PHPIDS
Current file: /home/lstrojny/Projekte/php-ids/trunk/lib/IDS/Converter.php
Legend: executed not executed dead code

  Coverage
  Classes Methods Lines
Total
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 18 / 18
85.57 %85.57%
85.57% 249 / 291
 
IDS_Converter
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 18 / 18
85.57 %85.57%
85.57% 249 / 291
 public static function runAll($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 6 / 6
 public static function convertFromCommented($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 11 / 11
 public static function convertFromNewLines($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 3 / 3
 public static function convertFromJSCharcode($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 51 / 51
 public static function convertJSRegexModifiers($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 2 / 2
 public static function convertEntities($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 7 / 7
 public static function convertQuotes($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 3 / 3
 public static function convertFromSQLHex($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 13 / 13
 public static function convertFromSQLKeywords($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 14 / 14
 public static function convertFromControlChars($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 19 / 19
 public static function convertFromNestedBase64($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 10 / 10
 public static function convertFromOutOfRangeChars($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 7 / 7
 public static function convertFromXML($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 4 / 4
 public static function convertFromJSUnicode($value)
100.00 %100.00%
100.00% 1 / 1
36.36 %36.36%
36.36% 4 / 11
 public static function convertFromUTF7($value)
100.00 %100.00%
100.00% 1 / 1
17.50 %17.50%
17.50% 7 / 40
 public static function convertConcatenations($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 28 / 28
 public static function convertFromProprietaryEncodings($value)
100.00 %100.00%
100.00% 1 / 1
100.00 %100.00%
100.00% 13 / 13
 public static function runCentrifuge($value, IDS_Monitor $monitor = NULL)
100.00 %100.00%
100.00% 1 / 1
95.83 %95.83%
95.83% 46 / 48


       1                 : <?php                                                                                   
       2                 :                                                                                         
       3                 : /**                                                                                     
       4                 :  * PHPIDS                                                                               
       5                 :  *                                                                                      
       6                 :  * Requirements: PHP5, SimpleXML                                                        
       7                 :  *                                                                                      
       8                 :  * Copyright (c) 2008 PHPIDS group (http://php-ids.org)                                 
       9                 :  *                                                                                      
      10                 :  * PHPIDS is free software; you can redistribute it and/or modify                       
      11                 :  * it under the terms of the GNU Lesser General Public License as published by          
      12                 :  * the Free Software Foundation, version 3 of the License, or                           
      13                 :  * (at your option) any later version.                                                  
      14                 :  *                                                                                      
      15                 :  * PHPIDS is distributed in the hope that it will be useful,                            
      16                 :  * but WITHOUT ANY WARRANTY; without even the implied warranty of                       
      17                 :  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the                         
      18                 :  * GNU Lesser General Public License for more details.                                  
      19                 :  *                                                                                      
      20                 :  * You should have received a copy of the GNU Lesser General Public License             
      21                 :  * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.                       
      22                 :  *                                                                                      
      23                 :  * PHP version 5.1.6+                                                                   
      24                 :  *                                                                                      
      25                 :  * @category Security                                                                   
      26                 :  * @package  PHPIDS                                                                     
      27                 :  * @author   Mario Heiderich <mario.heiderich@gmail.com>                                
      28                 :  * @author   Christian Matthies <ch0012@gmail.com>                                      
      29                 :  * @author   Lars Strojny <lars@strojny.net>                                            
      30                 :  * @license  http://www.gnu.org/licenses/lgpl.html LGPL                                 
      31                 :  * @link     http://php-ids.org/                                                        
      32                 :  */                                                                                     
      33                 :                                                                                         
      34                 : /**                                                                                     
      35                 :  * PHPIDS specific utility class to convert charsets manually                           
      36                 :  *                                                                                      
      37                 :  * Note that if you make use of IDS_Converter::runAll(), existing class                 
      38                 :  * methods will be executed in the same order as they are implemented in the            
      39                 :  * class tree!                                                                          
      40                 :  *                                                                                      
      41                 :  * @category  Security                                                                  
      42                 :  * @package   PHPIDS                                                                    
      43                 :  * @author    Christian Matthies <ch0012@gmail.com>                                     
      44                 :  * @author    Mario Heiderich <mario.heiderich@gmail.com>                               
      45                 :  * @author    Lars Strojny <lars@strojny.net>                                           
      46                 :  * @copyright 2007 The PHPIDS Group                                                     
      47                 :  * @license   http://www.gnu.org/licenses/lgpl.html LGPL                                
      48                 :  * @version   Release: $Id:Converter.php 517 2007-09-15 15:04:13Z mario $               
      49                 :  * @link      http://php-ids.org/                                                       
      50                 :  */                                                                                     
      51                 : class IDS_Converter                                                                     
      52               1 : {                                                                                       
      53                 :     /**                                                                                 
      54                 :      * Runs all converter functions                                                     
      55                 :      *                                                                                  
      56                 :      * Note that if you make use of IDS_Converter::runAll(), existing class             
      57                 :      * methods will be executed in the same order as they are implemented in the        
      58                 :      * class tree!                                                                      
      59                 :      *                                                                                  
      60                 :      * @param string $value the value to convert                                        
      61                 :      *                                                                                  
      62                 :      * @static                                                                          
      63                 :      * @return string                                                                   
      64                 :      */                                                                                 
      65                 :     public static function runAll($value)                                               
      66                 :     {                                                                                   
      67              35 :         foreach (get_class_methods(__CLASS__) as $method) {                             
      68                 :                                                                                         
      69              35 :             if (strpos($method, 'run') === 0) {                                         
      70              35 :                 continue;                                                               
      71                 :             }                                                                           
      72              35 :             $value = self::$method($value);                                             
      73              35 :         }                                                                               
      74                 :                                                                                         
      75              35 :         return $value;                                                                  
      76                 :     }                                                                                   
      77                 :                                                                                         
      78                 :     /**                                                                                 
      79                 :      * Check for comments and erases them if available                                  
      80                 :      *                                                                                  
      81                 :      * @param string $value the value to convert                                        
      82                 :      *                                                                                  
      83                 :      * @static                                                                          
      84                 :      * @return string                                                                   
      85                 :      */                                                                                 
      86                 :     public static function convertFromCommented($value)                                 
      87                 :     {                                                                                   
      88                 :         // check for existing comments                                                  
      89              35 :         if (preg_match('/(?:\<!-|-->|\/\*|\*\/|\/\/\W*\w+\s*$)|' .                      
      90              35 :             '(?:--[^-]*-)/ms', $value)) {                                               
      91                 :                                                                                         
      92                 :             $pattern = array(                                                           
      93               8 :                 '/(?:(?:<!)(?:(?:--(?:[^-]*(?:-[^-]+)*)--\s*)*)(?:>))/ms',              
      94               8 :                 '/(?:(?:\/\*\/*[^\/\*]*)+\*\/)/ms',                                     
      95                 :                 '/(?:--[^-]*-)/ms'                                                      
      96               8 :             );                                                                          
      97                 :                                                                                         
      98               8 :             $converted = preg_replace($pattern, ';', $value);                           
      99               8 :             $value    .= "\n" . $converted;                                             
     100               8 :         }                                                                               
     101                 :         //make sure inline comments are detected and converted correctly                
     102              35 :         $value = preg_replace('/(<\w+)\/+(\w+=?)/m', '$1/$2', $value);                  
     103              35 :         $value = preg_replace('/[^\\\:]\/\/(.*)$/m', '/**/$1', $value);                 
     104                 :                                                                                         
     105              35 :         return $value;                                                                  
     106                 :     }                                                                                   
     107                 :                                                                                         
     108                 :     /**                                                                                 
     109                 :      * Strip newlines                                                                   
     110                 :      *                                                                                  
     111                 :      * @param string $value the value to convert                                        
     112                 :      *                                                                                  
     113                 :      * @static                                                                          
     114                 :      * @return string                                                                   
     115                 :      */                                                                                 
     116                 :     public static function convertFromNewLines($value)                                  
     117                 :     {                                                                                   
     118                 :         //check for inline linebreaks                                                   
     119              35 :         $search = array('\r', '\n', '\f', '\t', '\v');                                  
     120              35 :         $value  = str_replace($search, ';', $value);                                    
     121                 :                                                                                         
     122                 :         //convert real linebreaks                                                       
     123              35 :         return preg_replace('/(?:\n|\r|\v)/m', '  ', $value);                           
     124                 :     }                                                                                   
     125                 :                                                                                         
     126                 :     /**                                                                                 
     127                 :      * Checks for common charcode pattern and decodes them                              
     128                 :      *                                                                                  
     129                 :      * @param string $value the value to convert                                        
     130                 :      *                                                                                  
     131                 :      * @static                                                                          
     132                 :      * @return string                                                                   
     133                 :      */                                                                                 
     134                 :     public static function convertFromJSCharcode($value)                                
     135                 :     {                                                                                   
     136              35 :         $matches = array();                                                             
     137                 :                                                                                         
     138                 :         // check if value matches typical charCode pattern                              
     139              35 :         if (preg_match_all('/(?:[\d+-=\/\* ]+(?:\s?,\s?[\d+-=\/\* ]+)){4,}/ms',         
     140              35 :             $value, $matches)) {                                                        
     141                 :                                                                                         
     142               1 :             $converted = '';                                                            
     143               1 :             $string    = implode(',', $matches[0]);                                     
     144               1 :             $string    = preg_replace('/\s/', '', $string);                             
     145               1 :             $string    = preg_replace('/\w+=/', '', $string);                           
     146               1 :             $charcode  = explode(',', $string);                                         
     147                 :                                                                                         
     148               1 :             foreach ($charcode as $char) {                                              
     149               1 :                 $char = preg_replace('/\W0/s', '', $char);                              
     150                 :                                                                                         
     151               1 :                 if (preg_match_all('/\d*[+-\/\* ]\d+/', $char, $matches)) {             
     152               1 :                     $match = preg_split('/(\W?\d+)/',                                   
     153               1 :                                         (implode('', $matches[0])),                     
     154               1 :                                         null,                                           
     155               1 :                                         PREG_SPLIT_DELIM_CAPTURE);                      
     156                 :                                                                                         
     157               1 :                     if (array_sum($match) >= 20 && array_sum($match) <= 127) {          
     158               1 :                         $converted .= chr(array_sum($match));                           
     159               1 :                     }                                                                   
     160                 :                                                                                         
     161               1 :                 } elseif (!empty($char) && $char >= 20 && $char <= 127) {               
     162               1 :                     $converted .= chr($char);                                           
     163               1 :                 }                                                                       
     164               1 :             }                                                                           
     165                 :                                                                                         
     166               1 :             $value .= "\n" . $converted;                                                
     167               1 :         }                                                                               
     168                 :                                                                                         
     169                 :         // check for octal charcode pattern                                             
     170              35 :         if (preg_match_all('/(?:(?:[\\\]+\d+[ \t]*){8,})/ims', $value, $matches)) {     
     171                 :                                                                                         
     172               1 :             $converted = '';                                                            
     173               1 :             $charcode  = explode('\\', preg_replace('/\s/', '', implode(',',            
     174               1 :                 $matches[0])));                                                         
     175                 :                                                                                         
     176               1 :             foreach ($charcode as $char) {                                              
     177               1 :                 if (!empty($char)) {                                                    
     178               1 :                     if (octdec($char) >= 20 && octdec($char) <= 127) {                  
     179               1 :                         $converted .= chr(octdec($char));                               
     180               1 :                     }                                                                   
     181               1 :                 }                                                                       
     182               1 :             }                                                                           
     183               1 :             $value .= "\n" . $converted;                                                
     184               1 :         }                                                                               
     185                 :                                                                                         
     186                 :         // check for hexadecimal charcode pattern                                       
     187              35 :         if (preg_match_all('/(?:(?:[\\\]+\w+\s*){8,})/ims', $value, $matches)) {        
     188                 :                                                                                         
     189               2 :             $converted = '';                                                            
     190               2 :             $charcode  = explode('\\', preg_replace('/[ux]/', '', implode(',',          
     191               2 :                 $matches[0])));                                                         
     192                 :                                                                                         
     193               2 :             foreach ($charcode as $char) {                                              
     194               2 :                 if (!empty($char)) {                                                    
     195               2 :                     if (hexdec($char) >= 20 && hexdec($char) <= 127) {                  
     196               2 :                         $converted .= chr(hexdec($char));                               
     197               2 :                     }                                                                   
     198               2 :                 }                                                                       
     199               2 :             }                                                                           
     200               2 :             $value .= "\n" . $converted;                                                
     201               2 :         }                                                                               
     202                 :                                                                                         
     203              35 :         return $value;                                                                  
     204                 :     }                                                                                   
     205                 :                                                                                         
     206                 :     /**                                                                                 
     207                 :      * Eliminate JS regex modifiers                                                     
     208                 :      *                                                                                  
     209                 :      * @param string $value the value to convert                                        
     210                 :      *                                                                                  
     211                 :      * @static                                                                          
     212                 :      * @return string                                                                   
     213                 :      */                                                                                 
     214                 :     public static function convertJSRegexModifiers($value)                              
     215                 :     {                                                                                   
     216              35 :         $value = preg_replace('/\/[gim]/', '/', $value);                                
     217                 :                                                                                         
     218              35 :         return $value;                                                                  
     219                 :     }                                                                                   
     220                 :                                                                                         
     221                 :     /**                                                                                 
     222                 :      * Converts from hex/dec entities                                                   
     223                 :      *                                                                                  
     224                 :      * @param string $value the value to convert                                        
     225                 :      *                                                                                  
     226                 :      * @static                                                                          
     227                 :      * @return string                                                                   
     228                 :      */                                                                                 
     229                 :     public static function convertEntities($value)                                      
     230                 :     {                                                                                   
     231              35 :         $converted = null;                                                              
     232              35 :         if (preg_match('/&#x?[\w]+/ms', $value)) {                                      
     233               6 :             $converted = preg_replace('/(&#x?[\w]{2}\d?);?/ms', '$1;', $value);         
     234               6 :             $converted = html_entity_decode($converted, ENT_QUOTES, 'UTF-8');           
     235               6 :             $value    .= "\n" . str_replace(';;', ';', $converted);                     
     236               6 :         }                                                                               
     237                 :                                                                                         
     238              35 :         return $value;                                                                  
     239                 :     }                                                                                   
     240                 :                                                                                         
     241                 :     /**                                                                                 
     242                 :      * Normalize quotes                                                                 
     243                 :      *                                                                                  
     244                 :      * @param string $value the value to convert                                        
     245                 :      *                                                                                  
     246                 :      * @static                                                                          
     247                 :      * @return string                                                                   
     248                 :      */                                                                                 
     249                 :     public static function convertQuotes($value)                                        
     250                 :     {                                                                                   
     251                 :         // normalize different quotes to "                                              
     252              35 :         $pattern = array('\'', '`', '´', '’', '‘');                                
     253              35 :         $value   = str_replace($pattern, '"', $value);                                  
     254                 :                                                                                         
     255              35 :         return $value;                                                                  
     256                 :     }                                                                                   
     257                 :                                                                                         
     258                 :     /**                                                                                 
     259                 :      * Converts SQLHEX to plain text                                                    
     260                 :      *                                                                                  
     261                 :      * @param string $value the value to convert                                        
     262                 :      *                                                                                  
     263                 :      * @static                                                                          
     264                 :      * @return string                                                                   
     265                 :      */                                                                                 
     266                 :     public static function convertFromSQLHex($value)                                    
     267                 :     {                                                                                   
     268              35 :         $matches = array();                                                             
     269              35 :         if(preg_match_all('/(?:0x[a-f\d]{2,}[a-f\d\s]*)+/im', $value, $matches)) {      
     270               3 :             foreach($matches[0] as $match) {                                            
     271               3 :                 $converted = '';                                                        
     272               3 :                 foreach(str_split($match, 2) as $hex_index) {                           
     273               3 :                     if(preg_match('/[a-f\d]{2,3}/i', $hex_index)) {                     
     274               3 :                       $converted .= chr(hexdec($hex_index));                            
     275               3 :                     }                                                                   
     276               3 :                 }                                                                       
     277               3 :                 $value = str_replace($match, $converted, $value);                       
     278               3 :             }                                                                           
     279               3 :         }                                                                               
     280              35 :         return $value;                                                                  
     281                 :     }                                                                                   
     282                 :                                                                                         
     283                 :     /**                                                                                 
     284                 :      * Converts basic SQL keywords and obfuscations                                     
     285                 :      *                                                                                  
     286                 :      * @param string $value the value to convert                                        
     287                 :      *                                                                                  
     288                 :      * @static                                                                          
     289                 :      * @return string                                                                   
     290                 :      */                                                                                 
     291                 :     public static function convertFromSQLKeywords($value)                               
     292                 :     {                                                                                   
     293                 :         $pattern = array('/(?:IS\s+null)|(LIKE\s+null)|' .                              
     294              35 :             '(?:(?:^|\W)IN[+\s]*\([\s\d"]+[^()]*\))/ims');                              
     295              35 :         $value   = preg_replace($pattern, '"=0', $value);                               
     296              35 :         $value   = preg_replace('/null,/ims', ',0', $value);                            
     297              35 :         $value   = preg_replace('/,null/ims', ',0', $value);                            
     298                 :         $pattern = array('/[^\w,]NULL|\\\N|TRUE|FALSE|UTC_TIME|' .                      
     299              35 :                          'LOCALTIME(?:STAMP)?|CURRENT_\w+|BINARY|' .                    
     300              35 :                          '(?:(?:ASCII|SOUNDEX|' .                                       
     301              35 :                          'MD5|R?LIKE)[+\s]*\([^()]+\))|(?:-+\d)/ims');                  
     302              35 :         $value   = preg_replace($pattern, 0, $value);                                   
     303                 :         $pattern = array('/(?:NOT\s+BETWEEN)|(?:IS\s+NOT)|(?:NOT\s+IN)|' .              
     304              35 :                          '(?:XOR|\WDIV\W|\WNOT\W|<>|RLIKE(?:\s+BINARY)?)|' .            
     305              35 :                          '(?:REGEXP\s+BINARY)|' .                                       
     306              35 :                          '(?:SOUNDS\s+LIKE)/ims');                                      
     307              35 :         $value   = preg_replace($pattern, '!', $value);                                 
     308              35 :         $value   = preg_replace('/"\s+\d/', '"', $value);                               
     309                 :                                                                                         
     310              35 :         return $value;                                                                  
     311                 :     }                                                                                   
     312                 :                                                                                         
     313                 :     /**                                                                                 
     314                 :      * Detects nullbytes and controls chars via ord()                                   
     315                 :      *                                                                                  
     316                 :      * @param string $value the value to convert                                        
     317                 :      *                                                                                  
     318                 :      * @static                                                                          
     319                 :      * @return string                                                                   
     320                 :      */                                                                                 
     321                 :     public static function convertFromControlChars($value)                              
     322                 :     {                                                                                   
     323                 :         // critical ctrl values                                                         
     324              35 :         $search     = array(chr(0), chr(1), chr(2),                                     
     325              35 :                             chr(3), chr(4), chr(5),                                     
     326              35 :                             chr(6), chr(7), chr(8),                                     
     327              35 :                             chr(11), chr(12), chr(14),                                  
     328              35 :                             chr(15), chr(16), chr(17),                                  
     329              35 :                             chr(18), chr(19));                                          
     330              35 :         $value      = str_replace($search, '%00', $value);                              
     331              35 :         $urlencoded = urlencode($value);                                                
     332                 :                                                                                         
     333                 :         //take care for malicious unicode characters                                    
     334              35 :         $value = urldecode(preg_replace('/(?:%E(?:2|3)%8(?:0|1)%(?:A|8|9)' .            
     335              35 :             '\w|%EF%BB%BF|%EF%BF%BD)|(?:&#(?:65|8)\d{3};?)/i', null,                    
     336              35 :                 $urlencoded));                                                          
     337                 :                                                                                         
     338              35 :         $value = preg_replace('/(?:&[#x]*(200|820|200|820|zwn?j|lrm|rlm)\w?;?)/i', null,
     339              35 :                 $value);                                                                
     340                 :                                                                                         
     341              35 :         $value = preg_replace('/(?:&#(?:65|8)\d{3};?)|' .                               
     342              35 :                 '(?:&#(?:56|7)3\d{2};?)|' .                                             
     343              35 :                 '(?:&#x(?:fe|20)\w{2};?)|' .                                            
     344              35 :                 '(?:&#x(?:d[c-f])\w{2};?)/i', null,                                     
     345              35 :                 $value);                                                                
     346                 :                                                                                         
     347              35 :         return $value;                                                                  
     348                 :     }                                                                                   
     349                 :                                                                                         
     350                 :     /**                                                                                 
     351                 :      * This method matches and translates base64 strings and fragments                  
     352                 :      * used in data URIs                                                                
     353                 :      *                                                                                  
     354                 :      * @param string $value the value to convert                                        
     355                 :      *                                                                                  
     356                 :      * @static                                                                          
     357                 :      * @return string                                                                   
     358                 :      */                                                                                 
     359                 :     public static function convertFromNestedBase64($value)                              
     360                 :     {                                                                                   
     361              35 :         $matches = array();                                                             
     362              35 :         preg_match_all('/(?:^|[,&?])\s*([a-z0-9]{30,}=*)(?:\W|$)/im',                   
     363              35 :             $value,                                                                     
     364              35 :             $matches);                                                                  
     365                 :                                                                                         
     366              35 :         foreach ($matches[1] as $item) {                                                
     367               2 :             if (isset($item) && !preg_match('/[a-f0-9]{32}/i', $item)) {                
     368               2 :                 $value = str_replace($item, base64_decode($item), $value);              
     369               2 :             }                                                                           
     370              35 :         }                                                                               
     371                 :                                                                                         
     372              35 :         return $value;                                                                  
     373                 :     }                                                                                   
     374                 :                                                                                         
     375                 :     /**                                                                                 
     376                 :      * Detects nullbytes and controls chars via ord()                                   
     377                 :      *                                                                                  
     378                 :      * @param string $value the value to convert                                        
     379                 :      *                                                                                  
     380                 :      * @static                                                                          
     381                 :      * @return string                                                                   
     382                 :      */                                                                                 
     383                 :     public static function convertFromOutOfRangeChars($value)                           
     384                 :     {                                                                                   
     385              35 :         $values = str_split($value);                                                    
     386              35 :         foreach ($values as $item) {                                                    
     387              35 :             if (ord($item) >= 127) {                                                    
     388               8 :                 $value = str_replace($item, 'U', $value);                               
     389               8 :             }                                                                           
     390              35 :         }                                                                               
     391                 :                                                                                         
     392              35 :         return $value;                                                                  
     393                 :     }                                                                                   
     394                 :                                                                                         
     395                 :     /**                                                                                 
     396                 :      * Strip XML patterns                                                               
     397                 :      *                                                                                  
     398                 :      * @param string $value the value to convert                                        
     399                 :      *                                                                                  
     400                 :      * @static                                                                          
     401                 :      * @return string                                                                   
     402                 :      */                                                                                 
     403                 :     public static function convertFromXML($value)                                       
     404                 :     {                                                                                   
     405              35 :         $converted = strip_tags($value);                                                
     406                 :                                                                                         
     407              35 :         if ($converted && ($converted != $value)) {                                     
     408              24 :             return $value . "\n" . $converted;                                          
     409                 :         }                                                                               
     410              30 :         return $value;                                                                  
     411                 :     }                                                                                   
     412                 :                                                                                         
     413                 :     /**                                                                                 
     414                 :      * This method converts JS unicode code points to                                   
     415                 :      * regular characters                                                               
     416                 :      *                                                                                  
     417                 :      * @param string $value the value to convert                                        
     418                 :      *                                                                                  
     419                 :      * @static                                                                          
     420                 :      * @return string                                                                   
     421                 :      */                                                                                 
     422                 :     public static function convertFromJSUnicode($value)                                 
     423                 :     {                                                                                   
     424              35 :         $matches = array();                                                             
     425                 :                                                                                         
     426              35 :         preg_match_all('/\\\u[0-9a-f]{4}/ims', $value, $matches);                       
     427                 :                                                                                         
     428              35 :         if (!empty($matches[0])) {                                                      
     429               0 :             foreach ($matches[0] as $match) {                                           
     430               0 :                 $value = str_replace($match,                                            
     431               0 :                     chr(hexdec(substr($match, 2, 4))),                                  
     432               0 :                     $value);                                                            
     433               0 :             }                                                                           
     434               0 :             $value .= "\n\u0001";                                                       
     435               0 :         }                                                                               
     436                 :                                                                                         
     437              35 :         return $value;                                                                  
     438                 :     }                                                                                   
     439                 :                                                                                         
     440                 :                                                                                         
     441                 :     /**                                                                                 
     442                 :      * Converts relevant UTF-7 tags to UTF-8                                            
     443                 :      *                                                                                  
     444                 :      * @param string $value the value to convert                                        
     445                 :      *                                                                                  
     446                 :      * @static                                                                          
     447                 :      * @return string                                                                   
     448                 :      */                                                                                 
     449                 :     public static function convertFromUTF7($value)                                      
     450                 :     {                                                                                   
     451              35 :         if(preg_match('/\+A\w+-/m', $value)) {                                          
     452               1 :             if (function_exists('mb_convert_encoding')) {                               
     453               1 :                 if(version_compare(PHP_VERSION, '5.2.8', '<')) {                        
     454               0 :                     $tmp_chars = str_split($value);                                     
     455               0 :                     $value = '';                                                        
     456               0 :                     foreach($tmp_chars as $char) {                                      
     457               0 :                         if(ord($char) <= 127) {                                         
     458               0 :                             $value .= $char;                                            
     459               0 :                         }                                                               
     460               0 :                     }                                                                   
     461               0 :                 }                                                                       
     462               1 :                 $value .= "\n" . mb_convert_encoding($value, 'UTF-8', 'UTF-7');         
     463               1 :             } else {                                                                    
     464                 :                 //list of all critical UTF7 codepoints                                  
     465                 :                 $schemes = array(                                                       
     466               0 :                     '+ACI-'      => '"',                                                
     467               0 :                     '+ADw-'      => '<',                                                
     468               0 :                     '+AD4-'      => '>',                                                
     469               0 :                     '+AFs-'      => '[',                                                
     470               0 :                     '+AF0-'      => ']',                                                
     471               0 :                     '+AHs-'      => '{',                                                
     472               0 :                     '+AH0-'      => '}',                                                
     473               0 :                     '+AFw-'      => '\\',                                               
     474               0 :                     '+ADs-'      => ';',                                                
     475               0 :                     '+ACM-'      => '#',                                                
     476               0 :                     '+ACY-'      => '&',                                                
     477               0 :                     '+ACU-'      => '%',                                                
     478               0 :                     '+ACQ-'      => '$',                                                
     479               0 :                     '+AD0-'      => '=',                                                
     480               0 :                     '+AGA-'      => '`',                                                
     481               0 :                     '+ALQ-'      => '"',                                                
     482               0 :                     '+IBg-'      => '"',                                                
     483               0 :                     '+IBk-'      => '"',                                                
     484               0 :                     '+AHw-'      => '|',                                                
     485               0 :                     '+ACo-'      => '*',                                                
     486               0 :                     '+AF4-'      => '^',                                                
     487               0 :                     '+ACIAPg-'   => '">',                                               
     488                 :                     '+ACIAPgA8-' => '">'                                                
     489               0 :                 );                                                                      
     490                 :                                                                                         
     491               0 :                 $value = str_ireplace(array_keys($schemes),                             
     492               0 :                     array_values($schemes), $value);                                    
     493                 :             }                                                                           
     494               1 :         }                                                                               
     495              35 :         return $value;                                                                  
     496                 :     }                                                                                   
     497                 :                                                                                         
     498                 :     /**                                                                                 
     499                 :      * Converts basic concatenations                                                    
     500                 :      *                                                                                  
     501                 :      * @param string $value the value to convert                                        
     502                 :      *                                                                                  
     503                 :      * @static                                                                          
     504                 :      * @return string                                                                   
     505                 :      */                                                                                 
     506                 :     public static function convertConcatenations($value)                                
     507                 :     {                                                                                   
     508                 :         //normalize remaining backslashes                                               
     509              35 :         if ($value != preg_replace('/(\w)\\\/', "$1", $value)) {                        
     510               3 :             $value .= preg_replace('/(\w)\\\/', "$1", $value);                          
     511               3 :         }                                                                               
     512                 :                                                                                         
     513              35 :         $compare = stripslashes($value);                                                
     514                 :                                                                                         
     515              35 :         $pattern = array('/(?:<\/\w+>\+<\w+>)/s',                                       
     516              35 :             '/(?:":\d+[^"[]+")/s',                                                      
     517              35 :             '/(?:"?"\+\w+\+")/s',                                                       
     518              35 :             '/(?:"\s*;[^"]+")|(?:";[^"]+:\s*")/s',                                      
     519              35 :             '/(?:"\s*(?:;|\+).{8,18}:\s*")/s',                                          
     520              35 :             '/(?:";\w+=)|(?:!""&&")|(?:~)/s',                                           
     521              35 :             '/(?:"?"\+""?\+?"?)|(?:;\w+=")|(?:"[|&]{2,})/s',                            
     522              35 :             '/(?:"\s*\W+")/s',                                                          
     523              35 :             '/(?:";\w\s*\+=\s*\w?\s*")/s',                                              
     524              35 :             '/(?:"[|&;]+\s*[^|&\n]*[|&]+\s*"?)/s',                                      
     525              35 :             '/(?:";\s*\w+\W+\w*\s*[|&]*")/s',                                           
     526              35 :             '/(?:"\s*"\s*\.)/s',                                                        
     527              35 :             '/(?:\s*new\s+\w+\s*[+"])/',                                                
     528              35 :             '/(?:(?:^|\s+)(?:do|else)\s+)/',                                            
     529              35 :             '/(?:\{\s*new\s+\w+\s*\})/',                                                
     530              35 :             '/(?:(this|self).)/');                                                      
     531                 :                                                                                         
     532                 :         // strip out concatenations                                                     
     533              35 :         $converted = preg_replace($pattern, null, $compare);                            
     534                 :                                                                                         
     535                 :         //strip object traversal                                                        
     536              35 :         $converted = preg_replace('/\w(\.\w\()/', "$1", $converted);                    
     537                 :                                                                                         
     538                 :         //convert JS special numbers                                                    
     539              35 :         $converted = preg_replace('/(?:\(*[.\d]e[+-]*[^a-z\W]+\)*)' .                   
     540              35 :             '|(?:NaN|Infinity)\W/ms', 1, $converted);                                   
     541                 :                                                                                         
     542              35 :         if ($converted && ($compare != $converted)) {                                   
     543              15 :             $value .= "\n" . $converted;                                                
     544              15 :         }                                                                               
     545                 :                                                                                         
     546              35 :         return $value;                                                                  
     547                 :     }                                                                                   
     548                 :                                                                                         
     549                 :     /**                                                                                 
     550                 :      * This method collects and decodes proprietary encoding types                      
     551                 :      *                                                                                  
     552                 :      * @param string      $value   the value to convert                                 
     553                 :      * @param IDS_Monitor $monitor the monitor object                                   
     554                 :      *                                                                                  
     555                 :      * @static                                                                          
     556                 :      * @return string                                                                   
     557                 :      */                                                                                 
     558                 :     public static function convertFromProprietaryEncodings($value) {                    
     559                 :                                                                                         
     560                 :         //Xajax error reportings                                                        
     561              35 :         $value = preg_replace('/<!\[CDATA\[(\W+)\]\]>/im', '$1', $value);               
     562                 :                                                                                         
     563                 :         //strip false alert triggering apostrophes                                      
     564              35 :         $value = preg_replace('/(\w)\"(s)/m', '$1$2', $value);                          
     565                 :                                                                                         
     566                 :         //strip quotes within typical search patterns                                   
     567              35 :         $value = preg_replace('/^"([^"=\\!><~]+)"$/', '$1', $value);                    
     568                 :                                                                                         
     569                 :         //OpenID login tokens                                                           
     570              35 :         $value = preg_replace('/{[\w-]{8,9}\}(?:\{[\w=]{8}\}){2}/', null, $value);      
     571                 :                                                                                         
     572                 :         //convert Content and \sdo\s to null                                            
     573              35 :         $value = preg_replace('/Content|\Wdo\s/', null, $value);                        
     574                 :                                                                                         
     575                 :         //strip emoticons                                                               
     576              35 :         $value = preg_replace(                                                          
     577              35 :             '/(?:[:;]-[()\/PD]+)|(?:\s;[()PD]+)|(?::[()PD]+)|-\.-|\^\^/m',              
     578              35 :             null,                                                                       
     579                 :             $value                                                                      
     580              35 :         );                                                                              
     581                 :                                                                                         
     582                 :         // normalize separation char repetion                                           
     583              35 :         $value = preg_replace('/([.+~=*_\-])\1{2,}/m', '$1', $value);                   
     584                 :                                                                                         
     585                 :         //remove parenthesis inside sentences                                           
     586              35 :         $value = preg_replace('/(\w\s)\(([&\w]+)\)(\s\w|$)/', '$1$2$3', $value);        
     587                 :                                                                                         
     588                 :         //normalize ampersand listings                                                  
     589              35 :         $value = preg_replace('/(\w\s)&\s(\w)/', '$1$2', $value);                       
     590                 :                                                                                         
     591              35 :         return $value;                                                                  
     592                 :     }                                                                                   
     593                 :                                                                                         
     594                 :     /**                                                                                 
     595                 :      * This method is the centrifuge prototype                                          
     596                 :      *                                                                                  
     597                 :      * @param string      $value   the value to convert                                 
     598                 :      * @param IDS_Monitor $monitor the monitor object                                   
     599                 :      *                                                                                  
     600                 :      * @static                                                                          
     601                 :      * @return string                                                                   
     602                 :      */                                                                                 
     603                 :     public static function runCentrifuge($value, IDS_Monitor $monitor = null)           
     604                 :     {                                                                                   
     605              35 :         $threshold = 3.49;                                                              
     606                 :                                                                                         
     607              35 :         $unserialized = false;                                                          
     608              35 :         if(preg_match('/^\w:\d+:\{/', $value)) {                                        
     609               0 :             $unserialized = @unserialize($value);                                       
     610               0 :         }                                                                               
     611                 :                                                                                         
     612              35 :         if (strlen($value) > 25 && !$unserialized) {                                    
     613                 :             // Check for the attack char ratio                                          
     614              33 :             $tmp_value = $value;                                                        
     615              33 :             $tmp_value = preg_replace('/([*.!?+-])\1{1,}/m', '$1', $tmp_value);         
     616              33 :             $tmp_value = preg_replace('/"[\p{L}\d\s]+"/m', null, $tmp_value);           
     617                 :                                                                                         
     618              33 :             $stripped_length = strlen(preg_replace('/[\d\s\p{L}.:,%\/><-]+/m',          
     619              33 :                 null, $tmp_value));                                                     
     620              33 :             $overall_length  = strlen(preg_replace('/([\d\s\p{L}]{3,})+/m', 'aaa',      
     621              33 :                 preg_replace('/\s{2,}/m', null, $tmp_value)));                          
     622                 :                                                                                         
     623                 :             if ($stripped_length != 0                                                   
     624              33 :                 && $overall_length/$stripped_length <= $threshold) {                    
     625                 :                                                                                         
     626              16 :                 $monitor->centrifuge['ratio']     =                                     
     627              16 :                     $overall_length/$stripped_length;                                   
     628              16 :                 $monitor->centrifuge['threshold'] =                                     
     629                 :                     $threshold;                                                         
     630                 :                                                                                         
     631              16 :                 $value .= "\n$[!!!]";                                                   
     632              16 :             }                                                                           
     633              33 :         }                                                                               
     634                 :                                                                                         
     635              35 :         if (strlen($value) > 40) {                                                      
     636                 :             // Replace all non-special chars                                            
     637              32 :             $converted =  preg_replace('/[\w\s\p{L},.!]/', null, $value);               
     638                 :                                                                                         
     639                 :             // Split string into an array, unify and sort                               
     640              32 :             $array = str_split($converted);                                             
     641              32 :             $array = array_unique($array);                                              
     642              32 :             asort($array);                                                              
     643                 :                                                                                         
     644                 :             // Normalize certain tokens                                                 
     645                 :             $schemes = array(                                                           
     646              32 :                 '~' => '+',                                                             
     647              32 :                 '^' => '+',                                                             
     648              32 :                 '|' => '+',                                                             
     649              32 :                 '*' => '+',                                                             
     650              32 :                 '%' => '+',                                                             
     651              32 :                 '&' => '+',                                                             
     652                 :                 '/' => '+'                                                              
     653              32 :             );                                                                          
     654                 :                                                                                         
     655              32 :             $converted = implode($array);                                               
     656              32 :             $converted = str_replace(array_keys($schemes),                              
     657              32 :                 array_values($schemes), $converted);                                    
     658              32 :             $converted = preg_replace('/[+-]\s*\d+/', '+', $converted);                 
     659              32 :             $converted = preg_replace('/[()[\]{}]/', '(', $converted);                  
     660              32 :             $converted = preg_replace('/[!?:=]/', ':', $converted);                     
     661              32 :             $converted = preg_replace('/[^:(+]/', null, stripslashes($converted));      
     662                 :                                                                                         
     663                 :             // Sort again and implode                                                   
     664              32 :             $array = str_split($converted);                                             
     665              32 :             asort($array);                                                              
     666                 :                                                                                         
     667              32 :             $converted = implode($array);                                               
     668                 :                                                                                         
     669              32 :             if (preg_match('/(?:\({2,}\+{2,}:{2,})|(?:\({2,}\+{2,}:+)|' .               
     670              32 :                 '(?:\({3,}\++:{2,})/', $converted)) {                                   
     671                 :                                                                                         
     672              15 :                 $monitor->centrifuge['converted'] = $converted;                         
     673                 :                                                                                         
     674              15 :                 return $value . "\n" . $converted;                                      
     675                 :             }                                                                           
     676              31 :         }                                                                               
     677                 :                                                                                         
     678              35 :         return $value;                                                                  
     679                 :     }                                                                                   
     680                 : }                                                                                       
     681                 :                                                                                         
     682                 : /*                                                                                      
     683                 :  * Local variables:                                                                     
     684                 :  * tab-width: 4                                                                         
     685                 :  * c-basic-offset: 4                                                                    
     686                 :  * End:                                                                                 
     687                 :  */                                                                                     

Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008.