mirror of
https://github.com/Lastorder-DC/rhymix.git
synced 2026-01-08 03:01:43 +09:00
339 lines
8.3 KiB
PHP
339 lines
8.3 KiB
PHP
<?php
|
|
|
|
namespace Rhymix\Framework;
|
|
|
|
/**
|
|
* The security class.
|
|
*/
|
|
class Security
|
|
{
|
|
/**
|
|
* Sanitize a variable.
|
|
*
|
|
* @param string $input
|
|
* @param string $type
|
|
* @return string|false
|
|
*/
|
|
public static function sanitize($input, $type)
|
|
{
|
|
switch ($type)
|
|
{
|
|
// Escape HTML special characters.
|
|
case 'escape':
|
|
if (!detectUTF8($input)) return false;
|
|
return escape($input);
|
|
|
|
// Strip all HTML tags.
|
|
case 'strip':
|
|
if (!detectUTF8($input)) return false;
|
|
return escape(strip_tags($input));
|
|
|
|
// Clean up HTML content to prevent XSS attacks.
|
|
case 'html':
|
|
if (!detectUTF8($input)) return false;
|
|
return Security\HTMLFilter::clean($input);
|
|
|
|
// Clean up the input to be used as a safe filename.
|
|
case 'filename':
|
|
if (!detectUTF8($input)) return false;
|
|
return Security\FilenameFilter::clean($input);
|
|
|
|
// Unknown filters return false.
|
|
default: return false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Encrypt a string using AES.
|
|
*
|
|
* @param string $plaintext
|
|
* @param string $key (optional)
|
|
* @param bool $force_compat (optional)
|
|
* @return string|false
|
|
*/
|
|
public static function encrypt($plaintext, $key = null, $force_compat = false)
|
|
{
|
|
// Get the encryption key.
|
|
$key = $key ?: config('crypto.encryption_key');
|
|
$key = substr(hash('sha256', $key, true), 0, 16);
|
|
|
|
// Use defuse/php-encryption if possible.
|
|
if (!$force_compat && version_compare(\PHP_VERSION, '5.4.0', '>=') && function_exists('openssl_encrypt'))
|
|
{
|
|
try
|
|
{
|
|
return base64_encode(\Crypto::Encrypt($plaintext, $key));
|
|
}
|
|
catch (\Exception $e)
|
|
{
|
|
return false;
|
|
}
|
|
}
|
|
|
|
// Otherwise, use the CryptoCompat class.
|
|
return base64_encode(\CryptoCompat::encrypt($plaintext, $key));
|
|
}
|
|
|
|
/**
|
|
* Decrypt a string using AES.
|
|
*
|
|
* @param string $plaintext
|
|
* @param string $key (optional)
|
|
* @param bool $force_compat (optional)
|
|
* @return string|false
|
|
*/
|
|
public static function decrypt($ciphertext, $key = null, $force_compat = false)
|
|
{
|
|
// Get the encryption key.
|
|
$key = $key ?: config('crypto.encryption_key');
|
|
$key = substr(hash('sha256', $key, true), 0, 16);
|
|
|
|
// Check whether the ciphertext is valid.
|
|
$ciphertext = @base64_decode($ciphertext);
|
|
if (strlen($ciphertext) < 48)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
// Use defuse/php-encryption if possible.
|
|
if (!$force_compat && version_compare(\PHP_VERSION, '5.4.0', '>=') && function_exists('openssl_decrypt'))
|
|
{
|
|
try
|
|
{
|
|
return \Crypto::Decrypt($ciphertext, $key);
|
|
}
|
|
catch (\Exception $e)
|
|
{
|
|
return false;
|
|
}
|
|
}
|
|
|
|
// Otherwise, use the CryptoCompat class.
|
|
return \CryptoCompat::decrypt($ciphertext, $key);
|
|
}
|
|
|
|
/**
|
|
* Generate a cryptographically secure random string.
|
|
*
|
|
* @param int $length
|
|
* @param string $format
|
|
* @return string
|
|
*/
|
|
public function getRandom($length = 32, $format = 'alnum')
|
|
{
|
|
// Find out how many bytes of entropy we really need.
|
|
switch($format)
|
|
{
|
|
case 'binary':
|
|
$entropy_required_bytes = $length;
|
|
break;
|
|
case 'hex':
|
|
$entropy_required_bytes = ceil($length / 2);
|
|
break;
|
|
case 'alnum':
|
|
case 'printable':
|
|
default:
|
|
$entropy_required_bytes = ceil($length * 3 / 4);
|
|
break;
|
|
}
|
|
|
|
// Cap entropy to 256 bits from any one source, because anything more is meaningless.
|
|
$entropy_capped_bytes = min(32, $entropy_required_bytes);
|
|
|
|
// Find and use the most secure way to generate a random string.
|
|
$entropy = false;
|
|
$is_windows = (defined('\PHP_OS') && strtoupper(substr(\PHP_OS, 0, 3)) === 'WIN');
|
|
if(function_exists('random_bytes')) // PHP 7
|
|
{
|
|
$entropy = random_bytes($entropy_capped_bytes);
|
|
}
|
|
elseif(function_exists('openssl_random_pseudo_bytes') && (!$is_windows || version_compare(\PHP_VERSION, '5.4', '>=')))
|
|
{
|
|
$entropy = openssl_random_pseudo_bytes($entropy_capped_bytes);
|
|
}
|
|
elseif(function_exists('mcrypt_create_iv') && (!$is_windows || version_compare(\PHP_VERSION, '5.3.7', '>=')))
|
|
{
|
|
$entropy = mcrypt_create_iv($entropy_capped_bytes, \MCRYPT_DEV_URANDOM);
|
|
}
|
|
elseif(function_exists('mcrypt_create_iv') && $is_windows)
|
|
{
|
|
$entropy = mcrypt_create_iv($entropy_capped_bytes, \MCRYPT_RAND);
|
|
}
|
|
elseif(!$is_windows && @is_readable('/dev/urandom'))
|
|
{
|
|
$fp = fopen('/dev/urandom', 'rb');
|
|
if (function_exists('stream_set_read_buffer')) // This function does not exist in HHVM.
|
|
{
|
|
stream_set_read_buffer($fp, 0); // Prevent reading several KB of unnecessary data from urandom.
|
|
}
|
|
$entropy = fread($fp, $entropy_capped_bytes);
|
|
fclose($fp);
|
|
}
|
|
|
|
// Use built-in source of entropy if an error occurs while using other functions.
|
|
if($entropy === false || strlen($entropy) < $entropy_capped_bytes)
|
|
{
|
|
$entropy = '';
|
|
for($i = 0; $i < $entropy_capped_bytes; $i += 2)
|
|
{
|
|
$entropy .= pack('S', rand(0, 65536) ^ mt_rand(0, 65535));
|
|
}
|
|
}
|
|
|
|
// Mixing (see RFC 4086 section 5)
|
|
$output = '';
|
|
for($i = 0; $i < $entropy_required_bytes; $i += 32)
|
|
{
|
|
$output .= hash('sha256', $entropy . $i . rand(), true);
|
|
}
|
|
|
|
// Encode and return the random string.
|
|
switch($format)
|
|
{
|
|
case 'binary':
|
|
return substr($output, 0, $length);
|
|
case 'printable':
|
|
$salt = '';
|
|
for($i = 0; $i < $length; $i++)
|
|
{
|
|
$salt .= chr(33 + (crc32(sha1($i . $output)) % 94));
|
|
}
|
|
return $salt;
|
|
case 'hex':
|
|
return substr(bin2hex($output), 0, $length);
|
|
case 'alnum':
|
|
default:
|
|
$salt = substr(base64_encode($output), 0, $length);
|
|
$replacements = chr(rand(65, 90)) . chr(rand(97, 122)) . rand(0, 9);
|
|
return strtr($salt, '+/=', $replacements);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Generate a cryptographically secure random number between $min and $max.
|
|
*
|
|
* @param int $min
|
|
* @param int $max
|
|
* @return int
|
|
*/
|
|
public static function getRandomNumber($min = 0, $max = 0x7fffffff)
|
|
{
|
|
if (function_exists('random_int'))
|
|
{
|
|
return random_int($min, $max);
|
|
}
|
|
else
|
|
{
|
|
$bytes_required = min(4, ceil(log($max - $min, 2) / 8) + 1);
|
|
$bytes = self::getRandom($bytes_required, 'binary');
|
|
$offset = abs(hexdec(bin2hex($bytes)) % ($max - $min + 1));
|
|
return intval($min + $offset);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Generate a random UUID.
|
|
*
|
|
* @return string
|
|
*/
|
|
public static function getRandomUUID()
|
|
{
|
|
$randpool = self::getRandom(16, 'binary');
|
|
$randpool[6] = chr(ord($randpool[6]) & 0x0f | 0x40);
|
|
$randpool[8] = chr(ord($randpool[8]) & 0x3f | 0x80);
|
|
return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($randpool), 4));
|
|
}
|
|
|
|
/**
|
|
* Compare two strings in constant time.
|
|
*
|
|
* @param string $a
|
|
* @param string $b
|
|
* @return bool
|
|
*/
|
|
public static function compareStrings($a, $b)
|
|
{
|
|
$diff = strlen($a) ^ strlen($b);
|
|
$maxlen = min(strlen($a), strlen($b));
|
|
for($i = 0; $i < $maxlen; $i++)
|
|
{
|
|
$diff |= ord($a[$i]) ^ ord($b[$i]);
|
|
}
|
|
return $diff === 0;
|
|
}
|
|
|
|
/**
|
|
* Check if the current request seems to be a CSRF attack.
|
|
*
|
|
* This method returns true if the request seems to be innocent,
|
|
* and false if it seems to be a CSRF attack.
|
|
*
|
|
* @param string $referer (optional)
|
|
* @return bool
|
|
*/
|
|
public static function checkCSRF($referer = null)
|
|
{
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST')
|
|
{
|
|
return false;
|
|
}
|
|
|
|
if (!$referer)
|
|
{
|
|
$referer = strval($_SERVER['HTTP_REFERER']);
|
|
if ($referer === '')
|
|
{
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return URL::isInternalURL($referer);
|
|
}
|
|
|
|
/**
|
|
* Check if the current request seems to be an XEE attack.
|
|
*
|
|
* This method returns true if the request seems to be innocent,
|
|
* and false if it seems to be an XEE attack.
|
|
* This is the opposite of XE's Security::detectXEE() method.
|
|
*
|
|
* @param string $xml (optional)
|
|
* @return bool
|
|
*/
|
|
public static function checkXEE($xml = null)
|
|
{
|
|
// Stop if there is no XML content.
|
|
if (!$xml)
|
|
{
|
|
return true;
|
|
}
|
|
|
|
// Reject entity tags.
|
|
if (strpos($xml, '<!ENTITY') !== false)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
// Check if there is no content after the xml tag.
|
|
$header = preg_replace('/<\?xml.*?\?'.'>/s', '', substr($xml, 0, 100), 1);
|
|
if (($xml = trim(substr_replace($xml, $header, 0, 100))) === '')
|
|
{
|
|
return false;
|
|
}
|
|
|
|
// Check if there is no content after the DTD.
|
|
$header = preg_replace('/^<!DOCTYPE[^>]*+>/i', '', substr($xml, 0, 200), 1);
|
|
if (($xml = trim(substr_replace($xml, $header, 0, 200))) === '')
|
|
{
|
|
return false;
|
|
}
|
|
|
|
// Check that the root tag is valid.
|
|
if (!preg_match('/^<(methodCall|methodResponse|fault)/', $xml))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
}
|