X-Git-Url: http://git.osdn.net/view?p=pukiwiki%2Fpukiwiki_sandbox.git;a=blobdiff_plain;f=spam%2Fspam_pickup.php;h=443e69a4772a19b891125ed5de3de3bdcfd1ae09;hp=1c826493958f406da210631b8247c6fee8f7a83f;hb=994bd33af87aa256bc133ff0d2eaf41e6c4c135e;hpb=6d9115fa8bc8f588e6f81b64ac28cb45ce7c7fcf diff --git a/spam/spam_pickup.php b/spam/spam_pickup.php index 1c82649..443e69a 100644 --- a/spam/spam_pickup.php +++ b/spam/spam_pickup.php @@ -1,10 +1,14 @@ = 4.3.0): preg_match_all(PREG_OFFSET_CAPTURE): $method['uri_XXX'] related feature +// + +if (! defined('DOMAIN_INI_FILE')) define('DOMAIN_INI_FILE', 'domain.ini.php'); // --------------------- // URI pickup @@ -14,27 +18,27 @@ // [OK] http://nasty.example.org:80/foo/xxx#nasty_string/bar // [OK] ftp://nasty.example.org:80/dfsdfs // [OK] ftp://cnn.example.com&story=breaking_news@10.0.0.1/top_story.htm (from RFC3986) +// Not available for: IDN(ignored) function uri_pickup($string = '') { if (! is_string($string)) return array(); - // Not available for: IDN(ignored) $array = array(); preg_match_all( // scheme://userinfo@host:port/path/or/pathinfo/maybefile.and?query=string#fragment // Refer RFC3986 (Regex below is not strict) - '#(\b[a-z][a-z0-9.+-]{1,8}):[/\\\]+' . // 1: Scheme + '#(\b[a-z][a-z0-9.+-]{1,8}):[/\\\]+' . // 1: Scheme '(?:' . - '([^\s<>"\'\[\]/\#?@]*)' . // 2: Userinfo (Username) + '([^\s<>"\'\[\]/\#?@]*)' . // 2: Userinfo (Username and/or password) '@)?' . '(' . // 3: Host '\[[0-9a-f:.]+\]' . '|' . // IPv6([colon-hex and dot]): RFC2732 '(?:[0-9]{1,3}\.){3}[0-9]{1,3}' . '|' . // IPv4(dot-decimal): 001.22.3.44 - '[a-z0-9_-][a-z0-9_.-]+[a-z0-9_-]' . // hostname(FQDN) : foo.example.org + '[a-z0-9_-][a-z0-9_.-]+[a-z0-9_-]' . // hostname(FQDN) : foo.example.org ')' . '(?::([0-9]*))?' . // 4: Port - '((?:/+[^\s<>"\'\[\]/\#]+)*/+)?' . // 5: Directory path or path-info + '((?:/+[^\s<>"\'\[\]/\#?]+)*/+)?' . // 5: Directory path '([^\s<>"\'\[\]\#?]+)?' . // 6: File? '(?:\?([^\s<>"\'\[\]\#]+))?' . // 7: Query string '(?:\#([a-z0-9._~%!$&\'()*+,;=:@-]*))?' . // 8: Fragment @@ -42,18 +46,18 @@ function uri_pickup($string = '') $string, $array, PREG_SET_ORDER | PREG_OFFSET_CAPTURE ); - // Format the $array + // Reformat the $array static $parts = array( 1 => 'scheme', 2 => 'userinfo', 3 => 'host', 4 => 'port', 5 => 'path', 6 => 'file', 7 => 'query', 8 => 'fragment' ); - $default = array(''); + $default = array(0 => '', 1 => -1); foreach(array_keys($array) as $uri) { $_uri = & $array[$uri]; array_rename_keys($_uri, $parts, TRUE, $default); $offset = $_uri['scheme'][1]; // Scheme's offset = URI's offset foreach(array_keys($_uri) as $part) { - $_uri[$part] = & $_uri[$part][0]; // Remove offsets + $_uri[$part] = $_uri[$part][0]; // Remove offsets } } @@ -86,27 +90,43 @@ function uri_pickup_implode($uri = array()) $tmp[] = & $uri['scheme']; $tmp[] = '://'; } + if (isset($uri['userinfo']) && $uri['userinfo'] !== '') { $tmp[] = & $uri['userinfo']; $tmp[] = '@'; + } else if (isset($uri['user']) || isset($uri['pass'])) { + if (isset($uri['user']) && $uri['user'] !== '') { + $tmp[] = & $uri['user']; + } + $tmp[] = ':'; + if (isset($uri['pass']) && $uri['pass'] !== '') { + $tmp[] = & $uri['pass']; + } + $tmp[] = '@'; } + if (isset($uri['host']) && $uri['host'] !== '') { $tmp[] = & $uri['host']; } + if (isset($uri['port']) && $uri['port'] !== '') { $tmp[] = ':'; $tmp[] = & $uri['port']; } + if (isset($uri['path']) && $uri['path'] !== '') { $tmp[] = & $uri['path']; } + if (isset($uri['file']) && $uri['file'] !== '') { $tmp[] = & $uri['file']; } + if (isset($uri['query']) && $uri['query'] !== '') { $tmp[] = '?'; $tmp[] = & $uri['query']; } + if (isset($uri['fragment']) && $uri['fragment'] !== '') { $tmp[] = '#'; $tmp[] = & $uri['fragment']; @@ -121,28 +141,50 @@ function uri_pickup_implode($uri = array()) // Normalize an array of URI arrays // NOTE: Give me the uri_pickup() results -function uri_pickup_normalize(& $pickups, $destructive = TRUE) +function uri_pickup_normalize(& $pickups, $destructive = TRUE, $pathfile = FALSE) { if (! is_array($pickups)) return $pickups; if ($destructive) { foreach (array_keys($pickups) as $key) { $_key = & $pickups[$key]; - $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : ''; - $_key['host'] = isset($_key['host']) ? host_normalize($_key['host']) : ''; - $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : ''; + $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : ''; + $_key['host'] = isset($_key['host']) ? host_normalize($_key['host']) : ''; + $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : ''; $_key['path'] = isset($_key['path']) ? strtolower(path_normalize($_key['path'])) : ''; - $_key['file'] = isset($_key['file']) ? file_normalize($_key['file']) : ''; + $_key['file'] = isset($_key['file']) ? file_normalize($_key['file']) : ''; $_key['query'] = isset($_key['query']) ? query_normalize($_key['query']) : ''; - $_key['fragment'] = isset($_key['fragment']) ? strtolower($_key['fragment']) : ''; + $_key['fragment'] = isset($_key['fragment']) ? strtolower($_key['fragment']) : ''; } } else { foreach (array_keys($pickups) as $key) { $_key = & $pickups[$key]; - $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : ''; - $_key['host'] = isset($_key['host']) ? strtolower($_key['host']) : ''; - $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : ''; - $_key['path'] = isset($_key['path']) ? path_normalize($_key['path']) : ''; + $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : ''; + $_key['host'] = isset($_key['host']) ? strtolower($_key['host']) : ''; + $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : ''; + $_key['path'] = isset($_key['path']) ? path_normalize($_key['path']) : ''; + } + } + + if ($pathfile) { + return uri_pickup_normalize_pathfile($pickups); + } else { + return $pickups; + } +} + +// Normalize: 'path' + 'file' = 'path' (Similar structure using PHP's "parse_url()" function) +// NOTE: In some case, 'file' DOES NOT mean _filename_. +// [EXAMPLE] http://example.com/path/to/directory-accidentally-not-ended-with-slash +function uri_pickup_normalize_pathfile(& $pickups) +{ + if (! is_array($pickups)) return $pickups; + + foreach (array_keys($pickups) as $key) { + $_key = & $pickups[$key]; + if (isset($_key['path'], $_key['file'])) { + $_key['path'] = $_key['path'] . $_key['file']; + unset($_key['file']); } } @@ -189,13 +231,14 @@ function scheme_normalize($scheme = '', $abbrevs_harmfull = TRUE) // www.foo.bar => foo.bar // www.10.20 => www.10.20 (Invalid hostname) // NOTE: -// 'www' is mostly used as traditional hostname of WWW server. -// 'www.foo.bar' may be identical with 'foo.bar'. +// 'www' is basically traditional hostname for WWW server. +// In these case, 'www.foo.bar' MAY be identical with 'foo.bar'. function host_normalize($host = '') { if (! is_string($host)) return ''; $host = strtolower($host); + $matches = array(); if (preg_match('/^www\.(.+\.[a-z]+)$/', $host, $matches)) { return $matches[1]; @@ -548,7 +591,7 @@ function area_pickup($string = '', $method = array()) // [OK] [link]http://nasty.example.com/[/link] // [OK] [url=http://nasty.example.com]visit http://nasty.example.com/[/url] // [OK] [link http://nasty.example.com/]buy something[/link] - $regex = '#\[(url|link)\b[^\]]*\].*?\[/\1\b[^\]]*(\])#is'; + $regex = '#\[(url|link|img|email)\b[^\]]*\].*?\[/\1\b[^\]]*(\])#is'; if (isset($method['area_bbcode'])) { $areas = array(); $count = isset($method['asap']) ? @@ -606,9 +649,12 @@ function area_measure($areas, & $array, $belief = -1, $a_key = 'area', $o_key = // --------------------- // Spam-uri pickup -// Preprocess: Removing uninterest part for URI detection +// Preprocess: Removing/Modifying uninterest part for URI detection function spam_uri_removing_hocus_pocus($binary = '', $method = array()) { + $from = $to = array(); + + // Remove sequential spaces and too short lines $length = 4 ; // 'http'(1) and '://'(2) and 'fqdn'(1) if (is_array($method)) { // ''(1) or ''(4) @@ -617,14 +663,17 @@ function spam_uri_removing_hocus_pocus($binary = '', $method = array()) isset($method['area_bbcode']) || isset($method['uri_bbcode'])) $length = 1; // Seems not effective } - - // Removing sequential spaces and too short lines $binary = strings($binary, $length, TRUE, FALSE); // Multibyte NOT needed + // Remove/Replace quoted-spaces within tags + $from[] = '#(<\w+ [^<>]*?\w ?= ?")([^"<>]*? [^"<>]*)("[^<>]*?>)#ie'; + $to[] = "'$1' . str_replace(' ' , '%20' , trim('$2')) . '$3'"; + // Remove words (has no '<>[]:') between spaces - $binary = preg_replace('/[ \t][\w.,()\ \t]+[ \t]/', ' ', $binary); + $from[] = '/[ \t][\w.,()\ \t]+[ \t]/'; + $to[] = ' '; - return $binary; + return preg_replace($from, $to, $binary); } // Preprocess: Domain exposure callback (See spam_uri_pickup_preprocess()) @@ -656,7 +705,7 @@ function _preg_replace_callback_domain_exposure($matches = array()) return $result; } -// Preprocess: rawurldecode() and adding space(s) and something +// Preprocess: minor-rawurldecode() and adding space(s) and something // to detect/count some URIs _if possible_ // NOTE: It's maybe danger to var_dump(result). [e.g. 'javascript:'] // [OK] http://victim.example.org/?site:nasty.example.org @@ -667,8 +716,20 @@ function spam_uri_pickup_preprocess($string = '', $method = array()) { if (! is_string($string)) return ''; - $string = spam_uri_removing_hocus_pocus(rawurldecode($string), $method); - //var_dump(htmlspecialchars($string)); + // rawurldecode(), just to catch encoded 'http://path/to/file', not to change '%20' to ' ' + $string = strtr( + $string, + array( + '%3A' => ':', + '%3a' => ':', + '%2F' => '/', + '%2f' => '/', + '%5C' => '\\', + '%5c' => '\\', + ) + ); + + $string = spam_uri_removing_hocus_pocus($string, $method); // Domain exposure (simple) // http://victim.example.org/nasty.example.org/path#frag @@ -676,30 +737,24 @@ function spam_uri_pickup_preprocess($string = '', $method = array()) $string = preg_replace( '#h?ttp://' . '(' . - 'ime\.nu' . '|' . // 2ch.net - 'ime\.st' . '|' . // 2ch.net - 'link\.toolbot\.com' . '|' . - 'urlx\.org' . + 'a9\.com/' . '|' . + 'aboutus\.org/' . '|' . + 'alexa\.com/data/details\?url=' . '|' . + 'ime\.(?:nu|st)/' . '|' . // 2ch.net + 'link\.toolbot\.com/' . '|' . + 'urlx\.org/' . '|' . + 'big5.51job.com/gate/big5/' . '|' . + 'big5.china.com/gate/big5/' . '|' . + 'big5.shippingchina.com:8080/' . '|' . + 'big5.xinhuanet.com/gate/big5/' . '|' . + 'bhomiyo.com/en.xliterate/' . '|' . + 'google.com/translate_c\?u=(?:http://)?' . '|' . + 'web.archive.org/web/2[^/]*/(?:http://)?' . '|' . + 'technorati.com/blogs/' . ')' . - '/([a-z0-9.%_-]+\.[a-z0-9.%_-]+)#i', // nasty.example.org - 'http://$2/?refer=$1 $0', // Preserve $0 or remove? - $string - ); - - // Domain exposure (gate-big5) - // http://victim.example.org/gate/big5/nasty.example.org/path - // => http://nasty.example.org/?refer=victim.example.org and original - $string = preg_replace( - '#h?ttp://' . - '(' . - 'big5.51job.com' . '|' . - 'big5.china.com' . '|' . - 'big5.xinhuanet.com' . '|' . - ')' . - '/gate/big5' . - '/([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . - '#i', // nasty.example.org - 'http://$2/?refer=$1 $0', // Preserve $0 or remove? + '([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . // nasty.example.org + '#i', + 'http://$2/?refer=$1 $0', // Preserve $0 or remove? $string ); @@ -721,8 +776,9 @@ function spam_uri_pickup_preprocess($string = '', $method = array()) // ... ')' . '/' . - '([a-z0-9?=&.%_/\'\\\+-]+)' . // 3:path/?query=foo+bar+ - '\bsite:([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . // 4:site:nasty.example.com + //TODO: Specify URL-enable characters + '([a-z0-9?=&.,%_/\'\\\+-]+)' . // 3:path/?query=foo+bar+ + '(?:\b|%20)site:([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . // 4:site:nasty.example.com '()' . // 5:Preserve or remove? '#i', ), @@ -779,10 +835,83 @@ function spam_uri_pickup($string = '', $method = array()) } // Remove 'offset's for area_measure() - foreach(array_keys($array) as $key) + foreach(array_keys($array) as $key) { unset($array[$key]['area']['offset']); + } return $array; } +// Rough hostname checker +// TODO: Strict digit, 0x, CIDR, '999.999.999.999', ':', '::G' +function is_ip($string = '') +{ + if (! is_string($string)) return FALSE; + + if (strpos($string, ':') !== FALSE) { + return 6; // Seems IPv6 + } + + if (preg_match('/^' . + '(?:[0-9]{1,3}\.){3}[0-9]{1,3}' . '|' . + '(?:[0-9]{1,3}\.){1,3}' . '$/', + $string)) { + return 4; // Seems IPv4(dot-decimal) + } + + return FALSE; // Seems not IP +} + +// Check responsibility-root of the FQDN +// 'foo.bar.example.com' => 'example.com' (.com has the last whois for it) +// 'foo.bar.example.au' => 'example.au' (.au has the last whois for it) +// 'foo.bar.example.edu.au' => 'example.edu.au' (.edu.au has the last whois for it) +// 'foo.bar.example.act.edu.au' => 'example.act.edu.au' (.act.edu.au has the last whois for it) +function whois_responsibility($fqdn = 'foo.bar.example.com', $parent = FALSE, $implicit = TRUE) +{ + static $domain; + + if ($fqdn === NULL) { + $domain = NULL; // Unset + return ''; + } + if (! is_string($fqdn)) return ''; + + if (is_ip($fqdn)) return $fqdn; + + if (! isset($domain)) { + $domain = array(); + if (file_exists(DOMAIN_INI_FILE)) { + include(DOMAIN_INI_FILE); // Set + } + } + + $result = array(); + $dcursor = & $domain; + $array = array_reverse(explode('.', $fqdn)); + $i = 0; + while(TRUE) { + if (! isset($array[$i])) break; + $acursor = $array[$i]; + if (is_array($dcursor) && isset($dcursor[$acursor])) { + $result[] = & $array[$i]; + $dcursor = & $dcursor[$acursor]; + } else { + if (! $parent && isset($acursor)) { + $result[] = & $array[$i]; // Whois servers must know this subdomain + } + break; + } + ++$i; + } + + // Implicit responsibility: Top-Level-Domains must not be yours + // 'bar.foo.something' => 'foo.something' + if ($implicit && count($result) == 1 && count($array) > 1) { + $result[] = & $array[1]; + } + + return $result ? implode('.', array_reverse($result)) : ''; +} + ?>