'(1) or ''(4)
+ // '[uri'(4) or ']'(1) or '[/uri]'(6)
+ if (isset($method['area_anchor']) || isset($method['uri_anchor']) ||
+ isset($method['area_bbcode']) || isset($method['uri_bbcode']))
+ $length = 1; // Seems not effective
+ }
+ $binary = strings($binary, $length, TRUE, FALSE); // Multibyte NOT needed
+
+ // Remove/Replace quoted-spaces within tags
+ $from[] = '#(<\w+ [^<>]*?\w ?= ?")([^"<>]*? [^"<>]*)("[^<>]*?>)#ie';
+ $to[] = "'$1' . str_replace(' ' , '%20' , trim('$2')) . '$3'";
+
+ // Remove words (has no '<>[]:') between spaces
+ $from[] = '/[ \t][\w.,()\ \t]+[ \t]/';
+ $to[] = ' ';
+
+ return preg_replace($from, $to, $binary);
+}
+
+// Preprocess: Domain exposure callback (See spam_uri_pickup_preprocess())
+// http://victim.example.org/?foo+site:nasty.example.com+bar
+// => http://nasty.example.com/?refer=victim.example.org
+// NOTE: 'refer=' is not so good for (at this time).
+// Consider about using IP address of the victim, try to avoid that.
+function _preg_replace_callback_domain_exposure($matches = array())
{
- $base = basename(__FILE__);
- $string = htmlspecialchars($string);
- print <<< EOF
-
-
-EOF;
+ $result = '';
+
+ // Preserve the victim URI as a complicity or ...
+ if (isset($matches[5])) {
+ $result =
+ $matches[1] . '://' . // scheme
+ $matches[2] . '/' . // victim.example.org
+ $matches[3]; // The rest of all (before victim)
+ }
+
+ // Flipped URI
+ if (isset($matches[4])) {
+ $result =
+ $matches[1] . '://' . // scheme
+ $matches[4] . // nasty.example.com
+ '/?refer=' . strtolower($matches[2]) . // victim.example.org
+ ' ' . $result;
+ }
+
+ return $result;
}
+// Preprocess: minor-rawurldecode() and adding space(s) and something
+// to detect/count some URIs _if possible_
+// NOTE: It's maybe danger to var_dump(result). [e.g. 'javascript:']
+// [OK] http://victim.example.org/?site:nasty.example.org
+// [OK] http://victim.example.org/nasty.example.org
+// [OK] http://victim.example.org/go?http%3A%2F%2Fnasty.example.org
+// [OK] http://victim.example.org/http://nasty.example.org
+function spam_uri_pickup_preprocess($string = '', $method = array())
+{
+ if (! is_string($string)) return '';
+
+ // rawurldecode(), just to catch encoded 'http://path/to/file', not to change '%20' to ' '
+ $string = strtr(
+ $string,
+ array(
+ '%3A' => ':',
+ '%3a' => ':',
+ '%2F' => '/',
+ '%2f' => '/',
+ '%5C' => '\\',
+ '%5c' => '\\',
+ )
+ );
-// ---- Show form and result
-echo basename(__FILE__) . '
';
-$msg = isset($_POST['msg']) ? $_POST['msg'] : '';
-show_form($msg);
+ $string = spam_uri_removing_hocus_pocus($string, $method);
-echo '';
-$results = spam_pickup($msg);
+ // Domain exposure (simple)
+ // http://victim.example.org/nasty.example.org/path#frag
+ // => http://nasty.example.org/?refer=victim.example.org and original
+ $string = preg_replace(
+ '#h?ttp://' .
+ '(' .
+ 'a9\.com/' . '|' .
+ 'aboutus\.org/' . '|' .
+ 'alexa\.com/data/details\?url=' . '|' .
+ 'ime\.(?:nu|st)/' . '|' . // 2ch.net
+ 'link\.toolbot\.com/' . '|' .
+ 'urlx\.org/' . '|' .
+ 'big5.51job.com/gate/big5/' . '|' .
+ 'big5.china.com/gate/big5/' . '|' .
+ 'big5.shippingchina.com:8080/' . '|' .
+ 'big5.xinhuanet.com/gate/big5/' . '|' .
+ 'bhomiyo.com/en.xliterate/' . '|' .
+ 'google.com/translate_c\?u=(?:http://)?' . '|' .
+ 'web.archive.org/web/2[^/]*/(?:http://)?' . '|' .
+ 'technorati.com/blogs/' .
+ ')' .
+ '([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . // nasty.example.org
+ '#i',
+ 'http://$2/?refer=$1 $0', // Preserve $0 or remove?
+ $string
+ );
-// Measure
-$count = count($results);
-$area = 0;
-foreach($results as $result)
- if (isset($result['area']))
- $area += $result['area'];
+ // Domain exposure (site:) See _preg_replace_callback_domain_exposure()
+ $string = preg_replace_callback(
+ array(
+ '#(h?ttp)://' . // 1:Scheme
+ // 2:Host
+ '(' .
+ '(?:[a-z0-9_.-]+\.)?[a-z0-9_-]+\.[a-z0-9_-]+' .
+ // Something Google: http://www.google.com/supported_domains
+ // AltaVista: http://es.altavista.com/web/results?q=site%3Anasty.example.org+foobar
+ // Live Search: search.live.com
+ // MySpace: http://sads.myspace.com/Modules/Search/Pages/Search.aspx?_snip_&searchString=site:nasty.example.org
+ // (also searchresults.myspace.com)
+ // alltheweb.com
+ // search.bbc.co.uk
+ // search.orange.co.uk
+ // ...
+ ')' .
+ '/' .
+ //TODO: Specify URL-enable characters
+ '([a-z0-9?=&.,%_/\'\\\+-]+)' . // 3:path/?query=foo+bar+
+ '(?:\b|%20)site:([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . // 4:site:nasty.example.com
+ '()' . // 5:Preserve or remove?
+ '#i',
+ ),
+ '_preg_replace_callback_domain_exposure',
+ $string
+ );
-echo "TOTAL = $count URIs, AREA_TOTAL = $area, AREA_AVERAGE = " . ($area / $count) . "" . "";
-var_dump($results);
-echo '';
+ // URI exposure (uriuri => uri uri)
+ $string = preg_replace(
+ array(
+ '#(?