<?php
-// $Id: spam_pickup.php,v 1.51 2007/07/02 14:51:40 henoheno Exp $
-// Copyright (C) 2006-2007 PukiWiki Developers Team
+// $Id: spam_pickup.php,v 1.71 2009/01/04 08:56:07 henoheno Exp $
+// Copyright (C) 2006-2009 PukiWiki Developers Team
// License: GPL v2 or (at your option) any later version
//
// Functions for Concept-work of spam-uri metrics
//
+// (PHP 4 >= 4.3.0): preg_match_all(PREG_OFFSET_CAPTURE): $method['uri_XXX'] related feature
+//
+
+if (! defined('DOMAIN_INI_FILE')) define('DOMAIN_INI_FILE', 'domain.ini.php');
// ---------------------
// URI pickup
// [OK] http://nasty.example.org:80/foo/xxx#nasty_string/bar
// [OK] ftp://nasty.example.org:80/dfsdfs
// [OK] ftp://cnn.example.com&story=breaking_news@10.0.0.1/top_story.htm (from RFC3986)
+// Not available for: IDN(ignored)
function uri_pickup($string = '')
{
if (! is_string($string)) return array();
- // Not available for: IDN(ignored)
$array = array();
preg_match_all(
// scheme://userinfo@host:port/path/or/pathinfo/maybefile.and?query=string#fragment
// Refer RFC3986 (Regex below is not strict)
- '#(\b[a-z][a-z0-9.+-]{1,8}):[/\\\]+' . // 1: Scheme
+ '#(\b[a-z][a-z0-9.+-]{1,8}):[/\\\]+' . // 1: Scheme
'(?:' .
- '([^\s<>"\'\[\]/\#?@]*)' . // 2: Userinfo (Username)
+ '([^\s<>"\'\[\]/\#?@]*)' . // 2: Userinfo (Username and/or password)
'@)?' .
'(' .
// 3: Host
'\[[0-9a-f:.]+\]' . '|' . // IPv6([colon-hex and dot]): RFC2732
'(?:[0-9]{1,3}\.){3}[0-9]{1,3}' . '|' . // IPv4(dot-decimal): 001.22.3.44
- '[a-z0-9_-][a-z0-9_.-]+[a-z0-9_-]' . // hostname(FQDN) : foo.example.org
+ '[a-z0-9_-][a-z0-9_.-]+[a-z0-9_-]' . // hostname(FQDN) : foo.example.org
')' .
'(?::([0-9]*))?' . // 4: Port
- '((?:/+[^\s<>"\'\[\]/\#]+)*/+)?' . // 5: Directory path or path-info
+ '((?:/+[^\s<>"\'\[\]/\#?]+)*/+)?' . // 5: Directory path
'([^\s<>"\'\[\]\#?]+)?' . // 6: File?
'(?:\?([^\s<>"\'\[\]\#]+))?' . // 7: Query string
'(?:\#([a-z0-9._~%!$&\'()*+,;=:@-]*))?' . // 8: Fragment
$string, $array, PREG_SET_ORDER | PREG_OFFSET_CAPTURE
);
- // Format the $array
+ // Reformat the $array
static $parts = array(
1 => 'scheme', 2 => 'userinfo', 3 => 'host', 4 => 'port',
5 => 'path', 6 => 'file', 7 => 'query', 8 => 'fragment'
);
- $default = array('');
+ $default = array(0 => '', 1 => -1);
foreach(array_keys($array) as $uri) {
$_uri = & $array[$uri];
array_rename_keys($_uri, $parts, TRUE, $default);
$offset = $_uri['scheme'][1]; // Scheme's offset = URI's offset
foreach(array_keys($_uri) as $part) {
- $_uri[$part] = & $_uri[$part][0]; // Remove offsets
+ $_uri[$part] = $_uri[$part][0]; // Remove offsets
}
}
$tmp[] = & $uri['scheme'];
$tmp[] = '://';
}
+
if (isset($uri['userinfo']) && $uri['userinfo'] !== '') {
$tmp[] = & $uri['userinfo'];
$tmp[] = '@';
+ } else if (isset($uri['user']) || isset($uri['pass'])) {
+ if (isset($uri['user']) && $uri['user'] !== '') {
+ $tmp[] = & $uri['user'];
+ }
+ $tmp[] = ':';
+ if (isset($uri['pass']) && $uri['pass'] !== '') {
+ $tmp[] = & $uri['pass'];
+ }
+ $tmp[] = '@';
}
+
if (isset($uri['host']) && $uri['host'] !== '') {
$tmp[] = & $uri['host'];
}
+
if (isset($uri['port']) && $uri['port'] !== '') {
$tmp[] = ':';
$tmp[] = & $uri['port'];
}
+
if (isset($uri['path']) && $uri['path'] !== '') {
$tmp[] = & $uri['path'];
}
+
if (isset($uri['file']) && $uri['file'] !== '') {
$tmp[] = & $uri['file'];
}
+
if (isset($uri['query']) && $uri['query'] !== '') {
$tmp[] = '?';
$tmp[] = & $uri['query'];
}
+
if (isset($uri['fragment']) && $uri['fragment'] !== '') {
$tmp[] = '#';
$tmp[] = & $uri['fragment'];
// Normalize an array of URI arrays
// NOTE: Give me the uri_pickup() results
-function uri_pickup_normalize(& $pickups, $destructive = TRUE)
+function uri_pickup_normalize(& $pickups, $destructive = TRUE, $pathfile = FALSE)
{
if (! is_array($pickups)) return $pickups;
if ($destructive) {
foreach (array_keys($pickups) as $key) {
$_key = & $pickups[$key];
- $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : '';
- $_key['host'] = isset($_key['host']) ? host_normalize($_key['host']) : '';
- $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : '';
+ $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : '';
+ $_key['host'] = isset($_key['host']) ? host_normalize($_key['host']) : '';
+ $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : '';
$_key['path'] = isset($_key['path']) ? strtolower(path_normalize($_key['path'])) : '';
- $_key['file'] = isset($_key['file']) ? file_normalize($_key['file']) : '';
+ $_key['file'] = isset($_key['file']) ? file_normalize($_key['file']) : '';
$_key['query'] = isset($_key['query']) ? query_normalize($_key['query']) : '';
- $_key['fragment'] = isset($_key['fragment']) ? strtolower($_key['fragment']) : '';
+ $_key['fragment'] = isset($_key['fragment']) ? strtolower($_key['fragment']) : '';
}
} else {
foreach (array_keys($pickups) as $key) {
$_key = & $pickups[$key];
- $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : '';
- $_key['host'] = isset($_key['host']) ? strtolower($_key['host']) : '';
- $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : '';
- $_key['path'] = isset($_key['path']) ? path_normalize($_key['path']) : '';
+ $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : '';
+ $_key['host'] = isset($_key['host']) ? strtolower($_key['host']) : '';
+ $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : '';
+ $_key['path'] = isset($_key['path']) ? path_normalize($_key['path']) : '';
+ }
+ }
+
+ if ($pathfile) {
+ return uri_pickup_normalize_pathfile($pickups);
+ } else {
+ return $pickups;
+ }
+}
+
+// Normalize: 'path' + 'file' = 'path' (Similar structure using PHP's "parse_url()" function)
+// NOTE: In some case, 'file' DOES NOT mean _filename_.
+// [EXAMPLE] http://example.com/path/to/directory-accidentally-not-ended-with-slash
+function uri_pickup_normalize_pathfile(& $pickups)
+{
+ if (! is_array($pickups)) return $pickups;
+
+ foreach (array_keys($pickups) as $key) {
+ $_key = & $pickups[$key];
+ if (isset($_key['path'], $_key['file'])) {
+ $_key['path'] = $_key['path'] . $_key['file'];
+ unset($_key['file']);
}
}
// www.foo.bar => foo.bar
// www.10.20 => www.10.20 (Invalid hostname)
// NOTE:
-// 'www' is mostly used as traditional hostname of WWW server.
-// 'www.foo.bar' may be identical with 'foo.bar'.
+// 'www' is basically traditional hostname for WWW server.
+// In these case, 'www.foo.bar' MAY be identical with 'foo.bar'.
function host_normalize($host = '')
{
if (! is_string($host)) return '';
$host = strtolower($host);
+
$matches = array();
if (preg_match('/^www\.(.+\.[a-z]+)$/', $host, $matches)) {
return $matches[1];
// [OK] [link]http://nasty.example.com/[/link]
// [OK] [url=http://nasty.example.com]visit http://nasty.example.com/[/url]
// [OK] [link http://nasty.example.com/]buy something[/link]
- $regex = '#\[(url|link)\b[^\]]*\].*?\[/\1\b[^\]]*(\])#is';
+ $regex = '#\[(url|link|img|email)\b[^\]]*\].*?\[/\1\b[^\]]*(\])#is';
if (isset($method['area_bbcode'])) {
$areas = array();
$count = isset($method['asap']) ?
// ---------------------
// Spam-uri pickup
-// Preprocess: Removing uninterest part for URI detection
+// Preprocess: Removing/Modifying uninterest part for URI detection
function spam_uri_removing_hocus_pocus($binary = '', $method = array())
{
+ $from = $to = array();
+
+ // Remove sequential spaces and too short lines
$length = 4 ; // 'http'(1) and '://'(2) and 'fqdn'(1)
if (is_array($method)) {
// '<a'(2) or 'href='(5) or '>'(1) or '</a>'(4)
isset($method['area_bbcode']) || isset($method['uri_bbcode']))
$length = 1; // Seems not effective
}
-
- // Removing sequential spaces and too short lines
$binary = strings($binary, $length, TRUE, FALSE); // Multibyte NOT needed
+ // Remove/Replace quoted-spaces within tags
+ $from[] = '#(<\w+ [^<>]*?\w ?= ?")([^"<>]*? [^"<>]*)("[^<>]*?>)#ie';
+ $to[] = "'$1' . str_replace(' ' , '%20' , trim('$2')) . '$3'";
+
// Remove words (has no '<>[]:') between spaces
- $binary = preg_replace('/[ \t][\w.,()\ \t]+[ \t]/', ' ', $binary);
+ $from[] = '/[ \t][\w.,()\ \t]+[ \t]/';
+ $to[] = ' ';
- return $binary;
+ return preg_replace($from, $to, $binary);
}
// Preprocess: Domain exposure callback (See spam_uri_pickup_preprocess())
return $result;
}
-// Preprocess: rawurldecode() and adding space(s) and something
+// Preprocess: minor-rawurldecode() and adding space(s) and something
// to detect/count some URIs _if possible_
// NOTE: It's maybe danger to var_dump(result). [e.g. 'javascript:']
// [OK] http://victim.example.org/?site:nasty.example.org
{
if (! is_string($string)) return '';
- $string = spam_uri_removing_hocus_pocus(rawurldecode($string), $method);
- //var_dump(htmlspecialchars($string));
+ // rawurldecode(), just to catch encoded 'http://path/to/file', not to change '%20' to ' '
+ $string = strtr(
+ $string,
+ array(
+ '%3A' => ':',
+ '%3a' => ':',
+ '%2F' => '/',
+ '%2f' => '/',
+ '%5C' => '\\',
+ '%5c' => '\\',
+ )
+ );
+
+ $string = spam_uri_removing_hocus_pocus($string, $method);
// Domain exposure (simple)
// http://victim.example.org/nasty.example.org/path#frag
$string = preg_replace(
'#h?ttp://' .
'(' .
- 'ime\.nu' . '|' . // 2ch.net
- 'ime\.st' . '|' . // 2ch.net
- 'link\.toolbot\.com' . '|' .
- 'urlx\.org' .
+ 'a9\.com/' . '|' .
+ 'aboutus\.org/' . '|' .
+ 'alexa\.com/data/details\?url=' . '|' .
+ 'ime\.(?:nu|st)/' . '|' . // 2ch.net
+ 'link\.toolbot\.com/' . '|' .
+ 'urlx\.org/' . '|' .
+ 'big5.51job.com/gate/big5/' . '|' .
+ 'big5.china.com/gate/big5/' . '|' .
+ 'big5.shippingchina.com:8080/' . '|' .
+ 'big5.xinhuanet.com/gate/big5/' . '|' .
+ 'bhomiyo.com/en.xliterate/' . '|' .
+ 'google.com/translate_c\?u=(?:http://)?' . '|' .
+ 'web.archive.org/web/2[^/]*/(?:http://)?' . '|' .
+ 'technorati.com/blogs/' .
')' .
- '/([a-z0-9.%_-]+\.[a-z0-9.%_-]+)#i', // nasty.example.org
- 'http://$2/?refer=$1 $0', // Preserve $0 or remove?
- $string
- );
-
- // Domain exposure (gate-big5)
- // http://victim.example.org/gate/big5/nasty.example.org/path
- // => http://nasty.example.org/?refer=victim.example.org and original
- $string = preg_replace(
- '#h?ttp://' .
- '(' .
- 'big5.51job.com' . '|' .
- 'big5.china.com' . '|' .
- 'big5.xinhuanet.com' . '|' .
- ')' .
- '/gate/big5' .
- '/([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' .
- '#i', // nasty.example.org
- 'http://$2/?refer=$1 $0', // Preserve $0 or remove?
+ '([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . // nasty.example.org
+ '#i',
+ 'http://$2/?refer=$1 $0', // Preserve $0 or remove?
$string
);
// ...
')' .
'/' .
- '([a-z0-9?=&.%_/\'\\\+-]+)' . // 3:path/?query=foo+bar+
- '\bsite:([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . // 4:site:nasty.example.com
+ //TODO: Specify URL-enable characters
+ '([a-z0-9?=&.,%_/\'\\\+-]+)' . // 3:path/?query=foo+bar+
+ '(?:\b|%20)site:([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . // 4:site:nasty.example.com
'()' . // 5:Preserve or remove?
'#i',
),
}
// Remove 'offset's for area_measure()
- foreach(array_keys($array) as $key)
+ foreach(array_keys($array) as $key) {
unset($array[$key]['area']['offset']);
+ }
return $array;
}
+// Rough hostname checker
+// TODO: Strict digit, 0x, CIDR, '999.999.999.999', ':', '::G'
+function is_ip($string = '')
+{
+ if (! is_string($string)) return FALSE;
+
+ if (strpos($string, ':') !== FALSE) {
+ return 6; // Seems IPv6
+ }
+
+ if (preg_match('/^' .
+ '(?:[0-9]{1,3}\.){3}[0-9]{1,3}' . '|' .
+ '(?:[0-9]{1,3}\.){1,3}' . '$/',
+ $string)) {
+ return 4; // Seems IPv4(dot-decimal)
+ }
+
+ return FALSE; // Seems not IP
+}
+
+// Check responsibility-root of the FQDN
+// 'foo.bar.example.com' => 'example.com' (.com has the last whois for it)
+// 'foo.bar.example.au' => 'example.au' (.au has the last whois for it)
+// 'foo.bar.example.edu.au' => 'example.edu.au' (.edu.au has the last whois for it)
+// 'foo.bar.example.act.edu.au' => 'example.act.edu.au' (.act.edu.au has the last whois for it)
+function whois_responsibility($fqdn = 'foo.bar.example.com', $parent = FALSE, $implicit = TRUE)
+{
+ static $domain;
+
+ if ($fqdn === NULL) {
+ $domain = NULL; // Unset
+ return '';
+ }
+ if (! is_string($fqdn)) return '';
+
+ if (is_ip($fqdn)) return $fqdn;
+
+ if (! isset($domain)) {
+ $domain = array();
+ if (file_exists(DOMAIN_INI_FILE)) {
+ include(DOMAIN_INI_FILE); // Set
+ }
+ }
+
+ $result = array();
+ $dcursor = & $domain;
+ $array = array_reverse(explode('.', $fqdn));
+ $i = 0;
+ while(TRUE) {
+ if (! isset($array[$i])) break;
+ $acursor = $array[$i];
+ if (is_array($dcursor) && isset($dcursor[$acursor])) {
+ $result[] = & $array[$i];
+ $dcursor = & $dcursor[$acursor];
+ } else {
+ if (! $parent && isset($acursor)) {
+ $result[] = & $array[$i]; // Whois servers must know this subdomain
+ }
+ break;
+ }
+ ++$i;
+ }
+
+ // Implicit responsibility: Top-Level-Domains must not be yours
+ // 'bar.foo.something' => 'foo.something'
+ if ($implicit && count($result) == 1 && count($array) > 1) {
+ $result[] = & $array[1];
+ }
+
+ return $result ? implode('.', array_reverse($result)) : '';
+}
+
?>
OSDN Git Service
