generate_glob_regex() enables globbing

[pukiwiki/pukiwiki_sandbox.git] / spam / spam.php

diff --git a/spam/spam.php b/spam/spam.php
index 54de9ff..daa5355 100644 (file)
--- a/spam/spam.php
+++ b/spam/spam.php
@@ -1,5 +1,5 @@
 <?php
-// $Id: spam.php,v 1.26 2006/11/23 01:16:13 henoheno Exp $
+// $Id: spam.php,v 1.32 2006/11/25 02:37:21 henoheno Exp $
 // Copyright (C) 2006 PukiWiki Developers Team
 // License: GPL v2 or (at your option) any later version
 
@@ -54,6 +54,12 @@ function uri_pickup($string = '', $normalize = TRUE,
 
                if ($normalize) {
                        $array[$uri]['scheme'] = scheme_normalize($array[$uri]['scheme']);
+                       //if ($array[$uri]['scheme'] === '') {
+                       //      // Ignore
+                       //      unset ($array[$uri]);
+                       //      continue;
+                       //}
+                       
                        $array[$uri]['host']   = strtolower($array[$uri]['host']);
                        $array[$uri]['port']   = port_normalize($array[$uri]['port'], $array[$uri]['scheme'], FALSE);
                        $array[$uri]['path']   = path_normalize($array[$uri]['path']);
@@ -86,6 +92,8 @@ function uri_pickup($string = '', $normalize = TRUE,
 // Domain exposure callback (See spam_uri_pickup_preprocess())
 // http://victim.example.org/?foo+site:nasty.example.com+bar
 // => http://nasty.example.com/?refer=victim.example.org
+// NOTE: 'refer=' is not so good for (at this time).
+// Consider about using IP address of the victim, try to avoid that.
 function _preg_replace_callback_domain_exposure($matches = array())
 {
        $result = '';
@@ -102,7 +110,7 @@ function _preg_replace_callback_domain_exposure($matches = array())
        $result = 
                $matches[1] . '://' .   // scheme
                $matches[4] .                   // nasty.example.com
-               '/refer=' . strtolower($matches[2]) . '/' .     // victim.example.org
+               '/?refer=' . strtolower($matches[2]) .  // victim.example.org
                ' ' . $result;
 
        return $result;
@@ -132,12 +140,12 @@ function spam_uri_pickup_preprocess($string = '')
                $string
        );
 
-       // Scheme exposure (schemescheme => scheme scheme)
+       // URI exposure (uriuri => uri uri)
        $string = preg_replace(
                array(
-                       '#(?:https?|ftp):/#',
-                       '#\b[a-z][a-z0-9.+-]{1,8}://#i',
-                       '#[a-z][a-z0-9.+-]{1,8}://#i'
+                       '#(?<! )(?:https?|ftp):/#',
+               //      '#[a-z][a-z0-9.+-]{1,8}://#i',
+               //      '#[a-z][a-z0-9.+-]{1,8}://#i'
                ),
                ' $0',
                $string
@@ -258,13 +266,19 @@ function area_measure($areas, & $array, $belief = -1, $a_key = 'area', $o_key =
 // ---------------------
 // Part Two
 
-// Scheme normalization: Rename the schemes
+// Scheme normalization: Renaming the schemes
 // snntp://example.org =>  nntps://example.org
-// NOTE: Keep the static list simple. See also port_normalize().
-function scheme_normalize($scheme = '')
+// NOTE: Keep the static lists simple. See also port_normalize().
+function scheme_normalize($scheme = '', $considerd_harmfull = TRUE)
 {
+       // Abbreviations considerable they don't have link intension
+       static $abbrevs = array(
+               'ttp'   => 'http',
+               'ttps'  => 'https',
+       );
+
+       // Alias => normalized
        static $aliases = array(
-               // alias => normalized
                'pop'   => 'pop3',
                'news'  => 'nntp',
                'imap4' => 'imap',
@@ -275,6 +289,13 @@ function scheme_normalize($scheme = '')
        );
 
        $scheme = strtolower(trim($scheme));
+       if (isset($abbrevs[$scheme])) {
+               if ($considerd_harmfull) {
+                       $scheme = $abbrevs[$scheme];
+               } else {
+                       $scheme = '';
+               }
+       }
        if (isset($aliases[$scheme])) $scheme = $aliases[$scheme];
 
        return $scheme;
@@ -401,8 +422,40 @@ function uri_array_implode($uri = array())
 // ---------------------
 // Part One : Checker
 
+function generate_glob_regex($string = '', $divider = '/')
+{
+       static $from = array(
+                       0 => '*',
+                       1 => '?',
+                       2 => '\[',
+                       3 => '\]',
+                       4 => '[',
+                       5 => ']',
+               );
+       static $mid = array(
+                       0 => '_AST_',
+                       1 => '_QUE_',
+                       2 => '_eRBR_',
+                       3 => '_eLBR_',
+                       4 => '_RBR_',
+                       5 => '_LBR_',
+               );
+       static $to = array(
+                       0 => '.*',
+                       1 => '.',
+                       2 => '\[',
+                       3 => '\]',
+                       4 => '[',
+                       5 => ']',
+               );
+
+       $string = str_replace($from, $mid, $string); // Hide
+       $string = preg_quote($string, $divider);
+       $string = str_replace($mid, $to, $string);   // Unhide
+
+       return $string;
+}
 
-// TODO: globbing for IP address or something
 // TODO: Ignore list
 // TODO: require_or_include_once(another file)
 function is_badhost($host = '')
@@ -410,38 +463,51 @@ function is_badhost($host = '')
        static $blocklist_regex;
 
        if (! isset($blocklist_regex)) {
+               $blocklist_regex = array();
                $blocklist = array(
-                       '.blogspot.com',
+                       // Deny all uri
+                       //'*',
+                       
+                       // IP address or ...
+                       //'10.20.*.*',  // 10.20.example.com also matches
+                       //'\[1\]',
+                       
+                       // Too much malicious sub-domains
+                       '*.blogspot.com',
+
+                       // 2006-11 dev
+                       'wwwtahoo.com',
+
+                       // 2006-11 dev
+                       '*.infogami.com',
+
+                       // 2006/11/19 17:50 dev
+                       '*.google0site.org',
+                       '*.bigpricesearch.org',
+                       '*.osfind.org',
+                       '*.bablomira.biz',
                );
                foreach ($blocklist as $part) {
-                       $blocklist_regex[] = '#\b' . preg_quote($part, '#') . '$#';
+                       $blocklist_regex[] = '#^' . generate_glob_regex($part, '#') . '$#';
                }
        }
 
+       $host = strtolower($host);
+       $result = FALSE;
        foreach ($blocklist_regex as $regex) {
                if (preg_match($regex, $host)) {
-                       return TRUE;
+                       $result = TRUE;
+                       break;
                }
        }
 
-       return FALSE;
+       return $result;
 }
 
 // TODO return TRUE or FALSE!
 // Simple/fast spam check
 function is_uri_spam($target = '')
 {
-       static $blocklist = array(
-               '.blogspot.com',
-       );
-       static $blocklist_regex;
-
-       if (! isset($blocklist_regex)) {
-               foreach ($blocklist as $part) {
-                       $blocklist_regex[] = '#\b' . preg_quote($part, '#') . '$#';
-               }
-       }
-
        $is_spam = FALSE;
        $urinum = 0;