gnh1201/reasonableframework
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update security.php

Browse Source
This commit is contained in:
Namhyeon Go 2018-02-26 18:15:23 +09:00 committed by GitHub
parent d3be0e17f3
commit 856c35686a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 44 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

69
system/security.php
View File

@ -175,7 +175,7 @@ if(!function_exists("check_empty_requests")) {
} }
if(!function_exists("get_hashed_text")) { if(!function_exists("get_hashed_text")) {
function get_hashed_text($text, $algo) { function get_hashed_text($text, $algo="sha1") {
$hashed_text = ""; $hashed_text = "";
switch($algo) { switch($algo) {
@ -351,42 +351,61 @@ if(!function_exists("get_fixed_length_id")) {
// https://stackoverflow.com/questions/1996122/how-to-prevent-xss-with-html-php // https://stackoverflow.com/questions/1996122/how-to-prevent-xss-with-html-php
if(!function_exists("get_clean_xss")) { if(!function_exists("get_clean_xss")) {
function get_clean_xss($data) { function get_clean_xss($data, $notags=0) {
// Fix &entity\n; if(is_string($data)) {
$data = str_replace(array('&','<','>'), array('&','<','>'), $data); // if no tags (equals to strip_tags)
$data = preg_replace('/(&#*\w+)[\x00-\x20]+;/u', '$1;', $data); if($notags > 0) {
$data = preg_replace('/(&#x*[0-9A-F]+);*/iu', '$1;', $data); return strip_tags($data);
$data = html_entity_decode($data, ENT_COMPAT, 'UTF-8'); }
// Remove any attribute starting with "on" or xmlns // Fix &entity\n;
$data = preg_replace('#(<[^>]+?[\x00-\x20"\'])(?:on|xmlns)[^>]*+>#iu', '$1>', $data); $data = str_replace(array('&amp;','&lt;','&gt;'), array('&amp;amp;','&amp;lt;','&amp;gt;'), $data);
$data = preg_replace('/(&#*\w+)[\x00-\x20]+;/u', '$1;', $data);
$data = preg_replace('/(&#x*[0-9A-F]+);*/iu', '$1;', $data);
$data = html_entity_decode($data, ENT_COMPAT, 'UTF-8');
// Remove javascript: and vbscript: protocols // Remove any attribute starting with "on" or xmlns
$data = preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2nojavascript...', $data); $data = preg_replace('#(<[^>]+?[\x00-\x20"\'])(?:on|xmlns)[^>]*+>#iu', '$1>', $data);
$data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2novbscript...', $data);
$data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u', '$1=$2nomozbinding...', $data);
// Only works in IE: <span style="width: expression(alert('Ping!'));"></span> // Remove javascript: and vbscript: protocols
$data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#i', '$1>', $data); $data = preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2nojavascript...', $data);
$data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#i', '$1>', $data); $data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2novbscript...', $data);
$data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#iu', '$1>', $data); $data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u', '$1=$2nomozbinding...', $data);
// Remove namespaced elements (we do not need them) // Only works in IE: <span style="width: expression(alert('Ping!'));"></span>
$data = preg_replace('#</*\w+:\w[^>]*+>#i', '', $data); $data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#i', '$1>', $data);
$data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#i', '$1>', $data);
$data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#iu', '$1>', $data);
do // Remove namespaced elements (we do not need them)
{ $data = preg_replace('#</*\w+:\w[^>]*+>#i', '', $data);
// Remove really unwanted tags
$old_data = $data; do
$data = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $data); {
// Remove really unwanted tags
$old_data = $data;
$data = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $data);
}
while ($old_data !== $data);
} }
while ($old_data !== $data);
// we are done... // we are done...
return $data; return $data;
} }
} }
if(!function_exists("get_clean_newlines")) {
function get_clean_newlines($data) {
return is_string($data) ? trim(preg_replace('~[\r\n]+~', ' ', $data)) : $data;
}
}
if(!function_exists("get_clean_text")) {
function get_clean_text($data) {
return is_string($data) ? get_clean_newlines(get_clean_xss($data, 1)) : $data;
}
}
// support curl or jsonp(callback) // support curl or jsonp(callback)
if(!function_exists("get_callable_token")) { if(!function_exists("get_callable_token")) {
function get_callable_token($token, $callback="", $charset="utf-8") { function get_callable_token($token, $callback="", $charset="utf-8") {