this->path)) < - 167 43 : $this->config['expiration_time']) { - 168 42 : $data = unserialize($this->readFile($this->path)); - 169 42 : return $data; - 170 : } - 171 : - 172 1 : return false; - 173 : } - 174 : - 175 : /** - 176 : * Read file and stripslashes if required - 177 : * - 178 : * @param string $filename Name of the file to read - 179 : * @return string - 180 : */ - 181 : protected function readFile($filename) - 182 : { - 183 42 : @set_magic_quotes_runtime(0); - 184 42 : $content = file_get_contents($filename); - 185 42 : if (function_exists('get_magic_quotes_runtime') and - 186 42 : get_magic_quotes_runtime()) { - 187 : - 188 0 : $content = stripslashes($content); - 189 0 : } - 190 42 : return $content; - 191 : } - 192 : } - 193 : - 194 : /* - 195 : * Local variables: - 196 : * tab-width: 4 - 197 : * c-basic-offset: 4 - 198 : * End: - 199 : */ - -- |
-
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -0 / 0 | -
-
|
- 100.00% | -0 / 0 | -
-
|
- 100.00% | -1 / 1 | -|||
| - | ||||||||||||
-- 1 : <?php - 2 : - 3 : /** - 4 : * PHPIDS - 5 : * - 6 : * Requirements: PHP5, SimpleXML - 7 : * - 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) - 9 : * - 10 : * PHPIDS is free software; you can redistribute it and/or modify - 11 : * it under the terms of the GNU Lesser General Public License as published by - 12 : * the Free Software Foundation, version 3 of the License, or - 13 : * (at your option) any later version. - 14 : * - 15 : * PHPIDS is distributed in the hope that it will be useful, - 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of - 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - 18 : * GNU Lesser General Public License for more details. - 19 : * - 20 : * You should have received a copy of the GNU Lesser General Public License - 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. - 22 : * - 23 : * PHP version 5.1.6+ - 24 : * - 25 : * @category Security - 26 : * @package PHPIDS - 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 28 : * @author Christian Matthies <ch0012@gmail.com> - 29 : * @author Lars Strojny <lars@strojny.net> - 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 31 : * @link http://php-ids.org/ - 32 : */ - 33 : - 34 : /** - 35 : * Caching wrapper interface - 36 : * - 37 : * @category Security - 38 : * @package PHPIDS - 39 : * @author Christian Matthies <ch0012@gmail.com> - 40 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 41 : * @author Lars Strojny <lars@strojny.net> - 42 : * @copyright 2007 The PHPIDS Group - 43 : * @version SVN: $Id:Interface.php 517 2007-09-15 15:04:13Z mario $ - 44 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 45 : * @since Version 0.4 - 46 : * @link http://php-ids.org/ - 47 : */ - 48 1 : interface IDS_Caching_Interface - 49 : { - 50 : /** - 51 : * Interface method - 52 : * - 53 : * @param array $data the cache data - 54 : * - 55 : * @return void - 56 : */ - 57 : public function setCache(array $data); - 58 : - 59 : /** - 60 : * Interface method - 61 : * - 62 : * @return void - 63 : */ - 64 : public function getCache(); - 65 : } - 66 : - 67 : /* - 68 : * Local variables: - 69 : * tab-width: 4 - 70 : * c-basic-offset: 4 - 71 : * End: - -- |
-
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -4 / 4 | -
-
|
- 100.00% | -14 / 14 | -|||
| - | ||||||||||||
| IDS_Caching_Session | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -4 / 4 | -
-
|
- 100.00% | -13 / 13 | -|||
| public function __construct($type, $init) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -3 / 3 | -||||||
| public static function getInstance($type, $init) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -4 / 4 | -||||||
| public function setCache(array $data) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -2 / 2 | -||||||
| public function getCache() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -3 / 3 | -||||||
-- 1 : <?php - 2 : - 3 : /** - 4 : * PHPIDS - 5 : * - 6 : * Requirements: PHP5, SimpleXML - 7 : * - 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) - 9 : * - 10 : * PHPIDS is free software; you can redistribute it and/or modify - 11 : * it under the terms of the GNU Lesser General Public License as published by - 12 : * the Free Software Foundation, version 3 of the License, or - 13 : * (at your option) any later version. - 14 : * - 15 : * PHPIDS is distributed in the hope that it will be useful, - 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of - 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - 18 : * GNU Lesser General Public License for more details. - 19 : * - 20 : * You should have received a copy of the GNU Lesser General Public License - 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. - 22 : * - 23 : * PHP version 5.1.6+ - 24 : * - 25 : * @category Security - 26 : * @package PHPIDS - 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 28 : * @author Christian Matthies <ch0012@gmail.com> - 29 : * @author Lars Strojny <lars@strojny.net> - 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 31 : * @link http://php-ids.org/ - 32 : */ - 33 : - 34 1 : require_once 'IDS/Caching/Interface.php'; - 35 : - 36 : /** - 37 : * File caching wrapper - 38 : * - 39 : * This class inhabits functionality to get and set cache via session. - 40 : * - 41 : * @category Security - 42 : * @package PHPIDS - 43 : * @author Christian Matthies <ch0012@gmail.com> - 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 45 : * @author Lars Strojny <lars@strojny.net> - 46 : * @copyright 2007 The PHPIDS Group - 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 48 : * @version Release: $Id:Session.php 517 2007-09-15 15:04:13Z mario $ - 49 : * @link http://php-ids.org/ - 50 : * @since Version 0.4 - 51 : */ - 52 1 : class IDS_Caching_Session implements IDS_Caching_Interface - 53 : { - 54 : - 55 : /** - 56 : * Caching type - 57 : * - 58 : * @var string - 59 : */ - 60 : private $type = null; - 61 : - 62 : /** - 63 : * Cache configuration - 64 : * - 65 : * @var array - 66 : */ - 67 : private $config = null; - 68 : - 69 : /** - 70 : * Holds an instance of this class - 71 : * - 72 : * @var object - 73 : */ - 74 : private static $cachingInstance = null; - 75 : - 76 : /** - 77 : * Constructor - 78 : * - 79 : * @param string $type caching type - 80 : * @param array $init the IDS_Init object - 81 : * - 82 : * @return void - 83 : */ - 84 : public function __construct($type, $init) - 85 : { - 86 1 : $this->type = $type; - 87 1 : $this->config = $init->config['Caching']; - 88 1 : } - 89 : - 90 : /** - 91 : * Returns an instance of this class - 92 : * - 93 : * @param string $type caching type - 94 : * @param array $init the IDS_Init object - 95 : * - 96 : * @return object $this - 97 : */ - 98 : public static function getInstance($type, $init) - 99 : { - 100 : - 101 4 : if (!self::$cachingInstance) { - 102 1 : self::$cachingInstance = new IDS_Caching_Session($type, $init); - 103 1 : } - 104 : - 105 4 : return self::$cachingInstance; - 106 : } - 107 : - 108 : /** - 109 : * Writes cache data into the session - 110 : * - 111 : * @param array $data the caching data - 112 : * - 113 : * @return object $this - 114 : */ - 115 : public function setCache(array $data) - 116 : { - 117 : - 118 3 : $_SESSION['PHPIDS'][$this->type] = $data; - 119 3 : return $this; - 120 : } - 121 : - 122 : /** - 123 : * Returns the cached data - 124 : * - 125 : * Note that this method returns false if either type or file cache is not set - 126 : * - 127 : * @return mixed cache data or false - 128 : */ - 129 : public function getCache() - 130 : { - 131 : - 132 2 : if ($this->type && $_SESSION['PHPIDS'][$this->type]) { - 133 1 : return $_SESSION['PHPIDS'][$this->type]; - 134 : } - 135 : - 136 1 : return false; - 137 : } - 138 : } - 139 : - 140 : /** - 141 : * Local variables: - 142 : * tab-width: 4 - 143 : * c-basic-offset: 4 - 144 : * End: - 145 : */ - -- |
-
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -18 / 18 | -
-
|
- 85.57% | -249 / 291 | -|||
| - | ||||||||||||
| IDS_Converter | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -18 / 18 | -
-
|
- 85.57% | -249 / 291 | -|||
| public static function runAll($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -6 / 6 | -||||||
| public static function convertFromCommented($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -11 / 11 | -||||||
| public static function convertFromNewLines($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -3 / 3 | -||||||
| public static function convertFromJSCharcode($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -51 / 51 | -||||||
| public static function convertJSRegexModifiers($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -2 / 2 | -||||||
| public static function convertEntities($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -||||||
| public static function convertQuotes($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -3 / 3 | -||||||
| public static function convertFromSQLHex($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -13 / 13 | -||||||
| public static function convertFromSQLKeywords($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -14 / 14 | -||||||
| public static function convertFromControlChars($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -19 / 19 | -||||||
| public static function convertFromNestedBase64($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -10 / 10 | -||||||
| public static function convertFromOutOfRangeChars($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -||||||
| public static function convertFromXML($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -4 / 4 | -||||||
| public static function convertFromJSUnicode($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 36.36% | -4 / 11 | -||||||
| public static function convertFromUTF7($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 17.50% | -7 / 40 | -||||||
| public static function convertConcatenations($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -28 / 28 | -||||||
| public static function convertFromProprietaryEncodings($value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -13 / 13 | -||||||
| public static function runCentrifuge($value, IDS_Monitor $monitor = NULL) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 95.83% | -46 / 48 | -||||||
-- 1 : <?php - 2 : - 3 : /** - 4 : * PHPIDS - 5 : * - 6 : * Requirements: PHP5, SimpleXML - 7 : * - 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) - 9 : * - 10 : * PHPIDS is free software; you can redistribute it and/or modify - 11 : * it under the terms of the GNU Lesser General Public License as published by - 12 : * the Free Software Foundation, version 3 of the License, or - 13 : * (at your option) any later version. - 14 : * - 15 : * PHPIDS is distributed in the hope that it will be useful, - 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of - 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - 18 : * GNU Lesser General Public License for more details. - 19 : * - 20 : * You should have received a copy of the GNU Lesser General Public License - 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. - 22 : * - 23 : * PHP version 5.1.6+ - 24 : * - 25 : * @category Security - 26 : * @package PHPIDS - 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 28 : * @author Christian Matthies <ch0012@gmail.com> - 29 : * @author Lars Strojny <lars@strojny.net> - 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 31 : * @link http://php-ids.org/ - 32 : */ - 33 : - 34 : /** - 35 : * PHPIDS specific utility class to convert charsets manually - 36 : * - 37 : * Note that if you make use of IDS_Converter::runAll(), existing class - 38 : * methods will be executed in the same order as they are implemented in the - 39 : * class tree! - 40 : * - 41 : * @category Security - 42 : * @package PHPIDS - 43 : * @author Christian Matthies <ch0012@gmail.com> - 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 45 : * @author Lars Strojny <lars@strojny.net> - 46 : * @copyright 2007 The PHPIDS Group - 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 48 : * @version Release: $Id:Converter.php 517 2007-09-15 15:04:13Z mario $ - 49 : * @link http://php-ids.org/ - 50 : */ - 51 : class IDS_Converter - 52 1 : { - 53 : /** - 54 : * Runs all converter functions - 55 : * - 56 : * Note that if you make use of IDS_Converter::runAll(), existing class - 57 : * methods will be executed in the same order as they are implemented in the - 58 : * class tree! - 59 : * - 60 : * @param string $value the value to convert - 61 : * - 62 : * @static - 63 : * @return string - 64 : */ - 65 : public static function runAll($value) - 66 : { - 67 35 : foreach (get_class_methods(__CLASS__) as $method) { - 68 : - 69 35 : if (strpos($method, 'run') === 0) { - 70 35 : continue; - 71 : } - 72 35 : $value = self::$method($value); - 73 35 : } - 74 : - 75 35 : return $value; - 76 : } - 77 : - 78 : /** - 79 : * Check for comments and erases them if available - 80 : * - 81 : * @param string $value the value to convert - 82 : * - 83 : * @static - 84 : * @return string - 85 : */ - 86 : public static function convertFromCommented($value) - 87 : { - 88 : // check for existing comments - 89 35 : if (preg_match('/(?:\<!-|-->|\/\*|\*\/|\/\/\W*\w+\s*$)|' . - 90 35 : '(?:--[^-]*-)/ms', $value)) { - 91 : - 92 : $pattern = array( - 93 8 : '/(?:(?:<!)(?:(?:--(?:[^-]*(?:-[^-]+)*)--\s*)*)(?:>))/ms', - 94 8 : '/(?:(?:\/\*\/*[^\/\*]*)+\*\/)/ms', - 95 : '/(?:--[^-]*-)/ms' - 96 8 : ); - 97 : - 98 8 : $converted = preg_replace($pattern, ';', $value); - 99 8 : $value .= "\n" . $converted; - 100 8 : } - 101 : //make sure inline comments are detected and converted correctly - 102 35 : $value = preg_replace('/(<\w+)\/+(\w+=?)/m', '$1/$2', $value); - 103 35 : $value = preg_replace('/[^\\\:]\/\/(.*)$/m', '/**/$1', $value); - 104 : - 105 35 : return $value; - 106 : } - 107 : - 108 : /** - 109 : * Strip newlines - 110 : * - 111 : * @param string $value the value to convert - 112 : * - 113 : * @static - 114 : * @return string - 115 : */ - 116 : public static function convertFromNewLines($value) - 117 : { - 118 : //check for inline linebreaks - 119 35 : $search = array('\r', '\n', '\f', '\t', '\v'); - 120 35 : $value = str_replace($search, ';', $value); - 121 : - 122 : //convert real linebreaks - 123 35 : return preg_replace('/(?:\n|\r|\v)/m', ' ', $value); - 124 : } - 125 : - 126 : /** - 127 : * Checks for common charcode pattern and decodes them - 128 : * - 129 : * @param string $value the value to convert - 130 : * - 131 : * @static - 132 : * @return string - 133 : */ - 134 : public static function convertFromJSCharcode($value) - 135 : { - 136 35 : $matches = array(); - 137 : - 138 : // check if value matches typical charCode pattern - 139 35 : if (preg_match_all('/(?:[\d+-=\/\* ]+(?:\s?,\s?[\d+-=\/\* ]+)){4,}/ms', - 140 35 : $value, $matches)) { - 141 : - 142 1 : $converted = ''; - 143 1 : $string = implode(',', $matches[0]); - 144 1 : $string = preg_replace('/\s/', '', $string); - 145 1 : $string = preg_replace('/\w+=/', '', $string); - 146 1 : $charcode = explode(',', $string); - 147 : - 148 1 : foreach ($charcode as $char) { - 149 1 : $char = preg_replace('/\W0/s', '', $char); - 150 : - 151 1 : if (preg_match_all('/\d*[+-\/\* ]\d+/', $char, $matches)) { - 152 1 : $match = preg_split('/(\W?\d+)/', - 153 1 : (implode('', $matches[0])), - 154 1 : null, - 155 1 : PREG_SPLIT_DELIM_CAPTURE); - 156 : - 157 1 : if (array_sum($match) >= 20 && array_sum($match) <= 127) { - 158 1 : $converted .= chr(array_sum($match)); - 159 1 : } - 160 : - 161 1 : } elseif (!empty($char) && $char >= 20 && $char <= 127) { - 162 1 : $converted .= chr($char); - 163 1 : } - 164 1 : } - 165 : - 166 1 : $value .= "\n" . $converted; - 167 1 : } - 168 : - 169 : // check for octal charcode pattern - 170 35 : if (preg_match_all('/(?:(?:[\\\]+\d+[ \t]*){8,})/ims', $value, $matches)) { - 171 : - 172 1 : $converted = ''; - 173 1 : $charcode = explode('\\', preg_replace('/\s/', '', implode(',', - 174 1 : $matches[0]))); - 175 : - 176 1 : foreach ($charcode as $char) { - 177 1 : if (!empty($char)) { - 178 1 : if (octdec($char) >= 20 && octdec($char) <= 127) { - 179 1 : $converted .= chr(octdec($char)); - 180 1 : } - 181 1 : } - 182 1 : } - 183 1 : $value .= "\n" . $converted; - 184 1 : } - 185 : - 186 : // check for hexadecimal charcode pattern - 187 35 : if (preg_match_all('/(?:(?:[\\\]+\w+\s*){8,})/ims', $value, $matches)) { - 188 : - 189 2 : $converted = ''; - 190 2 : $charcode = explode('\\', preg_replace('/[ux]/', '', implode(',', - 191 2 : $matches[0]))); - 192 : - 193 2 : foreach ($charcode as $char) { - 194 2 : if (!empty($char)) { - 195 2 : if (hexdec($char) >= 20 && hexdec($char) <= 127) { - 196 2 : $converted .= chr(hexdec($char)); - 197 2 : } - 198 2 : } - 199 2 : } - 200 2 : $value .= "\n" . $converted; - 201 2 : } - 202 : - 203 35 : return $value; - 204 : } - 205 : - 206 : /** - 207 : * Eliminate JS regex modifiers - 208 : * - 209 : * @param string $value the value to convert - 210 : * - 211 : * @static - 212 : * @return string - 213 : */ - 214 : public static function convertJSRegexModifiers($value) - 215 : { - 216 35 : $value = preg_replace('/\/[gim]/', '/', $value); - 217 : - 218 35 : return $value; - 219 : } - 220 : - 221 : /** - 222 : * Converts from hex/dec entities - 223 : * - 224 : * @param string $value the value to convert - 225 : * - 226 : * @static - 227 : * @return string - 228 : */ - 229 : public static function convertEntities($value) - 230 : { - 231 35 : $converted = null; - 232 35 : if (preg_match('/&#x?[\w]+/ms', $value)) { - 233 6 : $converted = preg_replace('/(&#x?[\w]{2}\d?);?/ms', '$1;', $value); - 234 6 : $converted = html_entity_decode($converted, ENT_QUOTES, 'UTF-8'); - 235 6 : $value .= "\n" . str_replace(';;', ';', $converted); - 236 6 : } - 237 : - 238 35 : return $value; - 239 : } - 240 : - 241 : /** - 242 : * Normalize quotes - 243 : * - 244 : * @param string $value the value to convert - 245 : * - 246 : * @static - 247 : * @return string - 248 : */ - 249 : public static function convertQuotes($value) - 250 : { - 251 : // normalize different quotes to " - 252 35 : $pattern = array('\'', '`', '´', '’', '‘'); - 253 35 : $value = str_replace($pattern, '"', $value); - 254 : - 255 35 : return $value; - 256 : } - 257 : - 258 : /** - 259 : * Converts SQLHEX to plain text - 260 : * - 261 : * @param string $value the value to convert - 262 : * - 263 : * @static - 264 : * @return string - 265 : */ - 266 : public static function convertFromSQLHex($value) - 267 : { - 268 35 : $matches = array(); - 269 35 : if(preg_match_all('/(?:0x[a-f\d]{2,}[a-f\d\s]*)+/im', $value, $matches)) { - 270 3 : foreach($matches[0] as $match) { - 271 3 : $converted = ''; - 272 3 : foreach(str_split($match, 2) as $hex_index) { - 273 3 : if(preg_match('/[a-f\d]{2,3}/i', $hex_index)) { - 274 3 : $converted .= chr(hexdec($hex_index)); - 275 3 : } - 276 3 : } - 277 3 : $value = str_replace($match, $converted, $value); - 278 3 : } - 279 3 : } - 280 35 : return $value; - 281 : } - 282 : - 283 : /** - 284 : * Converts basic SQL keywords and obfuscations - 285 : * - 286 : * @param string $value the value to convert - 287 : * - 288 : * @static - 289 : * @return string - 290 : */ - 291 : public static function convertFromSQLKeywords($value) - 292 : { - 293 : $pattern = array('/(?:IS\s+null)|(LIKE\s+null)|' . - 294 35 : '(?:(?:^|\W)IN[+\s]*\([\s\d"]+[^()]*\))/ims'); - 295 35 : $value = preg_replace($pattern, '"=0', $value); - 296 35 : $value = preg_replace('/null,/ims', ',0', $value); - 297 35 : $value = preg_replace('/,null/ims', ',0', $value); - 298 : $pattern = array('/[^\w,]NULL|\\\N|TRUE|FALSE|UTC_TIME|' . - 299 35 : 'LOCALTIME(?:STAMP)?|CURRENT_\w+|BINARY|' . - 300 35 : '(?:(?:ASCII|SOUNDEX|' . - 301 35 : 'MD5|R?LIKE)[+\s]*\([^()]+\))|(?:-+\d)/ims'); - 302 35 : $value = preg_replace($pattern, 0, $value); - 303 : $pattern = array('/(?:NOT\s+BETWEEN)|(?:IS\s+NOT)|(?:NOT\s+IN)|' . - 304 35 : '(?:XOR|\WDIV\W|\WNOT\W|<>|RLIKE(?:\s+BINARY)?)|' . - 305 35 : '(?:REGEXP\s+BINARY)|' . - 306 35 : '(?:SOUNDS\s+LIKE)/ims'); - 307 35 : $value = preg_replace($pattern, '!', $value); - 308 35 : $value = preg_replace('/"\s+\d/', '"', $value); - 309 : - 310 35 : return $value; - 311 : } - 312 : - 313 : /** - 314 : * Detects nullbytes and controls chars via ord() - 315 : * - 316 : * @param string $value the value to convert - 317 : * - 318 : * @static - 319 : * @return string - 320 : */ - 321 : public static function convertFromControlChars($value) - 322 : { - 323 : // critical ctrl values - 324 35 : $search = array(chr(0), chr(1), chr(2), - 325 35 : chr(3), chr(4), chr(5), - 326 35 : chr(6), chr(7), chr(8), - 327 35 : chr(11), chr(12), chr(14), - 328 35 : chr(15), chr(16), chr(17), - 329 35 : chr(18), chr(19)); - 330 35 : $value = str_replace($search, '%00', $value); - 331 35 : $urlencoded = urlencode($value); - 332 : - 333 : //take care for malicious unicode characters - 334 35 : $value = urldecode(preg_replace('/(?:%E(?:2|3)%8(?:0|1)%(?:A|8|9)' . - 335 35 : '\w|%EF%BB%BF|%EF%BF%BD)|(?:&#(?:65|8)\d{3};?)/i', null, - 336 35 : $urlencoded)); - 337 : - 338 35 : $value = preg_replace('/(?:&[#x]*(200|820|200|820|zwn?j|lrm|rlm)\w?;?)/i', null, - 339 35 : $value); - 340 : - 341 35 : $value = preg_replace('/(?:&#(?:65|8)\d{3};?)|' . - 342 35 : '(?:&#(?:56|7)3\d{2};?)|' . - 343 35 : '(?:&#x(?:fe|20)\w{2};?)|' . - 344 35 : '(?:&#x(?:d[c-f])\w{2};?)/i', null, - 345 35 : $value); - 346 : - 347 35 : return $value; - 348 : } - 349 : - 350 : /** - 351 : * This method matches and translates base64 strings and fragments - 352 : * used in data URIs - 353 : * - 354 : * @param string $value the value to convert - 355 : * - 356 : * @static - 357 : * @return string - 358 : */ - 359 : public static function convertFromNestedBase64($value) - 360 : { - 361 35 : $matches = array(); - 362 35 : preg_match_all('/(?:^|[,&?])\s*([a-z0-9]{30,}=*)(?:\W|$)/im', - 363 35 : $value, - 364 35 : $matches); - 365 : - 366 35 : foreach ($matches[1] as $item) { - 367 2 : if (isset($item) && !preg_match('/[a-f0-9]{32}/i', $item)) { - 368 2 : $value = str_replace($item, base64_decode($item), $value); - 369 2 : } - 370 35 : } - 371 : - 372 35 : return $value; - 373 : } - 374 : - 375 : /** - 376 : * Detects nullbytes and controls chars via ord() - 377 : * - 378 : * @param string $value the value to convert - 379 : * - 380 : * @static - 381 : * @return string - 382 : */ - 383 : public static function convertFromOutOfRangeChars($value) - 384 : { - 385 35 : $values = str_split($value); - 386 35 : foreach ($values as $item) { - 387 35 : if (ord($item) >= 127) { - 388 8 : $value = str_replace($item, 'U', $value); - 389 8 : } - 390 35 : } - 391 : - 392 35 : return $value; - 393 : } - 394 : - 395 : /** - 396 : * Strip XML patterns - 397 : * - 398 : * @param string $value the value to convert - 399 : * - 400 : * @static - 401 : * @return string - 402 : */ - 403 : public static function convertFromXML($value) - 404 : { - 405 35 : $converted = strip_tags($value); - 406 : - 407 35 : if ($converted && ($converted != $value)) { - 408 24 : return $value . "\n" . $converted; - 409 : } - 410 30 : return $value; - 411 : } - 412 : - 413 : /** - 414 : * This method converts JS unicode code points to - 415 : * regular characters - 416 : * - 417 : * @param string $value the value to convert - 418 : * - 419 : * @static - 420 : * @return string - 421 : */ - 422 : public static function convertFromJSUnicode($value) - 423 : { - 424 35 : $matches = array(); - 425 : - 426 35 : preg_match_all('/\\\u[0-9a-f]{4}/ims', $value, $matches); - 427 : - 428 35 : if (!empty($matches[0])) { - 429 0 : foreach ($matches[0] as $match) { - 430 0 : $value = str_replace($match, - 431 0 : chr(hexdec(substr($match, 2, 4))), - 432 0 : $value); - 433 0 : } - 434 0 : $value .= "\n\u0001"; - 435 0 : } - 436 : - 437 35 : return $value; - 438 : } - 439 : - 440 : - 441 : /** - 442 : * Converts relevant UTF-7 tags to UTF-8 - 443 : * - 444 : * @param string $value the value to convert - 445 : * - 446 : * @static - 447 : * @return string - 448 : */ - 449 : public static function convertFromUTF7($value) - 450 : { - 451 35 : if(preg_match('/\+A\w+-/m', $value)) { - 452 1 : if (function_exists('mb_convert_encoding')) { - 453 1 : if(version_compare(PHP_VERSION, '5.2.8', '<')) { - 454 0 : $tmp_chars = str_split($value); - 455 0 : $value = ''; - 456 0 : foreach($tmp_chars as $char) { - 457 0 : if(ord($char) <= 127) { - 458 0 : $value .= $char; - 459 0 : } - 460 0 : } - 461 0 : } - 462 1 : $value .= "\n" . mb_convert_encoding($value, 'UTF-8', 'UTF-7'); - 463 1 : } else { - 464 : //list of all critical UTF7 codepoints - 465 : $schemes = array( - 466 0 : '+ACI-' => '"', - 467 0 : '+ADw-' => '<', - 468 0 : '+AD4-' => '>', - 469 0 : '+AFs-' => '[', - 470 0 : '+AF0-' => ']', - 471 0 : '+AHs-' => '{', - 472 0 : '+AH0-' => '}', - 473 0 : '+AFw-' => '\\', - 474 0 : '+ADs-' => ';', - 475 0 : '+ACM-' => '#', - 476 0 : '+ACY-' => '&', - 477 0 : '+ACU-' => '%', - 478 0 : '+ACQ-' => '$', - 479 0 : '+AD0-' => '=', - 480 0 : '+AGA-' => '`', - 481 0 : '+ALQ-' => '"', - 482 0 : '+IBg-' => '"', - 483 0 : '+IBk-' => '"', - 484 0 : '+AHw-' => '|', - 485 0 : '+ACo-' => '*', - 486 0 : '+AF4-' => '^', - 487 0 : '+ACIAPg-' => '">', - 488 : '+ACIAPgA8-' => '">' - 489 0 : ); - 490 : - 491 0 : $value = str_ireplace(array_keys($schemes), - 492 0 : array_values($schemes), $value); - 493 : } - 494 1 : } - 495 35 : return $value; - 496 : } - 497 : - 498 : /** - 499 : * Converts basic concatenations - 500 : * - 501 : * @param string $value the value to convert - 502 : * - 503 : * @static - 504 : * @return string - 505 : */ - 506 : public static function convertConcatenations($value) - 507 : { - 508 : //normalize remaining backslashes - 509 35 : if ($value != preg_replace('/(\w)\\\/', "$1", $value)) { - 510 3 : $value .= preg_replace('/(\w)\\\/', "$1", $value); - 511 3 : } - 512 : - 513 35 : $compare = stripslashes($value); - 514 : - 515 35 : $pattern = array('/(?:<\/\w+>\+<\w+>)/s', - 516 35 : '/(?:":\d+[^"[]+")/s', - 517 35 : '/(?:"?"\+\w+\+")/s', - 518 35 : '/(?:"\s*;[^"]+")|(?:";[^"]+:\s*")/s', - 519 35 : '/(?:"\s*(?:;|\+).{8,18}:\s*")/s', - 520 35 : '/(?:";\w+=)|(?:!""&&")|(?:~)/s', - 521 35 : '/(?:"?"\+""?\+?"?)|(?:;\w+=")|(?:"[|&]{2,})/s', - 522 35 : '/(?:"\s*\W+")/s', - 523 35 : '/(?:";\w\s*\+=\s*\w?\s*")/s', - 524 35 : '/(?:"[|&;]+\s*[^|&\n]*[|&]+\s*"?)/s', - 525 35 : '/(?:";\s*\w+\W+\w*\s*[|&]*")/s', - 526 35 : '/(?:"\s*"\s*\.)/s', - 527 35 : '/(?:\s*new\s+\w+\s*[+"])/', - 528 35 : '/(?:(?:^|\s+)(?:do|else)\s+)/', - 529 35 : '/(?:\{\s*new\s+\w+\s*\})/', - 530 35 : '/(?:(this|self).)/'); - 531 : - 532 : // strip out concatenations - 533 35 : $converted = preg_replace($pattern, null, $compare); - 534 : - 535 : //strip object traversal - 536 35 : $converted = preg_replace('/\w(\.\w\()/', "$1", $converted); - 537 : - 538 : //convert JS special numbers - 539 35 : $converted = preg_replace('/(?:\(*[.\d]e[+-]*[^a-z\W]+\)*)' . - 540 35 : '|(?:NaN|Infinity)\W/ms', 1, $converted); - 541 : - 542 35 : if ($converted && ($compare != $converted)) { - 543 15 : $value .= "\n" . $converted; - 544 15 : } - 545 : - 546 35 : return $value; - 547 : } - 548 : - 549 : /** - 550 : * This method collects and decodes proprietary encoding types - 551 : * - 552 : * @param string $value the value to convert - 553 : * @param IDS_Monitor $monitor the monitor object - 554 : * - 555 : * @static - 556 : * @return string - 557 : */ - 558 : public static function convertFromProprietaryEncodings($value) { - 559 : - 560 : //Xajax error reportings - 561 35 : $value = preg_replace('/<!\[CDATA\[(\W+)\]\]>/im', '$1', $value); - 562 : - 563 : //strip false alert triggering apostrophes - 564 35 : $value = preg_replace('/(\w)\"(s)/m', '$1$2', $value); - 565 : - 566 : //strip quotes within typical search patterns - 567 35 : $value = preg_replace('/^"([^"=\\!><~]+)"$/', '$1', $value); - 568 : - 569 : //OpenID login tokens - 570 35 : $value = preg_replace('/{[\w-]{8,9}\}(?:\{[\w=]{8}\}){2}/', null, $value); - 571 : - 572 : //convert Content and \sdo\s to null - 573 35 : $value = preg_replace('/Content|\Wdo\s/', null, $value); - 574 : - 575 : //strip emoticons - 576 35 : $value = preg_replace( - 577 35 : '/(?:[:;]-[()\/PD]+)|(?:\s;[()PD]+)|(?::[()PD]+)|-\.-|\^\^/m', - 578 35 : null, - 579 : $value - 580 35 : ); - 581 : - 582 : // normalize separation char repetion - 583 35 : $value = preg_replace('/([.+~=*_\-])\1{2,}/m', '$1', $value); - 584 : - 585 : //remove parenthesis inside sentences - 586 35 : $value = preg_replace('/(\w\s)\(([&\w]+)\)(\s\w|$)/', '$1$2$3', $value); - 587 : - 588 : //normalize ampersand listings - 589 35 : $value = preg_replace('/(\w\s)&\s(\w)/', '$1$2', $value); - 590 : - 591 35 : return $value; - 592 : } - 593 : - 594 : /** - 595 : * This method is the centrifuge prototype - 596 : * - 597 : * @param string $value the value to convert - 598 : * @param IDS_Monitor $monitor the monitor object - 599 : * - 600 : * @static - 601 : * @return string - 602 : */ - 603 : public static function runCentrifuge($value, IDS_Monitor $monitor = null) - 604 : { - 605 35 : $threshold = 3.49; - 606 : - 607 35 : $unserialized = false; - 608 35 : if(preg_match('/^\w:\d+:\{/', $value)) { - 609 0 : $unserialized = @unserialize($value); - 610 0 : } - 611 : - 612 35 : if (strlen($value) > 25 && !$unserialized) { - 613 : // Check for the attack char ratio - 614 33 : $tmp_value = $value; - 615 33 : $tmp_value = preg_replace('/([*.!?+-])\1{1,}/m', '$1', $tmp_value); - 616 33 : $tmp_value = preg_replace('/"[\p{L}\d\s]+"/m', null, $tmp_value); - 617 : - 618 33 : $stripped_length = strlen(preg_replace('/[\d\s\p{L}.:,%\/><-]+/m', - 619 33 : null, $tmp_value)); - 620 33 : $overall_length = strlen(preg_replace('/([\d\s\p{L}]{3,})+/m', 'aaa', - 621 33 : preg_replace('/\s{2,}/m', null, $tmp_value))); - 622 : - 623 : if ($stripped_length != 0 - 624 33 : && $overall_length/$stripped_length <= $threshold) { - 625 : - 626 16 : $monitor->centrifuge['ratio'] = - 627 16 : $overall_length/$stripped_length; - 628 16 : $monitor->centrifuge['threshold'] = - 629 : $threshold; - 630 : - 631 16 : $value .= "\n$[!!!]"; - 632 16 : } - 633 33 : } - 634 : - 635 35 : if (strlen($value) > 40) { - 636 : // Replace all non-special chars - 637 32 : $converted = preg_replace('/[\w\s\p{L},.!]/', null, $value); - 638 : - 639 : // Split string into an array, unify and sort - 640 32 : $array = str_split($converted); - 641 32 : $array = array_unique($array); - 642 32 : asort($array); - 643 : - 644 : // Normalize certain tokens - 645 : $schemes = array( - 646 32 : '~' => '+', - 647 32 : '^' => '+', - 648 32 : '|' => '+', - 649 32 : '*' => '+', - 650 32 : '%' => '+', - 651 32 : '&' => '+', - 652 : '/' => '+' - 653 32 : ); - 654 : - 655 32 : $converted = implode($array); - 656 32 : $converted = str_replace(array_keys($schemes), - 657 32 : array_values($schemes), $converted); - 658 32 : $converted = preg_replace('/[+-]\s*\d+/', '+', $converted); - 659 32 : $converted = preg_replace('/[()[\]{}]/', '(', $converted); - 660 32 : $converted = preg_replace('/[!?:=]/', ':', $converted); - 661 32 : $converted = preg_replace('/[^:(+]/', null, stripslashes($converted)); - 662 : - 663 : // Sort again and implode - 664 32 : $array = str_split($converted); - 665 32 : asort($array); - 666 : - 667 32 : $converted = implode($array); - 668 : - 669 32 : if (preg_match('/(?:\({2,}\+{2,}:{2,})|(?:\({2,}\+{2,}:+)|' . - 670 32 : '(?:\({3,}\++:{2,})/', $converted)) { - 671 : - 672 15 : $monitor->centrifuge['converted'] = $converted; - 673 : - 674 15 : return $value . "\n" . $converted; - 675 : } - 676 31 : } - 677 : - 678 35 : return $value; - 679 : } - 680 : } - 681 : - 682 : /* - 683 : * Local variables: - 684 : * tab-width: 4 - 685 : * c-basic-offset: 4 - 686 : * End: - 687 : */ - -- |
-
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -8 / 8 | -
-
|
- 100.00% | -36 / 36 | -|||
| - | ||||||||||||
| IDS_Event | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -8 / 8 | -
-
|
- 100.00% | -36 / 36 | -|||
| public function __construct($name, $value, array $filters) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -17 / 17 | -||||||
| public function getName() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function getValue() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function getImpact() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -||||||
| public function getTags() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -||||||
| public function getFilters() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function count() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function getIterator() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
-- 1 : <?php - 2 : - 3 : /** - 4 : * PHPIDS - 5 : * - 6 : * Requirements: PHP5, SimpleXML - 7 : * - 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) - 9 : * - 10 : * PHPIDS is free software; you can redistribute it and/or modify - 11 : * it under the terms of the GNU Lesser General Public License as published by - 12 : * the Free Software Foundation, version 3 of the License, or - 13 : * (at your option) any later version. - 14 : * - 15 : * PHPIDS is distributed in the hope that it will be useful, - 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of - 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - 18 : * GNU Lesser General Public License for more details. - 19 : * - 20 : * You should have received a copy of the GNU Lesser General Public License - 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. - 22 : * - 23 : * PHP version 5.1.6+ - 24 : * - 25 : * @category Security - 26 : * @package PHPIDS - 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 28 : * @author Christian Matthies <ch0012@gmail.com> - 29 : * @author Lars Strojny <lars@strojny.net> - 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 31 : * @link http://php-ids.org/ - 32 : */ - 33 : - 34 : /** - 35 : * PHPIDS event object - 36 : * - 37 : * This class represents a certain event that occured while applying the filters - 38 : * to the supplied data. It aggregates a bunch of IDS_Filter implementations and - 39 : * is a assembled in IDS_Report. - 40 : * - 41 : * Note that this class implements both Countable and IteratorAggregate - 42 : * - 43 : * @category Security - 44 : * @package PHPIDS - 45 : * @author Christian Matthies <ch0012@gmail.com> - 46 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 47 : * @author Lars Strojny <lars@strojny.net> - 48 : * @copyright 2007 The PHPIDS Group - 49 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 50 : * @version Release: $Id:Event.php 517 2007-09-15 15:04:13Z mario $ - 51 : * @link http://php-ids.org/ - 52 : */ - 53 : class IDS_Event implements Countable, IteratorAggregate - 54 : { - 55 : - 56 : /** - 57 : * Event name - 58 : * - 59 : * @var scalar - 60 : */ - 61 : protected $name = null; - 62 : - 63 : /** - 64 : * Value of the event - 65 : * - 66 : * @var scalar - 67 : */ - 68 : protected $value = null; - 69 : - 70 : /** - 71 : * List of filter objects - 72 : * - 73 : * Filter objects in this array are those that matched the events value - 74 : * - 75 : * @var array - 76 : */ - 77 : protected $filters = array(); - 78 : - 79 : /** - 80 : * Calculated impact - 81 : * - 82 : * Total impact of the event - 83 : * - 84 : * @var integer - 85 : */ - 86 : protected $impact = 0; - 87 : - 88 : /** - 89 : * Affecte tags - 90 : * - 91 : * @var array - 92 : */ - 93 : protected $tags = array(); - 94 : - 95 : /** - 96 : * Constructor - 97 : * - 98 : * Fills event properties - 99 : * - 100 : * @param scalar $name the event name - 101 : * @param scalar $value the event value - 102 : * @param array $filters the corresponding filters - 103 : * - 104 : * @return void - 105 : */ - 106 : public function __construct($name, $value, Array $filters) - 107 : { - 108 58 : if (!is_scalar($name)) { - 109 1 : throw new InvalidArgumentException( - 110 1 : 'Expected $name to be a scalar,' . gettype($name) . ' given' - 111 1 : ); - 112 : } - 113 : - 114 58 : if (!is_scalar($value)) { - 115 1 : throw new InvalidArgumentException(' - 116 1 : Expected $value to be a scalar,' . gettype($value) . ' given' - 117 1 : ); - 118 : } - 119 : - 120 58 : $this->name = $name; - 121 58 : $this->value = $value; - 122 : - 123 58 : foreach ($filters as $filter) { - 124 58 : if (!$filter instanceof IDS_Filter) { - 125 1 : throw new InvalidArgumentException( - 126 : 'Filter must be derived from IDS_Filter' - 127 1 : ); - 128 : } - 129 : - 130 58 : $this->filters[] = $filter; - 131 58 : } - 132 58 : } - 133 : - 134 : /** - 135 : * Returns event name - 136 : * - 137 : * The name of the event usually is the key of the variable that was - 138 : * considered to be malicious - 139 : * - 140 : * @return scalar - 141 : */ - 142 : public function getName() - 143 : { - 144 53 : return $this->name; - 145 : } - 146 : - 147 : /** - 148 : * Returns event value - 149 : * - 150 : * @return scalar - 151 : */ - 152 : public function getValue() - 153 : { - 154 2 : return $this->value; - 155 : } - 156 : - 157 : /** - 158 : * Returns calculated impact - 159 : * - 160 : * @return integer - 161 : */ - 162 : public function getImpact() - 163 : { - 164 35 : if (!$this->impact) { - 165 35 : $this->impact = 0; - 166 35 : foreach ($this->filters as $filter) { - 167 35 : $this->impact += $filter->getImpact(); - 168 35 : } - 169 35 : } - 170 : - 171 35 : return $this->impact; - 172 : } - 173 : - 174 : /** - 175 : * Returns affected tags - 176 : * - 177 : * @return array - 178 : */ - 179 : public function getTags() - 180 : { - 181 4 : $filters = $this->getFilters(); - 182 : - 183 4 : foreach ($filters as $filter) { - 184 4 : $this->tags = array_merge($this->tags, - 185 4 : $filter->getTags()); - 186 4 : } - 187 : - 188 4 : $this->tags = array_values(array_unique($this->tags)); - 189 : - 190 4 : return $this->tags; - 191 : } - 192 : - 193 : /** - 194 : * Returns list of filter objects - 195 : * - 196 : * @return array - 197 : */ - 198 : public function getFilters() - 199 : { - 200 9 : return $this->filters; - 201 : } - 202 : - 203 : /** - 204 : * Returns number of filters - 205 : * - 206 : * To implement interface Countable this returns the number of filters - 207 : * appended. - 208 : * - 209 : * @return integer - 210 : */ - 211 : public function count() - 212 : { - 213 2 : return count($this->getFilters()); - 214 : } - 215 : - 216 : /** - 217 : * IteratorAggregate iterator getter - 218 : * - 219 : * Returns an iterator to iterate over the appended filters. - 220 : * - 221 : * @return Iterator|IteratorAggregate - 222 : */ - 223 : public function getIterator() - 224 : { - 225 3 : return new ArrayObject($this->getFilters()); - 226 : } - 227 : } - 228 : - 229 : /* - 230 : * Local variables: - 231 : * tab-width: 4 - 232 : * c-basic-offset: 4 - 233 : * End: - 234 : */ - -- |
-
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Storage.php | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -
-
|
- 84.96% | -113 / 133 | -|||
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -
-
|
- 100.00% | -18 / 18 | -|||
| - | ||||||||||||
| IDS_Filter | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -
-
|
- 100.00% | -18 / 18 | -|||
| public function __construct($id, $rule, $description, array $tags, $impact) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -6 / 6 | -||||||
| public function match($string) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -||||||
| public function getDescription() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function getTags() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function getRule() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function getImpact() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function getId() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
-- 1 : <?php - 2 : - 3 : /** - 4 : * PHPIDS - 5 : * - 6 : * Requirements: PHP5, SimpleXML - 7 : * - 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) - 9 : * - 10 : * PHPIDS is free software; you can redistribute it and/or modify - 11 : * it under the terms of the GNU Lesser General Public License as published by - 12 : * the Free Software Foundation, version 3 of the License, or - 13 : * (at your option) any later version. - 14 : * - 15 : * PHPIDS is distributed in the hope that it will be useful, - 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of - 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - 18 : * GNU Lesser General Public License for more details. - 19 : * - 20 : * You should have received a copy of the GNU Lesser General Public License - 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. - 22 : * - 23 : * PHP version 5.1.6+ - 24 : * - 25 : * @category Security - 26 : * @package PHPIDS - 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 28 : * @author Christian Matthies <ch0012@gmail.com> - 29 : * @author Lars Strojny <lars@strojny.net> - 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 31 : * @link http://php-ids.org/ - 32 : */ - 33 : - 34 : /** - 35 : * PHPIDS Filter object - 36 : * - 37 : * Each object of this class serves as a container for a specific filter. The - 38 : * object provides methods to get information about this particular filter and - 39 : * also to match an arbitrary string against it. - 40 : * - 41 : * @category Security - 42 : * @package PHPIDS - 43 : * @author Christian Matthies <ch0012@gmail.com> - 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 45 : * @author Lars Strojny <lars@strojny.net> - 46 : * @copyright 2007 The PHPIDS Group - 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 48 : * @version Release: $Id:Filter.php 517 2007-09-15 15:04:13Z mario $ - 49 : * @link http://php-ids.org/ - 50 : * @since Version 0.4 - 51 : */ - 52 : class IDS_Filter - 53 : { - 54 : - 55 : /** - 56 : * Filter rule - 57 : * - 58 : * @var string - 59 : */ - 60 : protected $rule; - 61 : - 62 : /** - 63 : * List of tags of the filter - 64 : * - 65 : * @var array - 66 : */ - 67 : protected $tags = array(); - 68 : - 69 : /** - 70 : * Filter impact level - 71 : * - 72 : * @var integer - 73 : */ - 74 : protected $impact = 0; - 75 : - 76 : /** - 77 : * Filter description - 78 : * - 79 : * @var string - 80 : */ - 81 : protected $description = null; - 82 : - 83 : /** - 84 : * Constructor - 85 : * - 86 : * @param mixed $rule filter rule - 87 : * @param string $description filter description - 88 : * @param array $tags list of tags - 89 : * @param integer $impact filter impact level - 90 : * - 91 : * @return void - 92 : */ - 93 : public function __construct($id, $rule, $description, array $tags, $impact) - 94 : { - 95 69 : $this->id = $id; - 96 69 : $this->rule = $rule; - 97 69 : $this->tags = $tags; - 98 69 : $this->impact = $impact; - 99 69 : $this->description = $description; - 100 69 : } - 101 : - 102 : /** - 103 : * Matches a string against current filter - 104 : * - 105 : * Matches given string against the filter rule the specific object of this - 106 : * class represents - 107 : * - 108 : * @param string $string the string to match - 109 : * - 110 : * @throws InvalidArgumentException if argument is no string - 111 : * @return boolean - 112 : */ - 113 : public function match($string) - 114 : { - 115 38 : if (!is_string($string)) { - 116 1 : throw new InvalidArgumentException(' - 117 1 : Invalid argument. Expected a string, received ' . gettype($string) - 118 1 : ); - 119 : } - 120 : - 121 37 : return (bool) preg_match( - 122 37 : '/' . $this->getRule() . '/ms', strtolower($string) - 123 37 : ); - 124 : } - 125 : - 126 : /** - 127 : * Returns filter description - 128 : * - 129 : * @return string - 130 : */ - 131 : public function getDescription() - 132 : { - 133 2 : return $this->description; - 134 : } - 135 : - 136 : /** - 137 : * Return list of affected tags - 138 : * - 139 : * Each filter rule is concerned with a certain kind of attack vectors. - 140 : * This method returns those affected kinds. - 141 : * - 142 : * @return array - 143 : */ - 144 : public function getTags() - 145 : { - 146 6 : return $this->tags; - 147 : } - 148 : - 149 : /** - 150 : * Returns filter rule - 151 : * - 152 : * @return string - 153 : */ - 154 : public function getRule() - 155 : { - 156 38 : return $this->rule; - 157 : } - 158 : - 159 : /** - 160 : * Get filter impact level - 161 : * - 162 : * @return integer - 163 : */ - 164 : public function getImpact() - 165 : { - 166 36 : return $this->impact; - 167 : } - 168 : - 169 : /** - 170 : * Get filter ID - 171 : * - 172 : * @return integer - 173 : */ - 174 : public function getId() - 175 : { - 176 1 : return $this->id; - 177 : } - 178 : } - 179 : - 180 : /* - 181 : * Local variables: - 182 : * tab-width: 4 - 183 : * c-basic-offset: 4 - 184 : * End: - 185 : */ - -- |
-
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -
-
|
- 84.96% | -113 / 133 | -|||
| - | ||||||||||||
| IDS_Filter_Storage | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -
-
|
- 84.96% | -113 / 133 | -|||
| public function __construct(IDS_Init $init) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 86.36% | -19 / 22 | -||||||
| public function setFilterSet($filterSet) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -4 / 4 | -||||||
| public function getFilterSet() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function addFilter(IDS_Filter $filter) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -2 / 2 | -||||||
| private function _isCached() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -||||||
| public function getFilterFromXML() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 89.80% | -44 / 49 | -||||||
| public function getFilterFromJson() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 75.00% | -36 / 48 | -||||||
-- 1 : <?php - 2 : - 3 : /** - 4 : * PHPIDS - 5 : * - 6 : * Requirements: PHP5, SimpleXML - 7 : * - 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) - 9 : * - 10 : * PHPIDS is free software; you can redistribute it and/or modify - 11 : * it under the terms of the GNU Lesser General Public License as published by - 12 : * the Free Software Foundation, version 3 of the License, or - 13 : * (at your option) any later version. - 14 : * - 15 : * PHPIDS is distributed in the hope that it will be useful, - 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of - 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - 18 : * GNU Lesser General Public License for more details. - 19 : * - 20 : * You should have received a copy of the GNU Lesser General Public License - 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. - 22 : * - 23 : * PHP version 5.1.6+ - 24 : * - 25 : * @category Security - 26 : * @package PHPIDS - 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 28 : * @author Christian Matthies <ch0012@gmail.com> - 29 : * @author Lars Strojny <lars@strojny.net> - 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 31 : * @link http://php-ids.org/ - 32 : */ - 33 : - 34 : /** - 35 : * Filter Storage - 36 : * - 37 : * This class provides various default functions for gathering filter patterns - 38 : * to be used later on by the detection mechanism. You might extend this class - 39 : * to your requirements. - 40 : * - 41 : * @category Security - 42 : * @package PHPIDS - 43 : * @author Christian Matthies <ch0012@gmail.com> - 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 45 : * @author Lars Strojny <lars@strojny.net> - 46 : * @copyright 2007 The PHPIDS Group - 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 48 : * @version Release: $Id:Storage.php 517 2007-09-15 15:04:13Z mario $ - 49 : * @link http://php-ids.org/ - 50 : */ - 51 : class IDS_Filter_Storage - 52 : { - 53 : - 54 : /** - 55 : * Filter source file - 56 : * - 57 : * @var string - 58 : */ - 59 : protected $source = null; - 60 : - 61 : /** - 62 : * Holds caching settings - 63 : * - 64 : * @var array - 65 : */ - 66 : protected $cacheSettings = null; - 67 : - 68 : /** - 69 : * Cache container - 70 : * - 71 : * @var object IDS_Caching wrapper - 72 : */ - 73 : protected $cache = null; - 74 : - 75 : /** - 76 : * Filter container - 77 : * - 78 : * @var array - 79 : */ - 80 : protected $filterSet = array(); - 81 : - 82 : /** - 83 : * Constructor - 84 : * - 85 : * Loads filters based on provided IDS_Init settings. - 86 : * - 87 : * @param object $init IDS_Init instance - 88 : * - 89 : * @throws Exception if unsupported filter type is given - 90 : * @return void - 91 : */ - 92 : public final function __construct(IDS_Init $init) - 93 : { - 94 42 : if ($init->config) { - 95 : - 96 42 : $caching = isset($init->config['Caching']['caching']) ? - 97 42 : $init->config['Caching']['caching'] : 'none'; - 98 : - 99 42 : $type = $init->config['General']['filter_type']; - 100 42 : $this->source = $init->getBasePath() - 101 42 : . $init->config['General']['filter_path']; - 102 : - 103 42 : if ($caching && $caching != 'none') { - 104 42 : $this->cacheSettings = $init->config['Caching']; - 105 42 : include_once 'IDS/Caching/Factory.php'; - 106 42 : $this->cache = IDS_Caching::factory($init, 'storage'); - 107 42 : } - 108 : - 109 : switch ($type) { - 110 42 : case 'xml' : - 111 41 : $this->getFilterFromXML(); - 112 41 : break; - 113 1 : case 'json' : - 114 1 : $this->getFilterFromJson(); - 115 1 : break; - 116 0 : default : - 117 0 : throw new Exception('Unsupported filter type.'); - 118 0 : } - 119 42 : } - 120 42 : } - 121 : - 122 : /** - 123 : * Sets the filter array - 124 : * - 125 : * @param array $filterSet array containing multiple IDS_Filter instances - 126 : * - 127 : * @return object $this - 128 : */ - 129 : public final function setFilterSet($filterSet) - 130 : { - 131 1 : foreach ($filterSet as $filter) { - 132 1 : $this->addFilter($filter); - 133 1 : } - 134 : - 135 1 : return $this; - 136 : } - 137 : - 138 : /** - 139 : * Returns registered filters - 140 : * - 141 : * @return array - 142 : */ - 143 : public final function getFilterSet() - 144 : { - 145 35 : return $this->filterSet; - 146 : } - 147 : - 148 : /** - 149 : * Adds a filter - 150 : * - 151 : * @param object $filter IDS_Filter instance - 152 : * - 153 : * @return object $this - 154 : */ - 155 : public final function addFilter(IDS_Filter $filter) - 156 : { - 157 42 : $this->filterSet[] = $filter; - 158 42 : return $this; - 159 : } - 160 : - 161 : /** - 162 : * Checks if any filters are cached - 163 : * - 164 : * @return mixed $filters cached filters or false - 165 : */ - 166 : private function _isCached() - 167 : { - 168 42 : $filters = false; - 169 : - 170 42 : if ($this->cacheSettings) { - 171 : - 172 42 : if ($this->cache) { - 173 42 : $filters = $this->cache->getCache(); - 174 42 : } - 175 42 : } - 176 : - 177 42 : return $filters; - 178 : } - 179 : - 180 : /** - 181 : * Loads filters from XML using SimpleXML - 182 : * - 183 : * This function parses the provided source file and stores the result. - 184 : * If caching mode is enabled the result will be cached to increase - 185 : * the performance. - 186 : * - 187 : * @throws Exception if problems with fetching the XML data occur - 188 : * @return object $this - 189 : */ - 190 : public function getFilterFromXML() - 191 : { - 192 : - 193 41 : if (extension_loaded('SimpleXML')) { - 194 : - 195 : /* - 196 : * See if filters are already available in the cache - 197 : */ - 198 41 : $filters = $this->_isCached(); - 199 : - 200 : /* - 201 : * If they aren't, parse the source file - 202 : */ - 203 41 : if (!$filters) { - 204 1 : if (file_exists($this->source)) { - 205 1 : if (LIBXML_VERSION >= 20621) { - 206 1 : $filters = simplexml_load_file($this->source, - 207 1 : null, - 208 1 : LIBXML_COMPACT); - 209 1 : } else { - 210 0 : $filters = simplexml_load_file($this->source); - 211 : } - 212 1 : } - 213 1 : } - 214 : - 215 : /* - 216 : * In case we still don't have any filters loaded and exception - 217 : * will be thrown - 218 : */ - 219 41 : if (empty($filters)) { - 220 0 : throw new Exception( - 221 : 'XML data could not be loaded.' . - 222 : ' Make sure you specified the correct path.' - 223 0 : ); - 224 : } - 225 : - 226 : /* - 227 : * Now the storage will be filled with IDS_Filter objects - 228 : */ - 229 41 : $data = array(); - 230 41 : $nocache = $filters instanceof SimpleXMLElement; - 231 41 : $filters = $nocache ? $filters->filter : $filters; - 232 : - 233 41 : include_once 'IDS/Filter.php'; - 234 : - 235 41 : foreach ($filters as $filter) { - 236 : - 237 41 : $id = $nocache ? (string) $filter->id : - 238 41 : $filter['id']; - 239 41 : $rule = $nocache ? (string) $filter->rule : - 240 41 : $filter['rule']; - 241 41 : $impact = $nocache ? (string) $filter->impact : - 242 41 : $filter['impact']; - 243 41 : $tags = $nocache ? array_values((array) $filter->tags) : - 244 41 : $filter['tags']; - 245 41 : $description = $nocache ? (string) $filter->description : - 246 41 : $filter['description']; - 247 : - 248 41 : $this->addFilter(new IDS_Filter($id, - 249 41 : $rule, - 250 41 : $description, - 251 41 : (array) $tags[0], - 252 41 : (int) $impact)); - 253 : - 254 41 : $data[] = array( - 255 41 : 'id' => $id, - 256 41 : 'rule' => $rule, - 257 41 : 'impact' => $impact, - 258 41 : 'tags' => $tags, - 259 : 'description' => $description - 260 41 : ); - 261 41 : } - 262 : - 263 : /* - 264 : * If caching is enabled, the fetched data will be cached - 265 : */ - 266 41 : if ($this->cacheSettings) { - 267 : - 268 41 : $this->cache->setCache($data); - 269 41 : } - 270 : - 271 41 : } else { - 272 0 : throw new Exception( - 273 : 'SimpleXML not loaded.' - 274 0 : ); - 275 : } - 276 : - 277 41 : return $this; - 278 : } - 279 : - 280 : /** - 281 : * Loads filters from Json file using ext/Json - 282 : * - 283 : * This function parses the provided source file and stores the result. - 284 : * If caching mode is enabled the result will be cached to increase - 285 : * the performance. - 286 : * - 287 : * @throws Exception if problems with fetching the JSON data occur - 288 : * @return object $this - 289 : */ - 290 : public function getFilterFromJson() - 291 : { - 292 : - 293 1 : if (extension_loaded('Json')) { - 294 : - 295 : /* - 296 : * See if filters are already available in the cache - 297 : */ - 298 1 : $filters = $this->_isCached(); - 299 : - 300 : /* - 301 : * If they aren't, parse the source file - 302 : */ - 303 1 : if (!$filters) { - 304 0 : if (file_exists($this->source)) { - 305 0 : @set_magic_quotes_runtime(0); - 306 0 : $content = file_get_contents($this->source); - 307 0 : $filters = json_decode($content); - 308 0 : } else { - 309 0 : throw new Exception( - 310 : 'JSON data could not be loaded.' . - 311 : ' Make sure you specified the correct path.' - 312 0 : ); - 313 : } - 314 0 : } - 315 : - 316 1 : if (!$filters) { - 317 0 : throw new Exception( - 318 : 'JSON data could not be loaded.' . - 319 : ' Make sure you specified the correct path.' - 320 0 : ); - 321 : } - 322 : - 323 : /* - 324 : * Now the storage will be filled with IDS_Filter objects - 325 : */ - 326 1 : $data = array(); - 327 1 : $nocache = !is_array($filters); - 328 1 : $filters = $nocache ? $filters->filters->filter : $filters; - 329 : - 330 1 : include_once 'IDS/Filter.php'; - 331 : - 332 1 : foreach ($filters as $filter) { - 333 : - 334 1 : $id = $nocache ? (string) $filter->id : - 335 1 : $filter['id']; - 336 1 : $rule = $nocache ? (string) $filter->rule : - 337 1 : $filter['rule']; - 338 1 : $impact = $nocache ? (string) $filter->impact : - 339 1 : $filter['impact']; - 340 1 : $tags = $nocache ? array_values((array) $filter->tags) : - 341 1 : $filter['tags']; - 342 1 : $description = $nocache ? (string) $filter->description : - 343 1 : $filter['description']; - 344 : - 345 1 : $this->addFilter(new IDS_Filter($id, - 346 1 : $rule, - 347 1 : $description, - 348 1 : (array) $tags[0], - 349 1 : (int) $impact)); - 350 : - 351 1 : $data[] = array( - 352 1 : 'id' => $id, - 353 1 : 'rule' => $rule, - 354 1 : 'impact' => $impact, - 355 1 : 'tags' => $tags, - 356 : 'description' => $description - 357 1 : ); - 358 1 : } - 359 : - 360 : /* - 361 : * If caching is enabled, the fetched data will be cached - 362 : */ - 363 1 : if ($this->cacheSettings) { - 364 1 : $this->cache->setCache($data); - 365 1 : } - 366 : - 367 1 : } else { - 368 0 : throw new Exception( - 369 : 'ext/json not loaded.' - 370 0 : ); - 371 : } - 372 : - 373 1 : return $this; - 374 : } - 375 : } - 376 : - 377 : /* - 378 : * Local variables: - 379 : * tab-width: 4 - 380 : * c-basic-offset: 4 - 381 : * End: - 382 : */ - -- |
-
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -9 / 9 | -
-
|
- 100.00% | -42 / 42 | -|||
| - | ||||||||||||
| IDS_Init | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -9 / 9 | -
-
|
- 100.00% | -42 / 42 | -|||
| private function __construct($configPath = NULL) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -||||||
| public function __clone() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public static function init($configPath = NULL) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -4 / 4 | -||||||
| public function setConfigPath($path) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -||||||
| public function getConfigPath() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function getBasePath() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -5 / 5 | -||||||
| public function setConfig(array $config, $overwrite = false) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -5 / 5 | -||||||
| protected function _mergeConfig($current, $successor) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -11 / 11 | -||||||
| public function getConfig() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
-- 1 : <?php - 2 : - 3 : /** - 4 : * PHPIDS - 5 : * - 6 : * Requirements: PHP5, SimpleXML - 7 : * - 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) - 9 : * - 10 : * PHPIDS is free software; you can redistribute it and/or modify - 11 : * it under the terms of the GNU Lesser General Public License as published by - 12 : * the Free Software Foundation, version 3 of the License, or - 13 : * (at your option) any later version. - 14 : * - 15 : * PHPIDS is distributed in the hope that it will be useful, - 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of - 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - 18 : * GNU Lesser General Public License for more details. - 19 : * - 20 : * You should have received a copy of the GNU Lesser General Public License - 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. - 22 : * - 23 : * PHP version 5.1.6+ - 24 : * - 25 : * @category Security - 26 : * @package PHPIDS - 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 28 : * @author Christian Matthies <ch0012@gmail.com> - 29 : * @author Lars Strojny <lars@strojny.net> - 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 31 : * @link http://php-ids.org/ - 32 : */ - 33 : - 34 : /** - 35 : * Framework initiation - 36 : * - 37 : * This class is used for the purpose to initiate the framework and inhabits - 38 : * functionality to parse the needed configuration file. - 39 : * - 40 : * @category Security - 41 : * @package PHPIDS - 42 : * @author Christian Matthies <ch0012@gmail.com> - 43 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 44 : * @author Lars Strojny <lars@strojny.net> - 45 : * @copyright 2007 The PHPIDS Groupup - 46 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 47 : * @version Release: $Id:Init.php 517 2007-09-15 15:04:13Z mario $ - 48 : * @link http://php-ids.org/ - 49 : * @since Version 0.4 - 50 : */ - 51 : class IDS_Init - 52 : { - 53 : - 54 : /** - 55 : * Holds config settings - 56 : * - 57 : * @var array - 58 : */ - 59 : public $config = array(); - 60 : - 61 : /** - 62 : * Instance of this class depending on the supplied config file - 63 : * - 64 : * @var array - 65 : * @static - 66 : */ - 67 : private static $instances = array(); - 68 : - 69 : /** - 70 : * Path to the config file - 71 : * - 72 : * @var string - 73 : */ - 74 : private $configPath = null; - 75 : - 76 : /** - 77 : * Constructor - 78 : * - 79 : * Includes needed classes and parses the configuration file - 80 : * - 81 : * @param string $configPath the path to the config file - 82 : * - 83 : * @return object $this - 84 : */ - 85 : private function __construct($configPath = null) - 86 : { - 87 3 : include_once 'IDS/Monitor.php'; - 88 3 : include_once 'IDS/Filter/Storage.php'; - 89 : - 90 3 : if ($configPath) { - 91 2 : $this->setConfigPath($configPath); - 92 1 : $this->config = parse_ini_file($this->configPath, true); - 93 1 : } - 94 2 : } - 95 : - 96 : /** - 97 : * Permitting to clone this object - 98 : * - 99 : * For the sake of correctness of a singleton pattern, this is necessary - 100 : * - 101 : * @return void - 102 : */ - 103 : public final function __clone() - 104 : { - 105 1 : } - 106 : - 107 : /** - 108 : * Returns an instance of this class. Also a PHP version check - 109 : * is being performed to avoid compatibility problems with PHP < 5.1.6 - 110 : * - 111 : * @param string $configPath the path to the config file - 112 : * - 113 : * @return object - 114 : */ - 115 : public static function init($configPath = null) - 116 : { - 117 67 : if (!isset(self::$instances[$configPath])) { - 118 3 : self::$instances[$configPath] = new IDS_Init($configPath); - 119 2 : } - 120 : - 121 67 : return self::$instances[$configPath]; - 122 : } - 123 : - 124 : /** - 125 : * Sets the path to the configuration file - 126 : * - 127 : * @param string $path the path to the config - 128 : * - 129 : * @throws Exception if file not found - 130 : * @return void - 131 : */ - 132 : public function setConfigPath($path) - 133 : { - 134 2 : if (file_exists($path)) { - 135 1 : $this->configPath = $path; - 136 1 : } else { - 137 1 : throw new Exception( - 138 : 'Configuration file could not be found at ' . - 139 1 : htmlspecialchars($path, ENT_QUOTES, 'UTF-8') - 140 1 : ); - 141 : } - 142 1 : } - 143 : - 144 : /** - 145 : * Returns path to configuration file - 146 : * - 147 : * @return string the config path - 148 : */ - 149 : public function getConfigPath() - 150 : { - 151 1 : return $this->configPath; - 152 : } - 153 : - 154 : /** - 155 : * This method checks if a base path is given and usage is set to true. - 156 : * If all that tests succeed the base path will be returned as a string - - 157 : * else null will be returned. - 158 : * - 159 : * @return string the base path or null - 160 : */ - 161 : public function getBasePath() { - 162 : - 163 42 : return ((isset($this->config['General']['base_path']) - 164 42 : && $this->config['General']['base_path'] - 165 42 : && isset($this->config['General']['use_base_path']) - 166 42 : && $this->config['General']['use_base_path']) - 167 42 : ? $this->config['General']['base_path'] : null); - 168 : } - 169 : - 170 : /** - 171 : * Merges new settings into the exsiting ones or overwrites them - 172 : * - 173 : * @param array $config the config array - 174 : * @param boolean $overwrite config overwrite flag - 175 : * - 176 : * @return void - 177 : */ - 178 : public function setConfig(array $config, $overwrite = false) - 179 : { - 180 2 : if ($overwrite) { - 181 2 : $this->config = $this->_mergeConfig($this->config, $config); - 182 2 : } else { - 183 1 : $this->config = $this->_mergeConfig($config, $this->config); - 184 : } - 185 2 : } - 186 : - 187 : /** - 188 : * Merge config hashes recursivly - 189 : * - 190 : * The algorithm merges configuration arrays recursively. If an element is - 191 : * an array in both, the values will be appended. If it is a scalar in both, - 192 : * the value will be replaced. - 193 : * - 194 : * @param array $current The legacy hash - 195 : * @param array $successor The hash which values count more when in doubt - 196 : * @return array Merged hash - 197 : */ - 198 : protected function _mergeConfig($current, $successor) - 199 : { - 200 2 : if (is_array($current) and is_array($successor)) { - 201 2 : foreach ($successor as $key => $value) { - 202 2 : if (isset($current[$key]) - 203 2 : and is_array($value) - 204 2 : and is_array($current[$key])) { - 205 : - 206 2 : $current[$key] = $this->_mergeConfig($current[$key], $value); - 207 2 : } else { - 208 2 : $current[$key] = $successor[$key]; - 209 : } - 210 2 : } - 211 2 : } - 212 2 : return $current; - 213 : } - 214 : - 215 : /** - 216 : * Returns the config array - 217 : * - 218 : * @return array the config array - 219 : */ - 220 : public function getConfig() - 221 : { - 222 1 : return $this->config; - 223 : } - 224 : } - 225 : - 226 : /* - 227 : * Local variables: - 228 : * tab-width: 4 - 229 : * c-basic-offset: 4 - 230 : * End: - 231 : */ - -- |
-
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 84.21% | -16 / 19 | -
-
|
- 87.11% | -169 / 194 | -|||
| - | ||||||||||||
| IDS_Monitor | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 84.21% | -16 / 19 | -
-
|
- 87.11% | -169 / 194 | -|||
| public function __construct(array $request, IDS_Init $init, array $tags = NULL) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 79.41% | -27 / 34 | -||||||
| public function run() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -6 / 6 | -||||||
| private function _iterate($key, $value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -17 / 17 | -||||||
| private function _detect($key, $value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -37 / 37 | -||||||
| private function _purifyValues($key, $value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 70.37% | -19 / 27 | -||||||
| private function _diff($original, $purified, $redux) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -26 / 26 | -||||||
| private function _jsonDecodeValues($key, $value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 72.73% | -8 / 11 | -||||||
| private function _jsonConcatContents($key, $value) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -2 / 2 | -||||||
| private function _match($key, $value, $filter) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -||||||
| public function setExceptions($exceptions) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -5 / 5 | -||||||
| public function getExceptions() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function setHtml($html) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -5 / 5 | -||||||
| public function addHtml($value) | -
-
|
- 0.00% | -0 / 1 | -
-
|
- 0.00% | -0 / 2 | -||||||
| public function getHtml() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function setJson($json) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 60.00% | -3 / 5 | -||||||
| public function addJson($value) | -
-
|
- 0.00% | -0 / 1 | -
-
|
- 0.00% | -0 / 2 | -||||||
| public function getJson() | -
-
|
- 0.00% | -0 / 1 | -
-
|
- 0.00% | -0 / 1 | -||||||
| public function getStorage() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function getReport() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -4 / 4 | -||||||
-- 1 : <?php - 2 : - 3 : /** - 4 : * PHPIDS - 5 : * - 6 : * Requirements: PHP5, SimpleXML - 7 : * - 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) - 9 : * - 10 : * PHPIDS is free software; you can redistribute it and/or modify - 11 : * it under the terms of the GNU Lesser General Public License as published by - 12 : * the Free Software Foundation, version 3 of the License, or - 13 : * (at your option) any later version. - 14 : * - 15 : * PHPIDS is distributed in the hope that it will be useful, - 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of - 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - 18 : * GNU Lesser General Public License for more details. - 19 : * - 20 : * You should have received a copy of the GNU Lesser General Public License - 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. - 22 : * - 23 : * PHP version 5.1.6+ - 24 : * - 25 : * @category Security - 26 : * @package PHPIDS - 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 28 : * @author Christian Matthies <ch0012@gmail.com> - 29 : * @author Lars Strojny <lars@strojny.net> - 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 31 : * @link http://php-ids.org/ - 32 : */ - 33 : - 34 : /** - 35 : * Monitoring engine - 36 : * - 37 : * This class represents the core of the frameworks attack detection mechanism - 38 : * and provides functions to scan incoming data for malicious appearing script - 39 : * fragments. - 40 : * - 41 : * @category Security - 42 : * @package PHPIDS - 43 : * @author Christian Matthies <ch0012@gmail.com> - 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 45 : * @author Lars Strojny <lars@strojny.net> - 46 : * @copyright 2007 The PHPIDS Group - 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 48 : * @version Release: $Id:Monitor.php 949 2008-06-28 01:26:03Z christ1an $ - 49 : * @link http://php-ids.org/ - 50 : */ - 51 : class IDS_Monitor - 52 : { - 53 : - 54 : /** - 55 : * Tags to define what to search for - 56 : * - 57 : * Accepted values are xss, csrf, sqli, dt, id, lfi, rfe, spam, dos - 58 : * - 59 : * @var array - 60 : */ - 61 : private $tags = null; - 62 : - 63 : /** - 64 : * Request array - 65 : * - 66 : * Array containing raw data to search in - 67 : * - 68 : * @var array - 69 : */ - 70 : private $request = null; - 71 : - 72 : /** - 73 : * Container for filter rules - 74 : * - 75 : * Holds an instance of IDS_Filter_Storage - 76 : * - 77 : * @var object - 78 : */ - 79 : private $storage = null; - 80 : - 81 : /** - 82 : * Results - 83 : * - 84 : * Holds an instance of IDS_Report which itself provides an API to - 85 : * access the detected results - 86 : * - 87 : * @var object - 88 : */ - 89 : private $report = null; - 90 : - 91 : /** - 92 : * Scan keys switch - 93 : * - 94 : * Enabling this property will cause the monitor to scan both the key and - 95 : * the value of variables - 96 : * - 97 : * @var boolean - 98 : */ - 99 : public $scanKeys = false; - 100 : - 101 : /** - 102 : * Exception container - 103 : * - 104 : * Using this array it is possible to define variables that must not be - 105 : * scanned. Per default, utmz google analytics parameters are permitted. - 106 : * - 107 : * @var array - 108 : */ - 109 : private $exceptions = array(); - 110 : - 111 : /** - 112 : * Html container - 113 : * - 114 : * Using this array it is possible to define variables that legally - 115 : * contain html and have to be prepared before hitting the rules to - 116 : * avoid too many false alerts - 117 : * - 118 : * @var array - 119 : */ - 120 : private $html = array(); - 121 : - 122 : /** - 123 : * JSON container - 124 : * - 125 : * Using this array it is possible to define variables that contain - 126 : * JSON data - and should be treated as such - 127 : * - 128 : * @var array - 129 : */ - 130 : private $json = array(); - 131 : - 132 : /** - 133 : * Holds HTMLPurifier object - 134 : * - 135 : * @var object - 136 : */ - 137 : private $htmlpurifier = NULL; - 138 : - 139 : /** - 140 : * Path to HTMLPurifier source - 141 : * - 142 : * This path might be changed in case one wishes to make use of a - 143 : * different HTMLPurifier source file e.g. if already used in the - 144 : * application PHPIDS is protecting - 145 : * - 146 : * @var string - 147 : */ - 148 : private $pathToHTMLPurifier = ''; - 149 : - 150 : /** - 151 : * HTMLPurifier cache directory - 152 : * - 153 : * @var string - 154 : */ - 155 : private $HTMLPurifierCache = ''; - 156 : - 157 : /** - 158 : * This property holds the tmp JSON string from the - 159 : * _jsonDecodeValues() callback - 160 : * - 161 : * @var string - 162 : */ - 163 : private $tmpJsonString = ''; - 164 : - 165 : - 166 : /** - 167 : * Constructor - 168 : * - 169 : * @param array $request array to scan - 170 : * @param object $init instance of IDS_Init - 171 : * @param array $tags list of tags to which filters should be applied - 172 : * - 173 : * @return void - 174 : */ - 175 : public function __construct(array $request, IDS_Init $init, array $tags = null) - 176 : { - 177 41 : $version = isset($init->config['General']['min_php_version']) - 178 41 : ? $init->config['General']['min_php_version'] : '5.1.6'; - 179 : - 180 41 : if (version_compare(PHP_VERSION, $version, '<')) { - 181 0 : throw new Exception( - 182 0 : 'PHP version has to be equal or higher than ' . $version . ' or - 183 : PHP version couldn\'t be determined' - 184 0 : ); - 185 : } - 186 : - 187 : - 188 41 : if (!empty($request)) { - 189 41 : $this->storage = new IDS_Filter_Storage($init); - 190 41 : $this->request = $request; - 191 41 : $this->tags = $tags; - 192 : - 193 41 : $this->scanKeys = $init->config['General']['scan_keys']; - 194 : - 195 41 : $this->exceptions = isset($init->config['General']['exceptions']) - 196 41 : ? $init->config['General']['exceptions'] : false; - 197 : - 198 41 : $this->html = isset($init->config['General']['html']) - 199 41 : ? $init->config['General']['html'] : false; - 200 : - 201 41 : $this->json = isset($init->config['General']['json']) - 202 41 : ? $init->config['General']['json'] : false; - 203 : - 204 41 : if(isset($init->config['General']['HTML_Purifier_Path']) - 205 41 : && isset($init->config['General']['HTML_Purifier_Cache'])) { - 206 41 : $this->pathToHTMLPurifier = - 207 41 : $init->config['General']['HTML_Purifier_Path']; - 208 41 : $this->HTMLPurifierCache = - 209 41 : $init->config['General']['HTML_Purifier_Cache']; - 210 41 : } - 211 : - 212 41 : } - 213 : - 214 41 : if (!is_writeable($init->getBasePath() - 215 41 : . $init->config['General']['tmp_path'])) { - 216 0 : throw new Exception( - 217 : 'Please make sure the ' . - 218 0 : htmlspecialchars($init->getBasePath() . - 219 0 : $init->config['General']['tmp_path'], ENT_QUOTES, 'UTF-8') . - 220 : ' folder is writable' - 221 0 : ); - 222 : } - 223 : - 224 41 : include_once 'IDS/Report.php'; - 225 41 : $this->report = new IDS_Report; - 226 41 : } - 227 : - 228 : /** - 229 : * Starts the scan mechanism - 230 : * - 231 : * @return object IDS_Report - 232 : */ - 233 : public function run() - 234 : { - 235 36 : if (!empty($this->request)) { - 236 36 : foreach ($this->request as $key => $value) { - 237 36 : $this->_iterate($key, $value); - 238 36 : } - 239 36 : } - 240 : - 241 36 : return $this->getReport(); - 242 : } - 243 : - 244 : /** - 245 : * Iterates through given data and delegates it to IDS_Monitor::_detect() in - 246 : * order to check for malicious appearing fragments - 247 : * - 248 : * @param mixed $key the former array key - 249 : * @param mixed $value the former array value - 250 : * - 251 : * @return void - 252 : */ - 253 : private function _iterate($key, $value) - 254 : { - 255 : - 256 36 : if (!is_array($value)) { - 257 36 : if (is_string($value)) { - 258 : - 259 36 : if ($filter = $this->_detect($key, $value)) { - 260 33 : include_once 'IDS/Event.php'; - 261 33 : $this->report->addEvent( - 262 33 : new IDS_Event( - 263 33 : $key, - 264 33 : $value, - 265 : $filter - 266 33 : ) - 267 33 : ); - 268 33 : } - 269 36 : } - 270 36 : } else { - 271 2 : foreach ($value as $subKey => $subValue) { - 272 2 : $this->_iterate($key . '.' . $subKey, $subValue); - 273 2 : } - 274 : } - 275 36 : } - 276 : - 277 : /** - 278 : * Checks whether given value matches any of the supplied filter patterns - 279 : * - 280 : * @param mixed $key the key of the value to scan - 281 : * @param mixed $value the value to scan - 282 : * - 283 : * @return bool|array false or array of filter(s) that matched the value - 284 : */ - 285 : private function _detect($key, $value) - 286 : { - 287 : - 288 : // to increase performance, only start detection if value - 289 : // isn't alphanumeric - 290 36 : if (!$value || !preg_match('/[^\w\s\/@!?,]+/', $value)) { - 291 1 : return false; - 292 : } - 293 : - 294 : // check if this field is part of the exceptions - 295 35 : if (is_array($this->exceptions) - 296 35 : && in_array($key, $this->exceptions, true)) { - 297 1 : return false; - 298 : } - 299 : - 300 : // check for magic quotes and remove them if necessary - 301 35 : if (function_exists('get_magic_quotes_gpc') - 302 35 : && get_magic_quotes_gpc()) { - 303 35 : $value = stripslashes($value); - 304 35 : } - 305 : - 306 : // if html monitoring is enabled for this field - then do it! - 307 35 : if (is_array($this->html) && in_array($key, $this->html, true)) { - 308 2 : list($key, $value) = $this->_purifyValues($key, $value); - 309 2 : } - 310 : - 311 : // check if json monitoring is enabled for this field - 312 35 : if (is_array($this->json) && in_array($key, $this->json, true)) { - 313 1 : list($key, $value) = $this->_jsonDecodeValues($key, $value); - 314 1 : } - 315 : - 316 : // use the converter - 317 35 : include_once 'IDS/Converter.php'; - 318 35 : $value = IDS_Converter::runAll($value); - 319 35 : $value = IDS_Converter::runCentrifuge($value, $this); - 320 : - 321 : // scan keys if activated via config - 322 35 : $key = $this->scanKeys ? IDS_Converter::runAll($key) - 323 35 : : $key; - 324 35 : $key = $this->scanKeys ? IDS_Converter::runCentrifuge($key, $this) - 325 35 : : $key; - 326 : - 327 35 : $filters = array(); - 328 35 : $filterSet = $this->storage->getFilterSet(); - 329 35 : foreach ($filterSet as $filter) { - 330 : - 331 : /* - 332 : * in case we have a tag array specified the IDS will only - 333 : * use those filters that are meant to detect any of the - 334 : * defined tags - 335 : */ - 336 35 : if (is_array($this->tags)) { - 337 1 : if (array_intersect($this->tags, $filter->getTags())) { - 338 1 : if ($this->_match($key, $value, $filter)) { - 339 1 : $filters[] = $filter; - 340 1 : } - 341 1 : } - 342 1 : } else { - 343 34 : if ($this->_match($key, $value, $filter)) { - 344 32 : $filters[] = $filter; - 345 32 : } - 346 : } - 347 35 : } - 348 : - 349 35 : return empty($filters) ? false : $filters; - 350 : } - 351 : - 352 : - 353 : /** - 354 : * Purifies given key and value variables using HTMLPurifier - 355 : * - 356 : * This function is needed whenever there is variables for which HTML - 357 : * might be allowed like e.g. WYSIWYG post bodies. It will dectect malicious - 358 : * code fragments and leaves harmless parts untouched. - 359 : * - 360 : * @param mixed $key - 361 : * @param mixed $value - 362 : * @since 0.5 - 363 : * - 364 : * @return array - 365 : */ - 366 : private function _purifyValues($key, $value) { - 367 : - 368 2 : include_once $this->pathToHTMLPurifier; - 369 : - 370 2 : if (!is_writeable($this->HTMLPurifierCache)) { - 371 0 : throw new Exception( - 372 0 : $this->HTMLPurifierCache . ' must be writeable'); - 373 : } - 374 : - 375 2 : if (class_exists('HTMLPurifier')) { - 376 2 : $config = HTMLPurifier_Config::createDefault(); - 377 2 : $config->set('Attr', 'EnableID', true); - 378 2 : $config->set('Cache', 'SerializerPath', $this->HTMLPurifierCache); - 379 2 : $config->set('Output', 'Newline', "\n"); - 380 2 : $this->htmlpurifier = new HTMLPurifier($config); - 381 2 : } else { - 382 0 : throw new Exception( - 383 : 'HTMLPurifier class could not be found - ' . - 384 0 : 'make sure the purifier files are valid and' . - 385 : ' the path is correct' - 386 0 : ); - 387 : } - 388 : - 389 2 : $purified_value = $this->htmlpurifier->purify($value); - 390 2 : $purified_key = $this->htmlpurifier->purify($key); - 391 : - 392 2 : $redux_value = strip_tags($value); - 393 2 : $redux_key = strip_tags($key); - 394 : - 395 2 : if ($value != $purified_value || $redux_value) { - 396 2 : $value = $this->_diff($value, $purified_value, $redux_value); - 397 2 : } else { - 398 0 : $value = NULL; - 399 : } - 400 2 : if ($key != $purified_key) { - 401 0 : $key = $this->_diff($key, $purified_key, $redux_key); - 402 0 : } else { - 403 2 : $key = NULL; - 404 : } - 405 : - 406 2 : return array($key, $value); - 407 : } - 408 : - 409 : /** - 410 : * This method calculates the difference between the original - 411 : * and the purified markup strings. - 412 : * - 413 : * @param string $original the original markup - 414 : * @param string $purified the purified markup - 415 : * @param string $redux the string without html - 416 : * @since 0.5 - 417 : * - 418 : * @return string the difference between the strings - 419 : */ - 420 : private function _diff($original, $purified, $redux) - 421 : { - 422 : /* - 423 : * deal with over-sensitive alt-attribute addition of the purifier - 424 : * and other common html formatting problems - 425 : */ - 426 2 : $purified = preg_replace('/\s+alt="[^"]*"/m', null, $purified); - 427 2 : $purified = preg_replace('/=?\s*"\s*"/m', null, $purified); - 428 : - 429 2 : $original = preg_replace('/=?\s*"\s*"/m', null, $original); - 430 2 : $original = preg_replace('/\s+alt=?/m', null, $original); - 431 : - 432 : // check which string is longer - 433 2 : $length = (strlen($original) - strlen($purified)); - 434 : /* - 435 : * Calculate the difference between the original html input - 436 : * and the purified string. - 437 : */ - 438 2 : if ($length > 0) { - 439 2 : $array_2 = str_split($original); - 440 2 : $array_1 = str_split($purified); - 441 2 : } else { - 442 2 : $array_1 = str_split($original); - 443 2 : $array_2 = str_split($purified); - 444 : } - 445 2 : foreach ($array_2 as $key => $value) { - 446 2 : if ($value !== $array_1[$key]) { - 447 2 : $array_1 = array_reverse($array_1); - 448 2 : $array_1[] = $value; - 449 2 : $array_1 = array_reverse($array_1); - 450 2 : } - 451 2 : } - 452 : - 453 : // return the diff - ready to hit the converter and the rules - 454 2 : $diff = trim(join('', array_reverse( - 455 2 : (array_slice($array_1, 0, $length))))); - 456 : - 457 : // clean up spaces between tag delimiters - 458 2 : $diff = preg_replace('/>\s*</m', '><', $diff); - 459 : - 460 : // correct over-sensitively stripped bad html elements - 461 2 : $diff = preg_replace('/[^<](iframe|script|embed|object' . - 462 2 : '|applet|base|img|style)/m', '<$1', $diff); - 463 : - 464 2 : if ($original == $purified && !$redux) { - 465 1 : return null; - 466 : } - 467 : - 468 2 : return $diff . $redux; - 469 : } - 470 : - 471 : /** - 472 : * This method prepares incoming JSON data for the PHPIDS detection - 473 : * process. It utilizes _jsonConcatContents() as callback and returns a - 474 : * string version of the JSON data structures. - 475 : * - 476 : * @param mixed $key - 477 : * @param mixed $value - 478 : * @since 0.5.3 - 479 : * - 480 : * @return array - 481 : */ - 482 : private function _jsonDecodeValues($key, $value) { - 483 : - 484 1 : $tmp_key = json_decode($key); - 485 1 : $tmp_value = json_decode($value); - 486 : - 487 1 : if($tmp_value && is_array($tmp_value) || is_object($tmp_value)) { - 488 1 : array_walk_recursive($tmp_value, array($this, '_jsonConcatContents')); - 489 1 : $value = $this->tmpJsonString; - 490 1 : } - 491 : - 492 1 : if($tmp_key && is_array($tmp_key) || is_object($tmp_key)) { - 493 0 : array_walk_recursive($tmp_key, array($this, '_jsonConcatContents')); - 494 0 : $key = $this->tmpJsonString; - 495 0 : } - 496 : - 497 1 : return array($key, $value); - 498 : } - 499 : - 500 : /** - 501 : * This is the callback used in _jsonDecodeValues(). The method - 502 : * concatenates key and value and stores them in $this->tmpJsonString. - 503 : * - 504 : * @param mixed $key - 505 : * @param mixed $value - 506 : * @since 0.5.3 - 507 : * - 508 : * @return void - 509 : */ - 510 : private function _jsonConcatContents($key, $value) { - 511 : - 512 1 : $this->tmpJsonString .= $key . " " . $value . "\n"; - 513 1 : } - 514 : - 515 : /** - 516 : * Matches given value and/or key against given filter - 517 : * - 518 : * @param mixed $key the key to optionally scan - 519 : * @param mixed $value the value to scan - 520 : * @param object $filter the filter object - 521 : * - 522 : * @return boolean - 523 : */ - 524 : private function _match($key, $value, $filter) - 525 : { - 526 35 : if ($this->scanKeys) { - 527 1 : if ($filter->match($key)) { - 528 1 : return true; - 529 : } - 530 1 : } - 531 : - 532 35 : if ($filter->match($value)) { - 533 33 : return true; - 534 : } - 535 : - 536 35 : return false; - 537 : } - 538 : - 539 : /** - 540 : * Sets exception array - 541 : * - 542 : * @param mixed $exceptions the thrown exceptions - 543 : * - 544 : * @return void - 545 : */ - 546 : public function setExceptions($exceptions) - 547 : { - 548 3 : if (!is_array($exceptions)) { - 549 2 : $exceptions = array($exceptions); - 550 2 : } - 551 : - 552 3 : $this->exceptions = $exceptions; - 553 3 : } - 554 : - 555 : /** - 556 : * Returns exception array - 557 : * - 558 : * @return array - 559 : */ - 560 : public function getExceptions() - 561 : { - 562 2 : return $this->exceptions; - 563 : } - 564 : - 565 : /** - 566 : * Sets html array - 567 : * - 568 : * @param mixed $html the fields containing html - 569 : * @since 0.5 - 570 : * - 571 : * @return void - 572 : */ - 573 : public function setHtml($html) - 574 : { - 575 3 : if (!is_array($html)) { - 576 1 : $html = array($html); - 577 1 : } - 578 : - 579 3 : $this->html = $html; - 580 3 : } - 581 : - 582 : /** - 583 : * Adds a value to the html array - 584 : * - 585 : * @since 0.5 - 586 : * - 587 : * @return void - 588 : */ - 589 : public function addHtml($value) - 590 : { - 591 0 : $this->html[] = $value; - 592 0 : } - 593 : - 594 : /** - 595 : * Returns html array - 596 : * - 597 : * @since 0.5 - 598 : * - 599 : * @return array the fields that contain allowed html - 600 : */ - 601 : public function getHtml() - 602 : { - 603 1 : return $this->html; - 604 : } - 605 : - 606 : /** - 607 : * Sets json array - 608 : * - 609 : * @param mixed $json the fields containing json - 610 : * @since 0.5.3 - 611 : * - 612 : * @return void - 613 : */ - 614 : public function setJson($json) - 615 : { - 616 1 : if (!is_array($json)) { - 617 0 : $json = array($json); - 618 0 : } - 619 : - 620 1 : $this->json = $json; - 621 1 : } - 622 : - 623 : /** - 624 : * Adds a value to the json array - 625 : * - 626 : * @since 0.5.3 - 627 : * - 628 : * @return void - 629 : */ - 630 : public function addJson($value) - 631 : { - 632 0 : $this->json[] = $value; - 633 0 : } - 634 : - 635 : /** - 636 : * Returns json array - 637 : * - 638 : * @since 0.5.3 - 639 : * - 640 : * @return array the fields that contain json - 641 : */ - 642 : public function getJson() - 643 : { - 644 0 : return $this->json; - 645 : } - 646 : - 647 : /** - 648 : * Returns storage container - 649 : * - 650 : * @return array - 651 : */ - 652 : public function getStorage() - 653 : { - 654 1 : return $this->storage; - 655 : } - 656 : - 657 : /** - 658 : * Returns report object providing various functions to work with - 659 : * detected results. Also the centrifuge data is being set as property - 660 : * of the report object. - 661 : * - 662 : * @return object IDS_Report - 663 : */ - 664 : public function getReport() - 665 : { - 666 36 : if (isset($this->centrifuge) && $this->centrifuge) { - 667 18 : $this->report->setCentrifuge($this->centrifuge); - 668 18 : } - 669 : - 670 36 : return $this->report; - 671 : } - 672 : - 673 : } - 674 : - 675 : /* - 676 : * Local variables: - 677 : * tab-width: 4 - 678 : * c-basic-offset: 4 - 679 : * End: - 680 : */ - -- |
-
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
-
|
- ||||
|
-
| - | Coverage | -|||||||||||
| - | Classes | -Methods | -Lines | -|||||||||
| Total | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -13 / 13 | -
-
|
- 86.08% | -68 / 79 | -|||
| - | ||||||||||||
| IDS_Report | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -13 / 13 | -
-
|
- 86.08% | -68 / 79 | -|||
| public function __construct(array $events = NULL) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -6 / 6 | -||||||
| public function addEvent(IDS_Event $event) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -3 / 3 | -||||||
| public function getEvent($name) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -6 / 6 | -||||||
| public function getTags() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -9 / 9 | -||||||
| public function getImpact() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -7 / 7 | -||||||
| public function hasEvent($name) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -3 / 3 | -||||||
| public function count() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function getIterator() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| public function isEmpty() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -1 / 1 | -||||||
| protected function clear() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -3 / 3 | -||||||
| public function getCentrifuge() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 100.00% | -2 / 2 | -||||||
| public function setCentrifuge($centrifuge = array ( -)) | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 75.00% | -3 / 4 | -||||||
| public function __toString() | -
-
|
- 100.00% | -1 / 1 | -
-
|
- 69.70% | -23 / 33 | -||||||
-- 1 : <?php - 2 : - 3 : /** - 4 : * PHPIDS - 5 : * - 6 : * Requirements: PHP5, SimpleXML - 7 : * - 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) - 9 : * - 10 : * PHPIDS is free software; you can redistribute it and/or modify - 11 : * it under the terms of the GNU Lesser General Public License as published by - 12 : * the Free Software Foundation, version 3 of the License, or - 13 : * (at your option) any later version. - 14 : * - 15 : * PHPIDS is distributed in the hope that it will be useful, - 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of - 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - 18 : * GNU Lesser General Public License for more details. - 19 : * - 20 : * You should have received a copy of the GNU Lesser General Public License - 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. - 22 : * - 23 : * PHP version 5.1.6+ - 24 : * - 25 : * @category Security - 26 : * @package PHPIDS - 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 28 : * @author Christian Matthies <ch0012@gmail.com> - 29 : * @author Lars Strojny <lars@strojny.net> - 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 31 : * @link http://php-ids.org/ - 32 : */ - 33 : - 34 : /** - 35 : * PHPIDS report object - 36 : * - 37 : * The report objects collects a number of events and thereby presents the - 38 : * detected results. It provides a convenient API to work with the results. - 39 : * - 40 : * Note that this class implements Countable, IteratorAggregate and - 41 : * a __toString() method - 42 : * - 43 : * @category Security - 44 : * @package PHPIDS - 45 : * @author Christian Matthies <ch0012@gmail.com> - 46 : * @author Mario Heiderich <mario.heiderich@gmail.com> - 47 : * @author Lars Strojny <lars@strojny.net> - 48 : * @copyright 2007 The PHPIDS Group - 49 : * @license http://www.gnu.org/licenses/lgpl.html LGPL - 50 : * @version Release: $Id:Report.php 517 2007-09-15 15:04:13Z mario $ - 51 : * @link http://php-ids.org/ - 52 : */ - 53 : class IDS_Report implements Countable, IteratorAggregate - 54 : { - 55 : - 56 : /** - 57 : * Event container - 58 : * - 59 : * @var array - 60 : */ - 61 : protected $events = array(); - 62 : - 63 : /** - 64 : * List of affected tags - 65 : * - 66 : * This list of tags is collected from the collected event objects on - 67 : * demand when IDS_Report->getTags() is called - 68 : * - 69 : * @var array - 70 : */ - 71 : protected $tags = array(); - 72 : - 73 : /** - 74 : * Impact level - 75 : * - 76 : * The impact level is calculated on demand by adding the results of the - 77 : * event objects on IDS_Report->getImpact() - 78 : * - 79 : * @var integer - 80 : */ - 81 : protected $impact = 0; - 82 : - 83 : /** - 84 : * Centrifuge data - 85 : * - 86 : * This variable - initiated as an empty array - carries all information - 87 : * about the centrifuge data if available - 88 : * - 89 : * @var array - 90 : */ - 91 : protected $centrifuge = array(); - 92 : - 93 : /** - 94 : * Constructor - 95 : * - 96 : * @param array $events the events the report should include - 97 : * - 98 : * @return void - 99 : */ - 100 : public function __construct(array $events = null) - 101 : { - 102 59 : if ($events) { - 103 19 : foreach ($events as $event) { - 104 19 : $this->addEvent($event); - 105 19 : } - 106 19 : } - 107 59 : } - 108 : - 109 : /** - 110 : * Adds an IDS_Event object to the report - 111 : * - 112 : * @param object $event IDS_Event - 113 : * - 114 : * @return object $this - 115 : */ - 116 : public function addEvent(IDS_Event $event) - 117 : { - 118 52 : $this->clear(); - 119 52 : $this->events[$event->getName()] = $event; - 120 : - 121 52 : return $this; - 122 : } - 123 : - 124 : /** - 125 : * Get event by name - 126 : * - 127 : * In most cases an event is identified by the key of the variable that - 128 : * contained maliciously appearing content - 129 : * - 130 : * @param scalar $name the event name - 131 : * - 132 : * @throws InvalidArgumentException if argument is invalid - 133 : * @return mixed IDS_Event object or false if the event does not exist - 134 : */ - 135 : public function getEvent($name) - 136 : { - 137 5 : if (!is_scalar($name)) { - 138 1 : throw new InvalidArgumentException( - 139 : 'Invalid argument type given' - 140 1 : ); - 141 : } - 142 : - 143 4 : if ($this->hasEvent($name)) { - 144 3 : return $this->events[$name]; - 145 : } - 146 : - 147 1 : return false; - 148 : } - 149 : - 150 : /** - 151 : * Returns list of affected tags - 152 : * - 153 : * @return array - 154 : */ - 155 : public function getTags() - 156 : { - 157 3 : if (!$this->tags) { - 158 3 : $this->tags = array(); - 159 : - 160 3 : foreach ($this->events as $event) { - 161 3 : $this->tags = array_merge($this->tags, - 162 3 : $event->getTags()); - 163 3 : } - 164 : - 165 3 : $this->tags = array_values(array_unique($this->tags)); - 166 3 : } - 167 : - 168 3 : return $this->tags; - 169 : } - 170 : - 171 : /** - 172 : * Returns total impact - 173 : * - 174 : * Each stored IDS_Event object and its IDS_Filter sub-object are called - 175 : * to calculate the overall impact level of this request - 176 : * - 177 : * @return integer - 178 : */ - 179 : public function getImpact() - 180 : { - 181 36 : if (!$this->impact) { - 182 36 : $this->impact = 0; - 183 36 : foreach ($this->events as $event) { - 184 34 : $this->impact += $event->getImpact(); - 185 36 : } - 186 36 : } - 187 : - 188 36 : return $this->impact; - 189 : } - 190 : - 191 : /** - 192 : * Checks if a specific event with given name exists - 193 : * - 194 : * @param scalar $name the event name - 195 : * - 196 : * @throws InvalidArgumentException if argument is illegal - 197 : * - 198 : * @return boolean - 199 : */ - 200 : public function hasEvent($name) - 201 : { - 202 11 : if (!is_scalar($name)) { - 203 1 : throw new InvalidArgumentException('Invalid argument given'); - 204 : } - 205 : - 206 10 : return isset($this->events[$name]); - 207 : } - 208 : - 209 : /** - 210 : * Returns total amount of events - 211 : * - 212 : * @return integer - 213 : */ - 214 : public function count() - 215 : { - 216 1 : return count($this->events); - 217 : } - 218 : - 219 : /** - 220 : * Return iterator object - 221 : * - 222 : * In order to provide the possibility to directly iterate over the - 223 : * IDS_Event object the IteratorAggregate is implemented. One can easily - 224 : * use foreach() to iterate through all stored IDS_Event objects. - 225 : * - 226 : * @return Iterator - 227 : */ - 228 : public function getIterator() - 229 : { - 230 1 : return new ArrayObject($this->events); - 231 : } - 232 : - 233 : /** - 234 : * Checks if any events are registered - 235 : * - 236 : * @return boolean - 237 : */ - 238 : public function isEmpty() - 239 : { - 240 4 : return empty($this->events); - 241 : } - 242 : - 243 : /** - 244 : * Clears calculated/collected values - 245 : * - 246 : * @return void - 247 : */ - 248 : protected function clear() - 249 : { - 250 52 : $this->impact = 0; - 251 52 : $this->tags = array(); - 252 52 : } - 253 : - 254 : /** - 255 : * This method returns the centrifuge property or null if not - 256 : * filled with data - 257 : * - 258 : * @return array/null - 259 : */ - 260 : public function getCentrifuge() - 261 : { - 262 1 : return ($this->centrifuge && count($this->centrifuge) > 0) - 263 1 : ? $this->centrifuge : null; - 264 : } - 265 : - 266 : /** - 267 : * This method sets the centrifuge property - 268 : * - 269 : * @param array $centrifuge the centrifuge data - 270 : * - 271 : * @throws InvalidArgumentException if argument is illegal - 272 : * - 273 : * @return boolean true is arguments were valid - 274 : */ - 275 : public function setCentrifuge($centrifuge = array()) - 276 : { - 277 18 : if (is_array($centrifuge) && $centrifuge) { - 278 18 : $this->centrifuge = $centrifuge; - 279 18 : return true; - 280 : } - 281 0 : throw new InvalidArgumentException('Invalid argument given'); - 282 : } - 283 : - 284 : /** - 285 : * Directly outputs all available information - 286 : * - 287 : * @return string - 288 : */ - 289 : public function __toString() - 290 : { - 291 2 : if (!$this->isEmpty()) { - 292 1 : $output = ''; - 293 1 : $output .= 'Total impact: ' . $this->getImpact() . "<br/>\n"; - 294 1 : $output .= 'Affected tags: ' . join(', ', $this->getTags()) . - 295 1 : "<br/>\n"; - 296 : - 297 1 : foreach ($this->events as $event) { - 298 : $output .= "<br/>\nVariable: " . - 299 1 : htmlspecialchars($event->getName()) . ' | Value: ' . - 300 1 : htmlspecialchars($event->getValue()) . "<br/>\n"; - 301 1 : $output .= 'Impact: ' . $event->getImpact() . ' | Tags: ' . - 302 1 : join(', ', $event->getTags()) . "<br/>\n"; - 303 : - 304 1 : foreach ($event as $filter) { - 305 1 : $output .= 'Description: ' . $filter->getDescription() . - 306 1 : ' | '; - 307 1 : $output .= 'Tags: ' . join(', ', $filter->getTags()) . - 308 1 : ' | '; - 309 1 : $output .= 'ID: ' . $filter->getId() . - 310 1 : "<br/>\n"; - 311 1 : } - 312 1 : } - 313 : - 314 1 : $output .= '<br/>'; - 315 : - 316 1 : if ($centrifuge = $this->getCentrifuge()) { - 317 0 : $output .= 'Centrifuge detection data'; - 318 : $output .= '<br/> Threshold: ' . - 319 0 : ((isset($centrifuge['threshold'])&&$centrifuge['threshold']) ? - 320 0 : $centrifuge['threshold'] : '---'); - 321 : $output .= '<br/> Ratio: ' . - 322 0 : ((isset($centrifuge['ratio'])&&$centrifuge['ratio']) ? - 323 0 : $centrifuge['ratio'] : '---'); - 324 0 : if(isset($centrifuge['converted'])) { - 325 0 : $output .= '<br/> Converted: ' . $centrifuge['converted']; - 326 0 : } - 327 0 : $output .= "<br/><br/>\n"; - 328 0 : } - 329 1 : } - 330 : - 331 2 : return isset($output) ? $output : ''; - 332 : } - 333 : } - 334 : - 335 : /* - 336 : * Local variables: - 337 : * tab-width: 4 - 338 : * c-basic-offset: 4 - 339 : * End: - 340 : */ - -- |
-
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
" . dvwaReadIdsLog() . "
-Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment.
-The aim of DVWA is to practice some of the most common web vulnerabilities, with various levels of difficultly, with a simple straightforward interface.
-It is up to the user how they approach DVWA. Either by working through every module at a fixed level, or selecting any module and working up to reach the highest level they can before moving onto the next one. There is not a fixed object to complete a module; however users should feel that they have successfully exploited the system as best as they possible could by using that particular vulnerability.
-Please note, there are both documented and undocumented vulnerability with this software. This is intentional. You are encouraged to try and discover as many issues as possible.
-DVWA also includes a Web Application Firewall (WAF), PHPIDS, which can be enabled at any stage to further increase the difficulty. This will demonstrate how adding another layer of security may block certain malicious actions. Note, there are also various public methods at bypassing these protections (so this can be seen as an extension for more advanced users)!
-There is a help button at the bottom of each page, which allows you to view hints & tips for that vulnerability. There are also additional links for further background reading, which relates to that security issue.
-Damn Vulnerable Web Application is damn vulnerable! Do not upload it to your hosting provider's public html folder or any Internet facing servers, as they will be compromised. It is recommend using a virtual machine (such as " . dvwaExternalLinkUrlGet( 'https://www.virtualbox.org/','VirtualBox' ) . " or " . dvwaExternalLinkUrlGet( 'https://www.vmware.com/','VMware' ) . "), which is set to NAT networking mode. Inside a guest machine, you can downloading and install " . dvwaExternalLinkUrlGet( 'https://www.apachefriends.org/en/xampp.html','XAMPP' ) . " for the web server and database.
-We do not take responsibility for the way in which any one uses this application (DVWA). We have made the purposes of the application clear and it should not be used maliciously. We have given warnings and taken measures to prevent users from installing DVWA on to live web servers. If your web server is compromised via an installation of DVWA it is not our responsibility it is the responsibility of the person/s who uploaded and installed it.
-DVWA aims to cover the most commonly seen vulnerabilities found in today's web applications. However there are plenty of other issues with web applications. Should you wish to explore any additional attack vectors, or want more difficult challenges, you may wish to look into the following other projects:
-' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '.' ); - if( $result && mysqli_num_rows( $result ) == 1 ) { // Login Successful... - dvwaMessagePush( "You have logged in as '{$user}'" ); - dvwaLogin( $user ); - dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'index.php' ); - } - - // Login failed - dvwaMessagePush( 'Login failed' ); - dvwaRedirect( 'login.php' ); -} - -$messagesHtml = messagesPopAllToHtml(); - -Header( 'Cache-Control: no-cache, must-revalidate'); // HTTP/1.1 -Header( 'Content-Type: text/html;charset=utf-8' ); // TODO- proper XHTML headers... -Header( 'Expires: Tue, 23 Jun 2009 12:00:00 GMT' ); // Date in the past - -// Anti-CSRF -generateSessionToken(); - -echo " - - - - - - - - -
Try installing again.
"; - } - $securityOptionsHtml .= ""; -} - -$phpIdsHtml = 'PHPIDS is currently: '; - -// Able to write to the PHPIDS log file? -$WarningHtml = ''; - -if( dvwaPhpIdsIsEnabled() ) { - $phpIdsHtml .= 'enabled. [Disable PHPIDS]'; - - # Only check if PHPIDS is enabled - if( !is_writable( $PHPIDSPath ) ) { - $WarningHtml .= "
" . dvwaExternalLinkUrlGet( 'https://github.com/PHPIDS/PHPIDS', 'PHPIDS' ) . " v" . dvwaPhpIdsVersionGet() . " (PHP-Intrusion Detection System) is a security layer for PHP based web applications.
-PHPIDS works by filtering any user supplied input against a blacklist of potentially malicious code. It is used in DVWA to serve as a live example of how Web Application Firewalls (WAFs) can help improve security and in some cases how WAFs can be circumvented.
-You can enable PHPIDS across this site for the duration of your session.
- -{$phpIdsHtml}
- [\">Simulate attack] - - [View IDS log] -Click on the 'Create / Reset Database' button below to create or reset your database.
- If you get an error make sure you have the correct user credentials in: " . realpath( getcwd() . DIRECTORY_SEPARATOR . "config" . DIRECTORY_SEPARATOR . "config.inc.php" ) . "
If the database already exists, it will be cleared and the data will be reset.
- You can also use this to reset the administrator credentials (\"admin // password\") at any stage.
allow_url_fopen = On
-allow_url_include = On
- About-Password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system. - A common approach is to repeatedly try guesses for the password. - -Users often choose weak passwords. Examples of insecure choices include single words found in dictionaries, family names, any too short password - (usually thought to be less than 6 or 7 characters), or predictable patterns - (e.g. alternating vowels and consonants, which is known as leetspeak, so "password" becomes "p@55w0rd"). - -Creating a targeted wordlists, which is generated towards the target, often gives the highest success rate. There are public tools out there that will create a dictionary - based on a combination of company websites, personal social networks and other common information (such as birthdays or year of graduation). - - A last resort is to try every possible password, known as a brute force attack. In theory, if there is no limit to the number of attempts, a brute force attack will always - be successful since the rules for acceptable passwords must be publicly known; but as the length of the password increases, so does the number of possible passwords - making the attack time longer. - -- - Objective-Your goal is to get the administrator’s password by brute forcing. Bonus points for getting the other four user passwords! - -- - Low Level-The developer has completely missed out any protections methods, allowing for anyone to try as many times as they wish, to login to any user without any repercussions. - -- - Medium Level-This stage adds a sleep on the failed login screen. This mean when you login incorrectly, there will be an extra two second wait before the page is visible. - -This will only slow down the amount of requests which can be processed a minute, making it longer to brute force. - -- - High Level-There has been an "anti Cross-Site Request Forgery (CSRF) token" used. There is a old myth that this protection will stop brute force attacks. This is not the case. - This level also extends on the medium level, by waiting when there is a failed login but this time it is a random amount of time between two and four seconds. - The idea of this is to try and confuse any timing predictions. - -Using a form could have a similar effect as a CSRF token. - -- - Impossible Level-Brute force (and user enumeration) should not be possible in the impossible level. The developer has added a "lock out" feature, where if there are five bad logins within - the last 15 minutes, the locked out user cannot log in. - -If the locked out user tries to login, even with a valid password, it will say their username or password is incorrect. This will make it impossible to know - if there is a valid account on the system, with that password, and if the account is locked. - -This can cause a "Denial of Service" (DoS), by having someone continually trying to login to someone's account. - This level would need to be extended by blacklisting the attacker (e.g. IP address, country, user-agent). - |
-
Reference:
-Welcome to the password protected area {$user}
"; - $html .= ""; - } - - ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); -} - -// Generate Anti-CSRF token -generateSessionToken(); - -?> diff --git a/dvwa/vulnerabilities/brute/source/impossible.php b/dvwa/vulnerabilities/brute/source/impossible.php deleted file mode 100644 index 0816216..0000000 --- a/dvwa/vulnerabilities/brute/source/impossible.php +++ /dev/null @@ -1,102 +0,0 @@ -prepare( 'SELECT failed_login, last_login FROM users WHERE user = (:user) LIMIT 1;' ); - $data->bindParam( ':user', $user, PDO::PARAM_STR ); - $data->execute(); - $row = $data->fetch(); - - // Check to see if the user has been locked out. - if( ( $data->rowCount() == 1 ) && ( $row[ 'failed_login' ] >= $total_failed_login ) ) { - // User locked out. Note, using this method would allow for user enumeration! - //$html .= "
Username and/or password incorrect.
"; - - // Calculate when the user would be allowed to login again - $last_login = strtotime( $row[ 'last_login' ] ); - $timeout = $last_login + ($lockout_time * 60); - $timenow = time(); - - /* - print "The last login was: " . date ("h:i:s", $last_login) . "
This account has been locked due to too many incorrect logins.
Welcome to the password protected area {$user}
"; - $html .= "Warning: Someone might of been brute forcing your account.
"; - $html .= "Number of login attempts: {$failed_login}.
Last login attempt was at: ${last_login}.
"; - - // Update bad login count - $data = $db->prepare( 'UPDATE users SET failed_login = (failed_login + 1) WHERE user = (:user) LIMIT 1;' ); - $data->bindParam( ':user', $user, PDO::PARAM_STR ); - $data->execute(); - } - - // Set the last login time - $data = $db->prepare( 'UPDATE users SET last_login = now() WHERE user = (:user) LIMIT 1;' ); - $data->bindParam( ':user', $user, PDO::PARAM_STR ); - $data->execute(); -} - -// Generate Anti-CSRF token -generateSessionToken(); - -?> diff --git a/dvwa/vulnerabilities/brute/source/low.php b/dvwa/vulnerabilities/brute/source/low.php deleted file mode 100644 index 55e390f..0000000 --- a/dvwa/vulnerabilities/brute/source/low.php +++ /dev/null @@ -1,32 +0,0 @@ -' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '' ); - - if( $result && mysqli_num_rows( $result ) == 1 ) { - // Get users details - $row = mysqli_fetch_assoc( $result ); - $avatar = $row["avatar"]; - - // Login successful - $html .= "
Username and/or password incorrect.
Alternative, the account has been locked because of too many failed logins.
If this is the case, please try again in {$lockout_time} minutes.
Welcome to the password protected area {$user}
"; - $html .= ""; - } - - ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); -} - -?> diff --git a/dvwa/vulnerabilities/brute/source/medium.php b/dvwa/vulnerabilities/brute/source/medium.php deleted file mode 100644 index 192362a..0000000 --- a/dvwa/vulnerabilities/brute/source/medium.php +++ /dev/null @@ -1,35 +0,0 @@ -' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '' ); - - if( $result && mysqli_num_rows( $result ) == 1 ) { - // Get users details - $row = mysqli_fetch_assoc( $result ); - $avatar = $row["avatar"]; - - // Login successful - $html .= "
Username and/or password incorrect.
Welcome to the password protected area {$user}
"; - $html .= ""; - } - - ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); -} - -?> diff --git a/dvwa/vulnerabilities/captcha/help/help.php b/dvwa/vulnerabilities/captcha/help/help.php deleted file mode 100644 index e79d9aa..0000000 --- a/dvwa/vulnerabilities/captcha/help/help.php +++ /dev/null @@ -1,62 +0,0 @@ -
Username and/or password incorrect.
- About-A is a program that can tell whether its user is a human or a computer. You've probably seen - them - colourful images with distorted text at the bottom of Web registration forms. CAPTCHAs are used by many websites to prevent abuse from - "bots", or automated programs usually written to generate spam. No computer program can read distorted text as well as humans can, so bots - cannot navigate sites protected by CAPTCHAs. - -CAPTCHAs are often used to protect sensitive functionality from automated bots. Such functionality typically includes user registration and changes, - password changes, and posting content. In this example, the CAPTCHA is guarding the change password functionality for the user account. This provides - limited protection from CSRF attacks as well as automated bot guessing. - -- - Objective-Your aim, change the current user's password in a automated manner because of the poor CAPTCHA system. - -- - Low Level-The issue with this CAPTCHA is that it is easily bypassed. The developer has made the assumption that all users will progress through screen 1, complete the CAPTCHA, and then - move on to the next screen where the password is actually updated. By submitting the new password directly to the change page, the user may bypass the CAPTCHA system. - -The parameters required to complete this challenge in low security would be similar to the following: -Spoiler: ?step=2&password_new=password&password_conf=password&Change=Change.
-
- - - Medium Level-The developer has attempted to place state around the session and keep track of whether the user successfully completed the - CAPTCHA prior to submitting data. Because the state variable (Spoiler: passed_captcha) is on the client side, - it can also be manipulated by the attacker like so: -Spoiler: ?step=2&password_new=password&password_conf=password&passed_captcha=true&Change=Change.
-
- - - High Level-There has been development code left in, which was never removed in production. It is possible to mimic the development values, to allow - invalid values in be placed into the CAPTCHA field. -You will need to spoof your user-agent (Spoiler: reCAPTCHA) as well as use the CAPTCHA value of - (Spoiler: hidd3n_valu3) to skip the check. - -- - Impossible Level-In the impossible level, the developer has removed all avenues of attack. The process has been simplified so that data and CAPTCHA verification occurs in one - single step. Alternatively, the developer could have moved the state variable server side (from the medium level), so the user cannot alter it. - |
-
Reference:
-Password Changed."; - - } else { - // Ops. Password mismatch - $html .= "
Both passwords must match."; - $hide_form = false; - } - - } else { - // What happens when the CAPTCHA was entered incorrectly - $html .= "
"; - $hide_form = false; - return; - } - - ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); -} - -// Generate Anti-CSRF token -generateSessionToken(); - -?> diff --git a/dvwa/vulnerabilities/captcha/source/impossible.php b/dvwa/vulnerabilities/captcha/source/impossible.php deleted file mode 100644 index 8dcce34..0000000 --- a/dvwa/vulnerabilities/captcha/source/impossible.php +++ /dev/null @@ -1,68 +0,0 @@ -
The CAPTCHA was incorrect. Please try again.
Password Changed."; - } - else { - // Feedback for the end user - failed! - $html .= "
Either your current password is incorrect or the new passwords did not match."; - $hide_form = false; - } - } -} - -// Generate Anti-CSRF token -generateSessionToken(); - -?> diff --git a/dvwa/vulnerabilities/captcha/source/low.php b/dvwa/vulnerabilities/captcha/source/low.php deleted file mode 100644 index 1812974..0000000 --- a/dvwa/vulnerabilities/captcha/source/low.php +++ /dev/null @@ -1,75 +0,0 @@ -
Please try again.
- "; - } - else { - // Both new passwords do not match. - $html .= "
You passed the CAPTCHA! Click the button to confirm your changes.
Both passwords must match."; - $hide_form = false; - } - } -} - -if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) { - // Hide the CAPTCHA form - $hide_form = true; - - // Get input - $pass_new = $_POST[ 'password_new' ]; - $pass_conf = $_POST[ 'password_conf' ]; - - // Check to see if both password match - if( $pass_new == $pass_conf ) { - // They do! - $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); - $pass_new = md5( $pass_new ); - - // Update database - $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';"; - $result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '
' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '' ); - - // Feedback for the end user - $html .= "
Password Changed."; - } - else { - // Issue with the passwords matching - $html .= "
Passwords did not match."; - $hide_form = false; - } - - ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); -} - -?> diff --git a/dvwa/vulnerabilities/captcha/source/medium.php b/dvwa/vulnerabilities/captcha/source/medium.php deleted file mode 100644 index d655b36..0000000 --- a/dvwa/vulnerabilities/captcha/source/medium.php +++ /dev/null @@ -1,83 +0,0 @@ -
- "; - } - else { - // Both new passwords do not match. - $html .= "
You passed the CAPTCHA! Click the button to confirm your changes.
Both passwords must match."; - $hide_form = false; - } - } -} - -if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) { - // Hide the CAPTCHA form - $hide_form = true; - - // Get input - $pass_new = $_POST[ 'password_new' ]; - $pass_conf = $_POST[ 'password_conf' ]; - - // Check to see if they did stage 1 - if( !$_POST[ 'passed_captcha' ] ) { - $html .= "
"; - $hide_form = false; - return; - } - - // Check to see if both password match - if( $pass_new == $pass_conf ) { - // They do! - $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); - $pass_new = md5( $pass_new ); - - // Update database - $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';"; - $result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '
You have not passed the CAPTCHA.
' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '' ); - - // Feedback for the end user - $html .= "
Password Changed."; - } - else { - // Issue with the passwords matching - $html .= "
Passwords did not match."; - $hide_form = false; - } - - ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); -} - -?> diff --git a/dvwa/vulnerabilities/csp/help/help.php b/dvwa/vulnerabilities/csp/help/help.php deleted file mode 100644 index 739b3f5..0000000 --- a/dvwa/vulnerabilities/csp/help/help.php +++ /dev/null @@ -1,52 +0,0 @@ -
- About-Content Security Policy (CSP) is used to define where scripts and other resources can be loaded or executed from. This module will walk you through ways to bypass the policy based on common mistakes made by developers. -None of the vulnerabilities are actual vulnerabilities in CSP, they are vulnerabilities in the way it has been implemented. - -- - Objective-Bypass Content Security Policy (CSP) and execute JavaScript in the page. - -- - Low Level-Examine the policy to find all the sources that can be used to host external script files. -Spoiler: Scripts can be included from Pastebin, try storing some JavaScript on there and then loading it in.
-
- - - Medium Level-The CSP policy tries to use a nonce to prevent inline scripts from being added by attackers. -Spoiler: Examine the nonce and see how it varies (or doesn't).
-
- - - High Level-The page makes a JSONP call to source/jsonp.php passing the name of the function to callback to, you need to modify the jsonp.php script to change the callback function. -Spoiler: The JavaScript on the page will execute whatever is returned by the page, changing this to your own code will execute that instead
-
- - - Impossible Level-- This level is an update of the high level where the JSONP call has its callback function hardcoded and the CSP policy is locked down to only allow external scripts. - - |
-
Reference:
-Reference:
-Reference:
-Module developed by Digininja.
-The page makes a call to ' . DVWA_WEB_PAGE_TO_ROOT . '/vulnerabilities/csp/source/jsonp.php to load some code. Modify that page to run your own code.
-1+2+3+4+5=
- - - - -'; - diff --git a/dvwa/vulnerabilities/csp/source/impossible.js b/dvwa/vulnerabilities/csp/source/impossible.js deleted file mode 100644 index 11b56aa..0000000 --- a/dvwa/vulnerabilities/csp/source/impossible.js +++ /dev/null @@ -1,19 +0,0 @@ -function clickButton() { - var s = document.createElement("script"); - s.src = "source/jsonp_impossible.php"; - document.body.appendChild(s); -} - -function solveSum(obj) { - if ("answer" in obj) { - document.getElementById("answer").innerHTML = obj['answer']; - } -} - -var solve_button = document.getElementById ("solve"); - -if (solve_button) { - solve_button.addEventListener("click", function() { - clickButton(); - }); -} diff --git a/dvwa/vulnerabilities/csp/source/impossible.php b/dvwa/vulnerabilities/csp/source/impossible.php deleted file mode 100644 index 320fd2f..0000000 --- a/dvwa/vulnerabilities/csp/source/impossible.php +++ /dev/null @@ -1,23 +0,0 @@ - - -Unlike the high level, this does a JSONP call but does not use a callback, instead it hardcodes the function to call.
The CSP settings only allow external JavaScript on the local server and no inline code.
-1+2+3+4+5=
- - - - -'; - diff --git a/dvwa/vulnerabilities/csp/source/jsonp.php b/dvwa/vulnerabilities/csp/source/jsonp.php deleted file mode 100644 index fcfc535..0000000 --- a/dvwa/vulnerabilities/csp/source/jsonp.php +++ /dev/null @@ -1,13 +0,0 @@ - "15"); - -echo $callback . "(".json_encode($outp).")"; -?> diff --git a/dvwa/vulnerabilities/csp/source/jsonp_impossible.php b/dvwa/vulnerabilities/csp/source/jsonp_impossible.php deleted file mode 100644 index 090a38b..0000000 --- a/dvwa/vulnerabilities/csp/source/jsonp_impossible.php +++ /dev/null @@ -1,7 +0,0 @@ - "15"); - -echo "solveSum (".json_encode($outp).")"; -?> diff --git a/dvwa/vulnerabilities/csp/source/low.php b/dvwa/vulnerabilities/csp/source/low.php deleted file mode 100644 index ea25c72..0000000 --- a/dvwa/vulnerabilities/csp/source/low.php +++ /dev/null @@ -1,22 +0,0 @@ - - -"; -} -$page[ 'body' ] .= ' - -'; diff --git a/dvwa/vulnerabilities/csp/source/medium.php b/dvwa/vulnerabilities/csp/source/medium.php deleted file mode 100644 index 0fd0320..0000000 --- a/dvwa/vulnerabilities/csp/source/medium.php +++ /dev/null @@ -1,25 +0,0 @@ -alert(1) - -?> - -Whatever you enter here gets dropped directly into the page, see if you can get an alert box to pop up.
- - - -'; diff --git a/dvwa/vulnerabilities/csrf/help/help.php b/dvwa/vulnerabilities/csrf/help/help.php deleted file mode 100644 index c025b03..0000000 --- a/dvwa/vulnerabilities/csrf/help/help.php +++ /dev/null @@ -1,57 +0,0 @@ -
- About-CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated. - With a little help of social engineering (such as sending a link via email/chat), an attacker may force the users of a web application to execute actions of - the attacker's choosing. - -A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is - the administrator account, this can compromise the entire web application. - -This attack may also be called "XSRF", similar to "Cross Site scripting (XSS)", and they are often used together. - -- - Objective-Your task is to make the current user change their own password, without them knowing about their actions, using a CSRF attack. - -- - Low Level-There are no measures in place to protect against this attack. This means a link can be crafted to achieve a certain action (in this case, change the current users password). - Then with some basic social engineering, have the target click the link (or just visit a certain page), to trigger the action. -Spoiler: ?password_new=password&password_conf=password&Change=Change.
-
- - - Medium Level-For the medium level challenge, there is a check to see where the last requested page came from. The developer believes if it matches the current domain, - it must of come from the web application so it can be trusted. -It may be required to link in multiple vulnerabilities to exploit this vector, such as reflective XSS. - -- - High Level-In the high level, the developer has added an "anti Cross-Site Request Forgery (CSRF) token". In order by bypass this protection method, another vulnerability will be required. -Spoiler: e.g. Javascript is a executed on the client side, in the browser.
-
- - - Impossible Level-In the impossible level, the challenge will extent the high level and asks for the current user's password. As this cannot be found out (only predicted or brute forced), - there is not an attack vector here. - |
-
Reference:
-Password Changed."; - } - else { - // Issue with passwords matching - $html .= "
Passwords did not match."; - } - - ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); -} - -// Generate Anti-CSRF token -generateSessionToken(); - -?> diff --git a/dvwa/vulnerabilities/csrf/source/impossible.php b/dvwa/vulnerabilities/csrf/source/impossible.php deleted file mode 100644 index 0b69b36..0000000 --- a/dvwa/vulnerabilities/csrf/source/impossible.php +++ /dev/null @@ -1,48 +0,0 @@ -prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' ); - $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR ); - $data->bindParam( ':password', $pass_curr, PDO::PARAM_STR ); - $data->execute(); - - // Do both new passwords match and does the current password match the user? - if( ( $pass_new == $pass_conf ) && ( $data->rowCount() == 1 ) ) { - // It does! - $pass_new = stripslashes( $pass_new ); - $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); - $pass_new = md5( $pass_new ); - - // Update database with new password - $data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' ); - $data->bindParam( ':password', $pass_new, PDO::PARAM_STR ); - $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR ); - $data->execute(); - - // Feedback for the user - $html .= "
Password Changed."; - } - else { - // Issue with passwords matching - $html .= "
Passwords did not match or current password incorrect."; - } -} - -// Generate Anti-CSRF token -generateSessionToken(); - -?> diff --git a/dvwa/vulnerabilities/csrf/source/low.php b/dvwa/vulnerabilities/csrf/source/low.php deleted file mode 100644 index 4787125..0000000 --- a/dvwa/vulnerabilities/csrf/source/low.php +++ /dev/null @@ -1,29 +0,0 @@ -' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '' ); - - // Feedback for the user - $html .= "
Password Changed."; - } - else { - // Issue with passwords matching - $html .= "
Passwords did not match."; - } - - ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); -} - -?> diff --git a/dvwa/vulnerabilities/csrf/source/medium.php b/dvwa/vulnerabilities/csrf/source/medium.php deleted file mode 100644 index 459368b..0000000 --- a/dvwa/vulnerabilities/csrf/source/medium.php +++ /dev/null @@ -1,36 +0,0 @@ -' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '' ); - - // Feedback for the user - $html .= "
Password Changed."; - } - else { - // Issue with passwords matching - $html .= "
Passwords did not match."; - } - } - else { - // Didn't come from a trusted source - $html .= "
That request didn't look correct."; - } - - ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); -} - -?> diff --git a/dvwa/vulnerabilities/exec/help/help.php b/dvwa/vulnerabilities/exec/help/help.php deleted file mode 100644 index 55d60fc..0000000 --- a/dvwa/vulnerabilities/exec/help/help.php +++ /dev/null @@ -1,62 +0,0 @@ -
- About-The purpose of the command injection attack is to inject and execute commands specified by the attacker in the vulnerable application. - In situation like this, the application, which executes unwanted system commands, is like a pseudo system shell, and the attacker may use it - as any authorized system user. However, commands are executed with the same privileges and environment as the web service has. - -Command injection attacks are possible in most cases because of lack of correct input data validation, which can be manipulated by the attacker - (forms, cookies, HTTP headers etc.). - -The syntax and commands may differ between the Operating Systems (OS), such as Linux and Windows, depending on their desired actions. - -This attack may also be called "Remote Command Execution (RCE)". - -- - Objective-Remotely, find out the user of the web service on the OS, as well as the machines hostname via RCE. - -- - Low Level-This allows for direct input into one of many PHP functions that will execute commands on the OS. It is possible to escape out of the designed command and - executed unintentional actions. -This can be done by adding on to the request, "once the command has executed successfully, run this command". - Spoiler: To add a command "&&". Example: 127.0.0.1 && dir.- - - - Medium Level-The developer has read up on some of the issues with command injection, and placed in various pattern patching to filter the input. However, this isn't enough. -Various other system syntaxes can be used to break out of the desired command. -Spoiler: e.g. background the ping command.
-
- - - High Level-In the high level, the developer goes back to the drawing board and puts in even more pattern to match. But even this isn't enough. -The developer has either made a slight typo with the filters and believes a certain PHP command will save them from this mistake. -Spoiler:
- removes all leading & trailing spaces, right?.
-
- - - Impossible Level-In the impossible level, the challenge has been re-written, only to allow a very stricted input. If this doesn't match and doesn't produce a certain result, - it will not be allowed to execute. Rather than "black listing" filtering (allowing any input and removing unwanted), this uses "white listing" (only allow certain values). - |
-
Reference:
-{$cmd}";
-}
-
-?>
diff --git a/dvwa/vulnerabilities/exec/source/impossible.php b/dvwa/vulnerabilities/exec/source/impossible.php
deleted file mode 100644
index a2d405e..0000000
--- a/dvwa/vulnerabilities/exec/source/impossible.php
+++ /dev/null
@@ -1,41 +0,0 @@
-{$cmd}";
- }
- else {
- // Ops. Let the user name theres a mistake
- $html .= 'ERROR: You have entered an invalid IP.'; - } -} - -// Generate Anti-CSRF token -generateSessionToken(); - -?> diff --git a/dvwa/vulnerabilities/exec/source/low.php b/dvwa/vulnerabilities/exec/source/low.php deleted file mode 100644 index 121362f..0000000 --- a/dvwa/vulnerabilities/exec/source/low.php +++ /dev/null @@ -1,21 +0,0 @@ -{$cmd}"; -} - -?> diff --git a/dvwa/vulnerabilities/exec/source/medium.php b/dvwa/vulnerabilities/exec/source/medium.php deleted file mode 100644 index 99da211..0000000 --- a/dvwa/vulnerabilities/exec/source/medium.php +++ /dev/null @@ -1,30 +0,0 @@ - '', - ';' => '', - ); - - // Remove any of the charactars in the array (blacklist). - $target = str_replace( array_keys( $substitutions ), $substitutions, $target ); - - // Determine OS and execute the ping command. - if( stristr( php_uname( 's' ), 'Windows NT' ) ) { - // Windows - $cmd = shell_exec( 'ping ' . $target ); - } - else { - // *nix - $cmd = shell_exec( 'ping -c 4 ' . $target ); - } - - // Feedback for the end user - $html .= "
{$cmd}";
-}
-
-?>
diff --git a/dvwa/vulnerabilities/fi/file1.php b/dvwa/vulnerabilities/fi/file1.php
deleted file mode 100644
index 7514461..0000000
--- a/dvwa/vulnerabilities/fi/file1.php
+++ /dev/null
@@ -1,21 +0,0 @@
-
-
- About-Some web applications allow the user to specify input that is used directly into file streams or allows the user to upload files to the server. - At a later time the web application accesses the user supplied input in the web applications context. By doing this, the web application is allowing - the potential for malicious file execution. - -If the file chosen to be included is local on the target machine, it is called "Local File Inclusion (LFI). But files may also be included on other - machines, which then the attack is a "Remote File Inclusion (RFI). - -When RFI is not an option. using another vulnerability with LFI (such as file upload and directory traversal) can often achieve the same effect. - -Note, the term "file inclusion" is not the same as "arbitrary file access" or "file disclosure". - -- - Objective-Read all five famous quotes from '../hackable/flags/fi.php' using only the file inclusion. - -- - Low Level-This allows for direct input into one of many PHP functions that will include the content when executing. - -Depending on the web service configuration will depend if RFI is a possibility. -Spoiler: LFI: ?page=../../../../../../etc/passwd. - Spoiler: RFI: ?page=http://www.evilsite.com/evil.php.- - - - Medium Level-The developer has read up on some of the issues with LFI/RFI, and decided to filter the input. However, the patterns that are used, isn't enough. -Spoiler: LFI: Possible, due to it only cycling through the pattern matching once. - Spoiler: RFI: .- - - - High Level-The developer has had enough. They decided to only allow certain files to be used. However as there are multiple files with the same basename, - they use a wildcard to include them all. -Spoiler: LFI: The filename only has start with a certain value.. - Spoiler: RFI: Need to link in another vulnerability, such as file upload.- - - - Impossible Level-The developer calls it quits and hardcodes only the allowed pages, with there exact filenames. By doing this, it removes all avenues of attack. - |
-
Reference:
- -The attacks in this section are designed to help you learn about how JavaScript is used in the browser and how it can be manipulated. The attacks could be carried out by just analysing network traffic, but that isn't the point and it would also probably be a lot harder.
- -Simply submit the phrase "success" to win the level. Obviously, it isn't quite that easy, each level implements different protection mechanisms, the JavaScript included in the pages has to be analysed and then manipulated to bypass the protections.
- -All the JavaScript is included in the page. Read the source and work out what function is being used to generate the token required to match with the phrase and then call the function manually.
-Spoiler: Change the phrase to success and then use the function generate_token() to update the token.
-
- - The JavaScript has been broken out into its own file and then minimized. You need to view the source for the included file and then work out what it is doing. Both Firefox and Chrome have a Pretty Print feature which attempts to reverse the compression and display code in a readable way. -
-Spoiler: The file uses the setTimeout function to run the do_elsesomething function which generates the token.
-
- - The JavaScript has been obfuscated by at least one engine. You are going to need to step through the code to work out what is useful, what is garbage and what is needed to complete the mission. -
-Spoiler: If it helps, two packers have been used, the first is from Dan's Tools and the second is the JavaScript Obfuscator Tool.
- Spoiler 2: This deobfuscation tool seems to work the best on this code deobfuscate javascript.
- Spoiler 3: This is one way to do it... run the obfuscated JS through a deobfuscation app, intercept the response for the obfuscated JS and swap in the readable version. Work out the flow and you will see three functions that need to be called in order. Call the functions at the right time with the right parameters.
-
- You can never trust the user and have to assume that any code sent to the user can be manipulated or bypassed and so there is no impossible level.
- -Reference:
-Invalid token.
"; - } - break; - case 'medium': - if ($token == strrev("XXsuccessXX")) { - $message = "Well done!
"; - } else { - $message = "Invalid token.
"; - } - break; - case 'high': - if ($token == hash("sha256", hash("sha256", "XX" . strrev("success")) . "ZZ")) { - $message = "Well done!
"; - } else { - $message = "Invalid token.
"; - } - break; - default: - $vulnerabilityFile = 'impossible.php'; - break; - } - } else { - $message = "You got the phrase wrong.
"; - } - } else { - $message = "Missing phrase or token.
"; - } -} - -if ( $_COOKIE[ 'security' ] == "impossible" ) { -$page[ 'body' ] = <<- You can never trust anything that comes from the user or prevent them from messing with it and so there is no impossible level. -
-EOF; -} else { -$page[ 'body' ] = <<- Submit the word "success" to win. -
- - $message - - -EOF; -} - -require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/javascript/source/{$vulnerabilityFile}"; - -$page[ 'body' ] .= <<Module developed by Digininja.
-
- About-A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. - A successful SQL injection exploit can read sensitive data from the database, modify database data (insert/update/delete), execute administration operations on the database - (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system (load_file) and in some cases issue commands to the operating system. - -SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands. - -This attack may also be called "SQLi". - -- - Objective-There are 5 users in the database, with id's from 1 to 5. Your mission... to steal their passwords via SQLi. - -- - Low Level-The SQL query uses RAW input that is directly controlled by the attacker. All they need to-do is escape the query and then they are able - to execute any SQL query they wish. -Spoiler: ?id=a' UNION SELECT "text1","text2";-- -&Submit=Submit.
-
- - - Medium Level-The medium level uses a form of SQL injection protection, with the function of - "". - However due to the SQL query not having quotes around the parameter, this will not fully protect the query from being altered. - -The text box has been replaced with a pre-defined dropdown list and uses POST to submit the form. -Spoiler: ?id=a UNION SELECT 1,2;-- -&Submit=Submit.
-
- - - High Level-This is very similar to the low level, however this time the attacker is inputting the value in a different manner. - The input values are being transferred to the vulnerable query via session variables using another page, rather than a direct GET request. -Spoiler: ID: a' UNION SELECT "text1","text2";-- -&Submit=Submit.
-
- - - Impossible Level-The queries are now parameterized queries (rather than being dynamic). This means the query has been defined by the developer, - and has distinguish which sections are code, and the rest is data. - |
-
Reference:
-ID: {$id}
First name: {$first}
Surname: {$last}";
- }
-
- ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
-}
-
-?>
diff --git a/dvwa/vulnerabilities/sqli/source/impossible.php b/dvwa/vulnerabilities/sqli/source/impossible.php
deleted file mode 100644
index 41e57c1..0000000
--- a/dvwa/vulnerabilities/sqli/source/impossible.php
+++ /dev/null
@@ -1,33 +0,0 @@
-prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' );
- $data->bindParam( ':id', $id, PDO::PARAM_INT );
- $data->execute();
- $row = $data->fetch();
-
- // Make sure only 1 result is returned
- if( $data->rowCount() == 1 ) {
- // Get values
- $first = $row[ 'first_name' ];
- $last = $row[ 'last_name' ];
-
- // Feedback for end user
- $html .= "ID: {$id}
First name: {$first}
Surname: {$last}";
- }
- }
-}
-
-// Generate Anti-CSRF token
-generateSessionToken();
-
-?>
diff --git a/dvwa/vulnerabilities/sqli/source/low.php b/dvwa/vulnerabilities/sqli/source/low.php
deleted file mode 100644
index 6b7d364..0000000
--- a/dvwa/vulnerabilities/sqli/source/low.php
+++ /dev/null
@@ -1,24 +0,0 @@
-' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '' );
-
- // Get results
- while( $row = mysqli_fetch_assoc( $result ) ) {
- // Get values
- $first = $row["first_name"];
- $last = $row["last_name"];
-
- // Feedback for end user
- $html .= "ID: {$id}
First name: {$first}
Surname: {$last}";
- }
-
- mysqli_close($GLOBALS["___mysqli_ston"]);
-}
-
-?>
diff --git a/dvwa/vulnerabilities/sqli/source/medium.php b/dvwa/vulnerabilities/sqli/source/medium.php
deleted file mode 100644
index 16f0752..0000000
--- a/dvwa/vulnerabilities/sqli/source/medium.php
+++ /dev/null
@@ -1,31 +0,0 @@
-' . mysqli_error($GLOBALS["___mysqli_ston"]) . '' );
-
- // Get results
- while( $row = mysqli_fetch_assoc( $result ) ) {
- // Display values
- $first = $row["first_name"];
- $last = $row["last_name"];
-
- // Feedback for end user
- $html .= "ID: {$id}
First name: {$first}
Surname: {$last}";
- }
-
-}
-
-// This is used later on in the index.php page
-// Setting it here so we can close the database connection in here like in the rest of the source scripts
-$query = "SELECT COUNT(*) FROM users;";
-$result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '' ); -$number_of_rows = mysqli_fetch_row( $result )[0]; - -mysqli_close($GLOBALS["___mysqli_ston"]); -?> diff --git a/dvwa/vulnerabilities/sqli_blind/cookie-input.php b/dvwa/vulnerabilities/sqli_blind/cookie-input.php deleted file mode 100644 index 5e31aa2..0000000 --- a/dvwa/vulnerabilities/sqli_blind/cookie-input.php +++ /dev/null @@ -1,31 +0,0 @@ -
- About-When an attacker executes SQL injection attacks, sometimes the server responds with error messages from the database server complaining that the SQL query's syntax is incorrect. - Blind SQL injection is identical to normal SQL Injection except that when an attacker attempts to exploit an application, rather then getting a useful error message, - they get a generic page specified by the developer instead. This makes exploiting a potential SQL Injection attack more difficult but not impossible. - An attacker can still steal data by asking a series of True and False questions through SQL statements, and monitoring how the web application response - (valid entry retunred or 404 header set). - -"time based" injection method is often used when there is no visible feedback in how the page different in its response (hence its a blind attack). - This means the attacker will wait to see how long the page takes to response back. If it takes longer than normal, their query was successful. - -- - Objective-Find the version of the SQL database software through a blind SQL attack. - -- - Low Level-The SQL query uses RAW input that is directly controlled by the attacker. All they need to-do is escape the query and then they are able - to execute any SQL query they wish. -Spoiler: ?id=1' AND sleep 5&Submit=Submit.
-
- - - Medium Level-The medium level uses a form of SQL injection protection, with the function of - "". - However due to the SQL query not having quotes around the parameter, this will not fully protect the query from being altered. - -The text box has been replaced with a pre-defined dropdown list and uses POST to submit the form. -Spoiler: ?id=1 AND sleep 3&Submit=Submit.
-
- - - High Level-This is very similar to the low level, however this time the attacker is inputting the value in a different manner. - The input values are being set on a different page, rather than a GET request. -Spoiler: ID: 1' AND sleep 10&Submit=Submit. - Spoiler: Should be able to cut out the middle man..- - - - Impossible Level-The queries are now parameterized queries (rather than being dynamic). This means the query has been defined by the developer, - and has distinguish which sections are code, and the rest is data. - |
-
Reference:
-User ID exists in the database.'; - } - else { - // Might sleep a random amount - if( rand( 0, 5 ) == 3 ) { - sleep( rand( 2, 4 ) ); - } - - // User wasn't found, so the page wasn't! - header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); - - // Feedback for end user - $html .= '
User ID is MISSING from the database.'; - } - - ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); -} - -?> diff --git a/dvwa/vulnerabilities/sqli_blind/source/impossible.php b/dvwa/vulnerabilities/sqli_blind/source/impossible.php deleted file mode 100644 index 25cb7cf..0000000 --- a/dvwa/vulnerabilities/sqli_blind/source/impossible.php +++ /dev/null @@ -1,35 +0,0 @@ -prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' ); - $data->bindParam( ':id', $id, PDO::PARAM_INT ); - $data->execute(); - - // Get results - if( $data->rowCount() == 1 ) { - // Feedback for end user - $html .= '
User ID exists in the database.'; - } - else { - // User wasn't found, so the page wasn't! - header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); - - // Feedback for end user - $html .= '
User ID is MISSING from the database.'; - } - } -} - -// Generate Anti-CSRF token -generateSessionToken(); - -?> diff --git a/dvwa/vulnerabilities/sqli_blind/source/low.php b/dvwa/vulnerabilities/sqli_blind/source/low.php deleted file mode 100644 index c933ef6..0000000 --- a/dvwa/vulnerabilities/sqli_blind/source/low.php +++ /dev/null @@ -1,28 +0,0 @@ - 0 ) { - // Feedback for end user - $html .= '
User ID exists in the database.'; - } - else { - // User wasn't found, so the page wasn't! - header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); - - // Feedback for end user - $html .= '
User ID is MISSING from the database.'; - } - - ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); -} - -?> diff --git a/dvwa/vulnerabilities/sqli_blind/source/medium.php b/dvwa/vulnerabilities/sqli_blind/source/medium.php deleted file mode 100644 index c49e725..0000000 --- a/dvwa/vulnerabilities/sqli_blind/source/medium.php +++ /dev/null @@ -1,26 +0,0 @@ - 0 ) { - // Feedback for end user - $html .= '
User ID exists in the database.'; - } - else { - // Feedback for end user - $html .= '
User ID is MISSING from the database.'; - } - - //mysql_close(); -} - -?> diff --git a/dvwa/vulnerabilities/upload/help/help.php b/dvwa/vulnerabilities/upload/help/help.php deleted file mode 100644 index 997d947..0000000 --- a/dvwa/vulnerabilities/upload/help/help.php +++ /dev/null @@ -1,54 +0,0 @@ -
- About-Uploaded files represent a significant risk to web applications. The first step in many attacks is to get some code to the system to be attacked. - Then the attacker only needs to find a way to get the code executed. Using a file upload helps the attacker accomplish the first step. - -The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system, forwarding attacks to backend systems, - and simple defacement. It depends on what the application does with the uploaded file, including where it is stored. - -- - Objective-Execute any PHP function of your choosing on the target system (such as - or ) thanks to this file upload vulnerability. - -- - Low Level-Low level will not check the contents of the file being uploaded in any way. It relies only on trust. -Spoiler: Upload any valid PHP file with command in it.
-
- - - Medium Level-When using the medium level, it will check the reported file type from the client when its being uploaded. -Spoiler: Worth looking for any restrictions within any "hidden" form fields.
-
- - - High Level-Once the file has been received from the client, the server will try to resize any image that was included in the request. -Spoiler: need to link in another vulnerability, such as file inclusion.
-
- - - Impossible Level-This will check everything from all the levels so far, as well then to re-encode the image. This will make a new image, therefor stripping - any "non-image" code (including metadata). - |
-
Reference:
-{$target_path} succesfully uploaded!";
- }
- }
- else {
- // Invalid file
- $html .= 'Your image was not uploaded. We can only accept JPEG or PNG images.'; - } -} - -?> diff --git a/dvwa/vulnerabilities/upload/source/impossible.php b/dvwa/vulnerabilities/upload/source/impossible.php deleted file mode 100644 index bea2037..0000000 --- a/dvwa/vulnerabilities/upload/source/impossible.php +++ /dev/null @@ -1,62 +0,0 @@ -${target_file} succesfully uploaded!"; - } - else { - // No - $html .= '
Your image was not uploaded.'; - } - - // Delete any temp files - if( file_exists( $temp_file ) ) - unlink( $temp_file ); - } - else { - // Invalid file - $html .= '
Your image was not uploaded. We can only accept JPEG or PNG images.'; - } -} - -// Generate Anti-CSRF token -generateSessionToken(); - -?> diff --git a/dvwa/vulnerabilities/upload/source/low.php b/dvwa/vulnerabilities/upload/source/low.php deleted file mode 100644 index 904403b..0000000 --- a/dvwa/vulnerabilities/upload/source/low.php +++ /dev/null @@ -1,19 +0,0 @@ -Your image was not uploaded.'; - } - else { - // Yes! - $html .= "
{$target_path} succesfully uploaded!";
- }
-}
-
-?>
diff --git a/dvwa/vulnerabilities/upload/source/medium.php b/dvwa/vulnerabilities/upload/source/medium.php
deleted file mode 100644
index 66f3bc8..0000000
--- a/dvwa/vulnerabilities/upload/source/medium.php
+++ /dev/null
@@ -1,33 +0,0 @@
-Your image was not uploaded.';
- }
- else {
- // Yes!
- $html .= "{$target_path} succesfully uploaded!";
- }
- }
- else {
- // Invalid file
- $html .= 'Your image was not uploaded. We can only accept JPEG or PNG images.'; - } -} - -?> diff --git a/dvwa/vulnerabilities/view_help.php b/dvwa/vulnerabilities/view_help.php deleted file mode 100644 index 2a6e141..0000000 --- a/dvwa/vulnerabilities/view_help.php +++ /dev/null @@ -1,26 +0,0 @@ -' . file_get_contents( DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/{$id}/help/help.php" ) . ' - {$help} -
" . highlight_string( $js_source, true ) . " |
-
" . highlight_string( $source, true ) . " |
-
{$impsrc} |
-
{$highsrc} |
-
{$medsrc} |
-
{$lowsrc} |
-
- About-Knowledge of a session ID is often the only thing required to access a site as a specific user after they have logged in, if that session ID is able to be calculated or easily guessed, then an attacker will have an easy way to gain access to user accounts without having to brute force passwords or find other vulnerabilities such as Cross-Site Scripting. - -- - Objective-This module uses four different ways to set the dvwaSession cookie value, the objective of each level is to work out how the ID is generated and then infer the IDs of other system users. - -- - Low Level-The cookie value should be very obviously predictable. - -Medium Level-The value looks a little more random than on low but if you collect a few you should start to see a pattern. - -High Level-First work out what format the value is in and then try to work out what is being used as the input to generate the values. -Extra flags are also being added to the cookie, this does not affect the challenge but highlights extra protections that can be added to protect the cookies. - - -Impossible Level-The cookie value should not be predictable at this level but feel free to try. -As well as the extra flags, the cookie is being tied to the domain and the path of the challenge. - |
-
Reference:
-
- This page will set a new cookie called dvwaSession each time the button is clicked.
-
- About-"Cross-Site Scripting (XSS)" attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites. - XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, - to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application using input from a user in the output, - without validating or encoding it. - -An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browser has no way to know that the script should not be trusted, - and will execute the JavaScript. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other - sensitive information retained by your browser and used with that site. These scripts can even rewrite the content of the HTML page. - -DOM Based XSS is a special case of reflected where the JavaScript is hidden in the URL and pulled out by JavaScript in the page while it is rendering rather than being embedded in the page when it is served. This can make it stealthier than other attacks and WAFs or other protections which are reading the page body do not see any malicious content. - -- - Objective-Run your own JavaScript in another user's browser, use this to steal the cookie of a logged in user. - -- - Low Level-Low level will not check the requested input, before including it to be used in the output text. -Spoiler: alert(1)")?>.
-
- Medium Level-The developer has tried to add a simple pattern matching to remove any references to "<script" to disable any JavaScript. Find a way to run JavaScript without using the script tags. -Spoiler: You must first break out of the select block then you can add an image with an onerror event:
-
- High Level-The developer is now white listing only the allowed languages, you must find a way to run your code without it going to the server. -Spoiler: The fragment section of a URL (anything after the # symbol) does not get sent to the server and so cannot be blocked. The bad JavaScript being used to render the page reads the content from it when creating the page.
-
- Impossible Level-The contents taken from the URL are encoded by default by most browsers which prevents any injected JavaScript from being executed. - |
-
Reference:
-Please choose a language:
- - -
- About-"Cross-Site Scripting (XSS)" attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites. - XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, - to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application using input from a user in the output, - without validating or encoding it. - -An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browser has no way to know that the script should not be trusted, - and will execute the JavaScript. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other - sensitive information retained by your browser and used with that site. These scripts can even rewrite the content of the HTML page. - -Because its a reflected XSS, the malicious code is not stored in the remote web application, so requires some social engineering (such as a link via email/chat). - -- - Objective-One way or another, steal the cookie of a logged in user. - -- - Low Level-Low level will not check the requested input, before including it to be used in the output text. -Spoiler: ?name=<script>alert("XSS");</script>.
-
- - - Medium Level-The developer has tried to add a simple pattern matching to remove any references to "<script>", to disable any JavaScript. -Spoiler: Its cAse sENSiTiVE.
-
- - - High Level-The developer now believes they can disable all JavaScript by removing the pattern "<s*c*r*i*p*t". -Spoiler: HTML events.
-
- - - Impossible Level-Using inbuilt PHP functions (such as ""), - its possible to escape any values which would alter the behaviour of the input. - |
-
Reference:
-Hello ${name}";
-}
-
-?>
diff --git a/dvwa/vulnerabilities/xss_s/help/help.php b/dvwa/vulnerabilities/xss_s/help/help.php
deleted file mode 100644
index 339a949..0000000
--- a/dvwa/vulnerabilities/xss_s/help/help.php
+++ /dev/null
@@ -1,56 +0,0 @@
-
- "Cross-Site Scripting (XSS)" attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites. - XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, - to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application using input from a user in the output, - without validating or encoding it. - -An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browser has no way to know that the script should not be trusted, - and will execute the JavaScript. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other - sensitive information retained by your browser and used with that site. These scripts can even rewrite the content of the HTML page. - -The XSS is stored in the database. The XSS is permanent, until the database is reset or the payload is manually deleted. - -- - Objective-Redirect everyone to a web page of your choosing. - -- - Low Level-Low level will not check the requested input, before including it to be used in the output text. -Spoiler: Either name or message field: <script>alert("XSS");</script>.
-
- - - Medium Level-The developer had added some protection, however hasn't done every field the same way. -Spoiler: name field: <sCriPt>alert("XSS");</sCriPt>.
-
- - - High Level-The developer believe they have disabled all script usage by removing the pattern "<s*c*r*i*p*t". -Spoiler: HTML events.
-
- - - Impossible Level-Using inbuilt PHP functions (such as ""), - its possible to escape any values which would alter the behaviour of the input. - |
-
Reference:
-' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '' ); - - //mysql_close(); -} - -?>