From 6d9115fa8bc8f588e6f81b64ac28cb45ce7c7fcf Mon Sep 17 00:00:00 2001 From: henoheno Date: Mon, 2 Jul 2007 23:51:40 +0900 Subject: [PATCH] * Separate: spam.php => spam.php and spam_pickup.php, SpamTest.php => SpamTest.php and SpamPickupTest.php * Reorder some functions * Remove unused function: array_leaf() --- spam/SpamPickupTest.php | 353 ++++++++++++++++++ spam/SpamTest.php | 327 +---------------- spam/runner.php | 9 +- spam/spam.php | 957 ++++-------------------------------------------- spam/spam_pickup.php | 788 +++++++++++++++++++++++++++++++++++++++ 5 files changed, 1225 insertions(+), 1209 deletions(-) create mode 100644 spam/SpamPickupTest.php create mode 100644 spam/spam_pickup.php diff --git a/spam/SpamPickupTest.php b/spam/SpamPickupTest.php new file mode 100644 index 0000000..7e3be4a --- /dev/null +++ b/spam/SpamPickupTest.php @@ -0,0 +1,353 @@ + NULL, + '[TRUE]' => TRUE, + '[FALSE]' => FALSE, + '[array(foobar)]' => array('foobar'), + '[]' => '', + '[0]' => 0, + '[1]' => 1 + ); + } + + function testFunc_scheme_normalize() + { + // Null + foreach($this->setup_string_null() as $key => $value){ + $this->assertEquals('', scheme_normalize($value), $key); + } + + // CASE + $this->assertEquals('http', scheme_normalize('HTTP')); + + // Aliases + $this->assertEquals('pop3', scheme_normalize('pop')); + $this->assertEquals('nntp', scheme_normalize('news')); + $this->assertEquals('imap', scheme_normalize('imap4')); + $this->assertEquals('nntps', scheme_normalize('snntp')); + $this->assertEquals('nntps', scheme_normalize('snews')); + $this->assertEquals('pop3s', scheme_normalize('spop3')); + $this->assertEquals('pop3s', scheme_normalize('pops')); + + // Abbrevs + $this->assertEquals('http', scheme_normalize('ttp')); + $this->assertEquals('https', scheme_normalize('ttps')); + + // Abbrevs considererd harmless + $this->assertEquals('', scheme_normalize('ttp', FALSE)); + $this->assertEquals('', scheme_normalize('ttps', FALSE)); + } + + function testFunc_host_normalize() + { + // Null + foreach($this->setup_string_null() as $key => $value){ + $this->assertEquals('', host_normalize($value), $key); + } + + // Hostname is case-insensitive + $this->assertEquals('example.org', host_normalize('ExAMPle.ORG')); + + // Cut 'www' (destructive) + $this->assertEquals('example.org', host_normalize('WWW.example.org')); + } + + function testFunc_port_normalize() + { + $scheme = 'dont_care'; + + // 1st argument: Null + $this->assertEquals('', port_normalize(NULL, $scheme)); + $this->assertEquals('', port_normalize(TRUE, $scheme)); + $this->assertEquals('', port_normalize(FALSE, $scheme)); + $this->assertEquals('', port_normalize(array('foobar'), $scheme)); + $this->assertEquals('', port_normalize('', $scheme)); + + // 1st argument: Known port + $this->assertEquals('', port_normalize( -1, $scheme)); + $this->assertEquals(0, port_normalize( 0, $scheme)); + $this->assertEquals(1, port_normalize( 1, $scheme)); + $this->assertEquals('', port_normalize( 21, 'ftp')); + $this->assertEquals('', port_normalize( 22, 'ssh')); + $this->assertEquals('', port_normalize( 23, 'telnet')); + $this->assertEquals('', port_normalize( 25, 'smtp')); + $this->assertEquals('', port_normalize( 69, 'tftp')); + $this->assertEquals('', port_normalize( 70, 'gopher')); + $this->assertEquals('', port_normalize( 79, 'finger')); + $this->assertEquals('', port_normalize( 80, 'http')); + $this->assertEquals('', port_normalize( 110, 'pop3')); + $this->assertEquals('', port_normalize( 115, 'sftp')); + $this->assertEquals('', port_normalize( 119, 'nntp')); + $this->assertEquals('', port_normalize( 143, 'imap')); + $this->assertEquals('', port_normalize( 194, 'irc')); + $this->assertEquals('', port_normalize( 210, 'wais')); + $this->assertEquals('', port_normalize( 443, 'https')); + $this->assertEquals('', port_normalize( 563, 'nntps')); + $this->assertEquals('', port_normalize( 873, 'rsync')); + $this->assertEquals('', port_normalize( 990, 'ftps')); + $this->assertEquals('', port_normalize( 992, 'telnets')); + $this->assertEquals('', port_normalize( 993, 'imaps')); + $this->assertEquals('', port_normalize( 994, 'ircs')); + $this->assertEquals('', port_normalize( 995, 'pop3s')); + $this->assertEquals('', port_normalize( 3306, 'mysql')); + $this->assertEquals(8080, port_normalize( 8080, $scheme)); + $this->assertEquals(65535, port_normalize(65535, $scheme)); + $this->assertEquals(65536, port_normalize(65536, $scheme)); // Seems not invalid in RFC + + // 1st argument: Invalid type + $this->assertEquals('1x', port_normalize('001', $scheme) . 'x'); + $this->assertEquals('', port_normalize('+0', $scheme)); + $this->assertEquals('', port_normalize('0-1', $scheme)); // intval() says '0' + $this->assertEquals('', port_normalize('str', $scheme)); + + // 2nd and 3rd argument: Null + $this->assertEquals(80, port_normalize(80, NULL, TRUE)); + $this->assertEquals(80, port_normalize(80, TRUE, TRUE)); + $this->assertEquals(80, port_normalize(80, FALSE, TRUE)); + $this->assertEquals(80, port_normalize(80, array('foobar'), TRUE)); + $this->assertEquals(80, port_normalize(80, '', TRUE)); + + // 2nd and 3rd argument: Do $scheme_normalize + $this->assertEquals('', port_normalize(80, 'TTP', TRUE)); + $this->assertEquals('', port_normalize(110, 'POP', TRUE)); + $this->assertEquals(80, port_normalize(80, 'HTTP', FALSE)); + } + + function testFunc_path_normalize() + { + // 1st argument: Null + foreach($this->setup_string_null() as $key => $value){ + $this->assertEquals('/', path_normalize($value), $key); + } + + // 1st argument: CASE sensitive + $this->assertEquals('/ExAMPle', path_normalize('ExAMPle')); + $this->assertEquals('/#hoge', path_normalize('#hoge')); + $this->assertEquals('/a/b/c/d', path_normalize('/a/b/./c////./d')); + $this->assertEquals('/b/', path_normalize('/a/../../../b/')); + + // 2nd argument + $this->assertEquals('\\b\\c\\d\\', path_normalize('\\a\\..\\b\\.\\c\\\\.\\d\\', '\\')); + $this->assertEquals('str1str3str', path_normalize('str1strstr2str..str3str', 'str')); + $this->assertEquals('/do/../nothing/', path_normalize('/do/../nothing/', TRUE)); + $this->assertEquals('/do/../nothing/', path_normalize('/do/../nothing/', array('a'))); + $this->assertEquals('', path_normalize(array('a'), array('b'))); + } + + function testFunc_query_normalize() + { + // 1st argument: Null + foreach($this->setup_string_null() as $key => $value){ + $this->assertEquals('', query_normalize($value), $key); + } + + $this->assertEquals('a=0dd&b&c&d&f=d', query_normalize('&&&&f=d&b&d&c&a=0dd')); + $this->assertEquals('eg=foobar', query_normalize('nothing==&eg=dummy&eg=padding&eg=foobar')); + } + + function testFunc_file_normalize() + { + // 1st argument: Null + foreach($this->setup_string_null() as $key => $value){ + $this->assertEquals('', file_normalize($value), $key); + } + + // 1st argument: Cut DirectoryIndexes (Destructive) + foreach(array( + 'default.htm', + 'default.html', + 'default.asp', + 'default.aspx', + 'index', + 'index.htm', + 'index.html', + 'index.shtml', + 'index.jsp', + 'index.php', + 'index.php', + 'index.php3', + 'index.php4', + 'index.pl', + 'index.py', + 'index.rb', + 'index.cgi', + + // Apache 2.0.59 default 'index.html' variants + 'index.html.ca', + 'index.html.cz.iso8859-2', + 'index.html.de', + 'index.html.dk', + 'index.html.ee', + 'index.html.el', + 'index.html.en', + 'index.html.es', + 'index.html.et', + 'index.html.fr', + 'index.html.he.iso8859-8', + 'index.html.hr.iso8859-2', + 'index.html.it', + 'index.html.ja.iso2022-jp', + 'index.html.ko.euc-kr', + 'index.html.lb.utf8', + 'index.html.nl', + 'index.html.nn', + 'index.html.no', + 'index.html.po.iso8859-2', + 'index.html.pt', + 'index.html.pt-br', + 'index.html.ru.cp866', + 'index.html.ru.cp-1251', + 'index.html.ru.iso-ru', + 'index.html.ru.koi8-r', + 'index.html.ru.utf8', + 'index.html.sv', + 'index.html.var', // default + 'index.html.zh-cn.gb2312', + 'index.html.zh-tw.big5', + + 'index.html.po.iso8859-2', + 'index.html.zh-tw.big5', + + 'index.ja.en.de.html', + + // .gz + 'index.html.ca.gz', + 'index.html.en.ja.ca.z', + ) as $arg){ + $this->assertEquals('', file_normalize($arg)); + } + + //$this->assertEquals('foo/', file_normalize('foo/index.html')); + + //$this->assertEquals('ExAMPle', file_normalize('ExAMPle')); + //$this->assertEquals('exe.exe', file_normalize('exe.exe')); + //$this->assertEquals('sample.html', file_normalize('sample.html.en')); + //$this->assertEquals('sample.html', file_normalize('sample.html.pt-br')); + //$this->assertEquals('sample.html', file_normalize('sample.html.po.iso8859-2')); + //$this->assertEquals('sample.html', file_normalize('sample.html.zh-tw.big5')); + } + + function testFunc_uri_pickup() + { + // 1st argument: Null + foreach($this->setup_string_null() as $key => $value){ + $this->assertEquals(0, count(uri_pickup($value)), $key); + } + + // 1st argument: Some + $test_string = <<assertEquals(5, count($results)); + + // ttp://wwW.Example.Org:80#TTP_and_www + $this->assertEquals('http', $results[0]['scheme']); + $this->assertEquals('', $results[0]['userinfo']); + $this->assertEquals('example.org', $results[0]['host']); + $this->assertEquals('', $results[0]['port']); + $this->assertEquals('/', $results[0]['path']); + $this->assertEquals('', $results[0]['file']); + $this->assertEquals('', $results[0]['query']); + $this->assertEquals('ttp_and_www', $results[0]['fragment']); + + // https://nasty.example.org:443/foo/xxx#port443/slash + $this->assertEquals('https', $results[1]['scheme']); + $this->assertEquals('', $results[1]['userinfo']); + $this->assertEquals('nasty.example.org', $results[1]['host']); + $this->assertEquals('', $results[1]['port']); + $this->assertEquals('/foo/', $results[1]['path']); + $this->assertEquals('xxx', $results[1]['file']); + $this->assertEquals('', $results[1]['query']); + $this->assertEquals('port443', $results[1]['fragment']); + + // sftp://foobar.example.org:80/dfsdfs#sftp_bat_port80 + $this->assertEquals('sftp', $results[2]['scheme']); + $this->assertEquals('', $results[2]['userinfo']); + $this->assertEquals('foobar.example.org', $results[2]['host']); + $this->assertEquals('80', $results[2]['port']); + $this->assertEquals('/', $results[2]['path']); + $this->assertEquals('dfsdfs', $results[2]['file']); + $this->assertEquals('', $results[2]['query']); + $this->assertEquals('ftp_bat_port80', $results[2]['fragment']); + + // ftp://cnn.example.com&story=breaking_news@10.0.0.1/top_story.htm + $this->assertEquals('ftp', $results[3]['scheme']); + $this->assertEquals('cnn.example.com&story=breaking_news', $results[3]['userinfo']); + $this->assertEquals('10.0.0.1', $results[3]['host']); + $this->assertEquals('', $results[3]['port']); + $this->assertEquals('/', $results[3]['path']); + $this->assertEquals('top_story.htm', $results[3]['file']); + $this->assertEquals('', $results[3]['query']); + $this->assertEquals('', $results[3]['fragment']); + + + // Specific tests ---- + + // Divider: Back-slash + $test_string = ' http:\\backslash.org\fobar.html '; + $results = uri_pickup_normalize(uri_pickup($test_string)); + $this->assertEquals('backslash.org', $results[0]['host']); + + // Host: Underscore + $test_string = ' http://under_score.org/fobar.html '; + $results = uri_pickup_normalize(uri_pickup($test_string)); + $this->assertEquals('under_score.org',$results[0]['host']); // Not 'under' + + // Host: IPv4 + $test_string = ' http://192.168.0.1/fobar.html '; + $results = uri_pickup_normalize(uri_pickup($test_string)); + $this->assertEquals('192.168.0.1', $results[0]['host']); + + // Host: Starts + $test_string = ' http://_sss/foo.html '; + $results = uri_pickup_normalize(uri_pickup($test_string)); + $this->assertEquals('_sss', $results[0]['host']); + $this->assertEquals('foo.html', $results[0]['file']); + + // Host: Ends + $test_string = ' http://sss_/foo.html '; + $results = uri_pickup_normalize(uri_pickup($test_string)); + $this->assertEquals('sss_', $results[0]['host']); + $this->assertEquals('foo.html', $results[0]['file']); + + + // Specific tests ---- Fails + + // Divider: Colon only (Too sensitive to capture) + $test_string = ' http:colon.org '; + $results = uri_pickup_normalize(uri_pickup($test_string)); + $this->assertEquals(0, count($results)); + + // Host: Too short + $test_string = ' http://s/foo.html http://ss/foo.html '; + $results = uri_pickup_normalize(uri_pickup($test_string)); + $this->assertEquals(0, count($results)); + + $test_string = ' http://sss/foo.html '; + $results = uri_pickup_normalize(uri_pickup($test_string)); + $this->assertEquals('sss', $results[0]['host']); + $this->assertEquals('foo.html', $results[0]['file']); + } + +} + +?> \ No newline at end of file diff --git a/spam/SpamTest.php b/spam/SpamTest.php index 20171a4..8112909 100644 --- a/spam/SpamTest.php +++ b/spam/SpamTest.php @@ -1,5 +1,5 @@ assertEquals(array('b' => array('k3')), $result); } - function testFunc_uri_pickup() - { - // 1st argument: Null - foreach($this->setup_string_null() as $key => $value){ - $this->assertEquals(0, count(uri_pickup($value)), $key); - } - - // 1st argument: Some - $test_string = <<assertEquals(5, count($results)); - - // ttp://wwW.Example.Org:80#TTP_and_www - $this->assertEquals('http', $results[0]['scheme']); - $this->assertEquals('', $results[0]['userinfo']); - $this->assertEquals('example.org', $results[0]['host']); - $this->assertEquals('', $results[0]['port']); - $this->assertEquals('/', $results[0]['path']); - $this->assertEquals('', $results[0]['file']); - $this->assertEquals('', $results[0]['query']); - $this->assertEquals('ttp_and_www', $results[0]['fragment']); - - // https://nasty.example.org:443/foo/xxx#port443/slash - $this->assertEquals('https', $results[1]['scheme']); - $this->assertEquals('', $results[1]['userinfo']); - $this->assertEquals('nasty.example.org', $results[1]['host']); - $this->assertEquals('', $results[1]['port']); - $this->assertEquals('/foo/', $results[1]['path']); - $this->assertEquals('xxx', $results[1]['file']); - $this->assertEquals('', $results[1]['query']); - $this->assertEquals('port443', $results[1]['fragment']); - - // sftp://foobar.example.org:80/dfsdfs#sftp_bat_port80 - $this->assertEquals('sftp', $results[2]['scheme']); - $this->assertEquals('', $results[2]['userinfo']); - $this->assertEquals('foobar.example.org', $results[2]['host']); - $this->assertEquals('80', $results[2]['port']); - $this->assertEquals('/', $results[2]['path']); - $this->assertEquals('dfsdfs', $results[2]['file']); - $this->assertEquals('', $results[2]['query']); - $this->assertEquals('ftp_bat_port80', $results[2]['fragment']); - - // ftp://cnn.example.com&story=breaking_news@10.0.0.1/top_story.htm - $this->assertEquals('ftp', $results[3]['scheme']); - $this->assertEquals('cnn.example.com&story=breaking_news', $results[3]['userinfo']); - $this->assertEquals('10.0.0.1', $results[3]['host']); - $this->assertEquals('', $results[3]['port']); - $this->assertEquals('/', $results[3]['path']); - $this->assertEquals('top_story.htm', $results[3]['file']); - $this->assertEquals('', $results[3]['query']); - $this->assertEquals('', $results[3]['fragment']); - - - // Specific tests ---- - - // Divider: Back-slash - $test_string = ' http:\\backslash.org\fobar.html '; - $results = uri_pickup_normalize(uri_pickup($test_string)); - $this->assertEquals('backslash.org', $results[0]['host']); - - // Host: Underscore - $test_string = ' http://under_score.org/fobar.html '; - $results = uri_pickup_normalize(uri_pickup($test_string)); - $this->assertEquals('under_score.org',$results[0]['host']); // Not 'under' - - // Host: IPv4 - $test_string = ' http://192.168.0.1/fobar.html '; - $results = uri_pickup_normalize(uri_pickup($test_string)); - $this->assertEquals('192.168.0.1', $results[0]['host']); - - // Host: Starts - $test_string = ' http://_sss/foo.html '; - $results = uri_pickup_normalize(uri_pickup($test_string)); - $this->assertEquals('_sss', $results[0]['host']); - $this->assertEquals('foo.html', $results[0]['file']); - - // Host: Ends - $test_string = ' http://sss_/foo.html '; - $results = uri_pickup_normalize(uri_pickup($test_string)); - $this->assertEquals('sss_', $results[0]['host']); - $this->assertEquals('foo.html', $results[0]['file']); - - - // Specific tests ---- Fails - - // Divider: Colon only (Too sensitive to capture) - $test_string = ' http:colon.org '; - $results = uri_pickup_normalize(uri_pickup($test_string)); - $this->assertEquals(0, count($results)); - - // Host: Too short - $test_string = ' http://s/foo.html http://ss/foo.html '; - $results = uri_pickup_normalize(uri_pickup($test_string)); - $this->assertEquals(0, count($results)); - - $test_string = ' http://sss/foo.html '; - $results = uri_pickup_normalize(uri_pickup($test_string)); - $this->assertEquals('sss', $results[0]['host']); - $this->assertEquals('foo.html', $results[0]['file']); - } - - function testFunc_scheme_normalize() - { - // Null - foreach($this->setup_string_null() as $key => $value){ - $this->assertEquals('', scheme_normalize($value), $key); - } - - // CASE - $this->assertEquals('http', scheme_normalize('HTTP')); - - // Aliases - $this->assertEquals('pop3', scheme_normalize('pop')); - $this->assertEquals('nntp', scheme_normalize('news')); - $this->assertEquals('imap', scheme_normalize('imap4')); - $this->assertEquals('nntps', scheme_normalize('snntp')); - $this->assertEquals('nntps', scheme_normalize('snews')); - $this->assertEquals('pop3s', scheme_normalize('spop3')); - $this->assertEquals('pop3s', scheme_normalize('pops')); - - // Abbrevs - $this->assertEquals('http', scheme_normalize('ttp')); - $this->assertEquals('https', scheme_normalize('ttps')); - - // Abbrevs considererd harmless - $this->assertEquals('', scheme_normalize('ttp', FALSE)); - $this->assertEquals('', scheme_normalize('ttps', FALSE)); - } - - function testFunc_host_normalize() - { - // Null - foreach($this->setup_string_null() as $key => $value){ - $this->assertEquals('', host_normalize($value), $key); - } - - // Hostname is case-insensitive - $this->assertEquals('example.org', host_normalize('ExAMPle.ORG')); - - // Cut 'www' (destructive) - $this->assertEquals('example.org', host_normalize('WWW.example.org')); - } - - function testFunc_port_normalize() - { - $scheme = 'dont_care'; - - // 1st argument: Null - $this->assertEquals('', port_normalize(NULL, $scheme)); - $this->assertEquals('', port_normalize(TRUE, $scheme)); - $this->assertEquals('', port_normalize(FALSE, $scheme)); - $this->assertEquals('', port_normalize(array('foobar'), $scheme)); - $this->assertEquals('', port_normalize('', $scheme)); - - // 1st argument: Known port - $this->assertEquals('', port_normalize( -1, $scheme)); - $this->assertEquals(0, port_normalize( 0, $scheme)); - $this->assertEquals(1, port_normalize( 1, $scheme)); - $this->assertEquals('', port_normalize( 21, 'ftp')); - $this->assertEquals('', port_normalize( 22, 'ssh')); - $this->assertEquals('', port_normalize( 23, 'telnet')); - $this->assertEquals('', port_normalize( 25, 'smtp')); - $this->assertEquals('', port_normalize( 69, 'tftp')); - $this->assertEquals('', port_normalize( 70, 'gopher')); - $this->assertEquals('', port_normalize( 79, 'finger')); - $this->assertEquals('', port_normalize( 80, 'http')); - $this->assertEquals('', port_normalize( 110, 'pop3')); - $this->assertEquals('', port_normalize( 115, 'sftp')); - $this->assertEquals('', port_normalize( 119, 'nntp')); - $this->assertEquals('', port_normalize( 143, 'imap')); - $this->assertEquals('', port_normalize( 194, 'irc')); - $this->assertEquals('', port_normalize( 210, 'wais')); - $this->assertEquals('', port_normalize( 443, 'https')); - $this->assertEquals('', port_normalize( 563, 'nntps')); - $this->assertEquals('', port_normalize( 873, 'rsync')); - $this->assertEquals('', port_normalize( 990, 'ftps')); - $this->assertEquals('', port_normalize( 992, 'telnets')); - $this->assertEquals('', port_normalize( 993, 'imaps')); - $this->assertEquals('', port_normalize( 994, 'ircs')); - $this->assertEquals('', port_normalize( 995, 'pop3s')); - $this->assertEquals('', port_normalize( 3306, 'mysql')); - $this->assertEquals(8080, port_normalize( 8080, $scheme)); - $this->assertEquals(65535, port_normalize(65535, $scheme)); - $this->assertEquals(65536, port_normalize(65536, $scheme)); // Seems not invalid in RFC - - // 1st argument: Invalid type - $this->assertEquals('1x', port_normalize('001', $scheme) . 'x'); - $this->assertEquals('', port_normalize('+0', $scheme)); - $this->assertEquals('', port_normalize('0-1', $scheme)); // intval() says '0' - $this->assertEquals('', port_normalize('str', $scheme)); - - // 2nd and 3rd argument: Null - $this->assertEquals(80, port_normalize(80, NULL, TRUE)); - $this->assertEquals(80, port_normalize(80, TRUE, TRUE)); - $this->assertEquals(80, port_normalize(80, FALSE, TRUE)); - $this->assertEquals(80, port_normalize(80, array('foobar'), TRUE)); - $this->assertEquals(80, port_normalize(80, '', TRUE)); - - // 2nd and 3rd argument: Do $scheme_normalize - $this->assertEquals('', port_normalize(80, 'TTP', TRUE)); - $this->assertEquals('', port_normalize(110, 'POP', TRUE)); - $this->assertEquals(80, port_normalize(80, 'HTTP', FALSE)); - } - - function testFunc_path_normalize() - { - // 1st argument: Null - foreach($this->setup_string_null() as $key => $value){ - $this->assertEquals('/', path_normalize($value), $key); - } - - // 1st argument: CASE sensitive - $this->assertEquals('/ExAMPle', path_normalize('ExAMPle')); - $this->assertEquals('/#hoge', path_normalize('#hoge')); - $this->assertEquals('/a/b/c/d', path_normalize('/a/b/./c////./d')); - $this->assertEquals('/b/', path_normalize('/a/../../../b/')); - - // 2nd argument - $this->assertEquals('\\b\\c\\d\\', path_normalize('\\a\\..\\b\\.\\c\\\\.\\d\\', '\\')); - $this->assertEquals('str1str3str', path_normalize('str1strstr2str..str3str', 'str')); - $this->assertEquals('/do/../nothing/', path_normalize('/do/../nothing/', TRUE)); - $this->assertEquals('/do/../nothing/', path_normalize('/do/../nothing/', array('a'))); - $this->assertEquals('', path_normalize(array('a'), array('b'))); - } - - function testFunc_file_normalize() - { - // 1st argument: Null - foreach($this->setup_string_null() as $key => $value){ - $this->assertEquals('', file_normalize($value), $key); - } - - // 1st argument: Cut DirectoryIndexes (Destructive) - foreach(array( - 'default.htm', - 'default.html', - 'default.asp', - 'default.aspx', - 'index', - 'index.htm', - 'index.html', - 'index.shtml', - 'index.jsp', - 'index.php', - 'index.php', - 'index.php3', - 'index.php4', - 'index.pl', - 'index.py', - 'index.rb', - 'index.cgi', - - // Apache 2.0.59 default 'index.html' variants - 'index.html.ca', - 'index.html.cz.iso8859-2', - 'index.html.de', - 'index.html.dk', - 'index.html.ee', - 'index.html.el', - 'index.html.en', - 'index.html.es', - 'index.html.et', - 'index.html.fr', - 'index.html.he.iso8859-8', - 'index.html.hr.iso8859-2', - 'index.html.it', - 'index.html.ja.iso2022-jp', - 'index.html.ko.euc-kr', - 'index.html.lb.utf8', - 'index.html.nl', - 'index.html.nn', - 'index.html.no', - 'index.html.po.iso8859-2', - 'index.html.pt', - 'index.html.pt-br', - 'index.html.ru.cp866', - 'index.html.ru.cp-1251', - 'index.html.ru.iso-ru', - 'index.html.ru.koi8-r', - 'index.html.ru.utf8', - 'index.html.sv', - 'index.html.var', // default - 'index.html.zh-cn.gb2312', - 'index.html.zh-tw.big5', - - 'index.html.po.iso8859-2', - 'index.html.zh-tw.big5', - - 'index.ja.en.de.html', - - // .gz - 'index.html.ca.gz', - 'index.html.en.ja.ca.z', - ) as $arg){ - $this->assertEquals('', file_normalize($arg)); - } - - //$this->assertEquals('foo/', file_normalize('foo/index.html')); - - //$this->assertEquals('ExAMPle', file_normalize('ExAMPle')); - //$this->assertEquals('exe.exe', file_normalize('exe.exe')); - //$this->assertEquals('sample.html', file_normalize('sample.html.en')); - //$this->assertEquals('sample.html', file_normalize('sample.html.pt-br')); - //$this->assertEquals('sample.html', file_normalize('sample.html.po.iso8859-2')); - //$this->assertEquals('sample.html', file_normalize('sample.html.zh-tw.big5')); - } - - function testFunc_query_normalize() - { - // 1st argument: Null - foreach($this->setup_string_null() as $key => $value){ - $this->assertEquals('', query_normalize($value), $key); - } - - $this->assertEquals('a=0dd&b&c&d&f=d', query_normalize('&&&&f=d&b&d&c&a=0dd')); - $this->assertEquals('eg=foobar', query_normalize('nothing==&eg=dummy&eg=padding&eg=foobar')); - } - function testFunc_generate_glob_regex() { // 1st argument: Null @@ -617,7 +293,6 @@ EOF; $this->assertTrue(isset($array['IANA-examples'])); } - function testFunc_whois_responsibility() { // 1st argument: Null diff --git a/spam/runner.php b/spam/runner.php index d2e74e7..8474d3b 100644 --- a/spam/runner.php +++ b/spam/runner.php @@ -1,15 +1,20 @@ show(); diff --git a/spam/spam.php b/spam/spam.php index 0f32471..27094f4 100644 --- a/spam/spam.php +++ b/spam/spam.php @@ -1,5 +1,5 @@ = 4.3.0): preg_match_all(PREG_OFFSET_CAPTURE): $method['uri_XXX'] related feature +require_once('spam_pickup.php'); + if (! defined('SPAM_INI_FILE')) define('SPAM_INI_FILE', 'spam.ini.php'); if (! defined('DOMAIN_INI_FILE')) define('DOMAIN_INI_FILE', 'domain.ini.php'); @@ -38,7 +40,9 @@ function preg_grep_invert($pattern = '//', $input = array()) } } -// ---- + +// --------------------- +// Utilities // Very roughly, shrink the lines of var_export() // NOTE: If the same data exists, it must be corrupted. @@ -68,41 +72,29 @@ function var_export_shrink($expression, $return = FALSE, $ignore_numeric_keys = } } -// Remove redundant values from array() -function array_unique_recursive($array = array()) +// Reverse $string with specified delimiter +function delimiter_reverse($string = 'foo.bar.example.com', $from_delim = '.', $to_delim = '.') { - if (! is_array($array)) return $array; - - $tmp = array(); - foreach($array as $key => $value){ - if (is_array($value)) { - $array[$key] = array_unique_recursive($value); - } else { - if (isset($tmp[$value])) { - unset($array[$key]); - } else { - $tmp[$value] = TRUE; - } - } - } + if (! is_string($string) || ! is_string($from_delim) || ! is_string($to_delim)) + return $string; - return $array; + // com.example.bar.foo + return implode($to_delim, array_reverse(explode($from_delim, $string))); } -// Renumber all numeric keys from 0 -function array_renumber_numeric_keys(& $array) +// ksort() by domain +function ksort_by_domain(& $array) { - if (! is_array($array)) return $array; - - $count = -1; - $tmp = array(); - foreach($array as $key => $value){ - if (is_array($value)) array_renumber_numeric_keys($array[$key]); // Recurse - if (is_numeric($key)) $tmp[$key] = ++$count; + $sort = array(); + foreach(array_keys($array) as $key) { + $sort[delimiter_reverse($key)] = $key; } - array_rename_keys($array, $tmp); - - return $array; + ksort($sort, SORT_STRING); + $result = array(); + foreach($sort as $key) { + $result[$key] = & $array[$key]; + } + $array = $result; } // Roughly strings(1) using PCRE @@ -154,154 +146,41 @@ function strings($binary = '', $min_len = 4, $ignore_space = FALSE, $multibyte = return $binary; } -// Reverse $string with specified delimiter -function delimiter_reverse($string = 'foo.bar.example.com', $from_delim = '.', $to_delim = '.') -{ - if (! is_string($string) || ! is_string($from_delim) || ! is_string($to_delim)) - return $string; - - // com.example.bar.foo - return implode($to_delim, array_reverse(explode($from_delim, $string))); -} - // --------------------- -// URI pickup - -// Return an array of URIs in the $string -// [OK] http://nasty.example.org#nasty_string -// [OK] http://nasty.example.org:80/foo/xxx#nasty_string/bar -// [OK] ftp://nasty.example.org:80/dfsdfs -// [OK] ftp://cnn.example.com&story=breaking_news@10.0.0.1/top_story.htm (from RFC3986) -function uri_pickup($string = '') -{ - if (! is_string($string)) return array(); - - // Not available for: IDN(ignored) - $array = array(); - preg_match_all( - // scheme://userinfo@host:port/path/or/pathinfo/maybefile.and?query=string#fragment - // Refer RFC3986 (Regex below is not strict) - '#(\b[a-z][a-z0-9.+-]{1,8}):[/\\\]+' . // 1: Scheme - '(?:' . - '([^\s<>"\'\[\]/\#?@]*)' . // 2: Userinfo (Username) - '@)?' . - '(' . - // 3: Host - '\[[0-9a-f:.]+\]' . '|' . // IPv6([colon-hex and dot]): RFC2732 - '(?:[0-9]{1,3}\.){3}[0-9]{1,3}' . '|' . // IPv4(dot-decimal): 001.22.3.44 - '[a-z0-9_-][a-z0-9_.-]+[a-z0-9_-]' . // hostname(FQDN) : foo.example.org - ')' . - '(?::([0-9]*))?' . // 4: Port - '((?:/+[^\s<>"\'\[\]/\#]+)*/+)?' . // 5: Directory path or path-info - '([^\s<>"\'\[\]\#?]+)?' . // 6: File? - '(?:\?([^\s<>"\'\[\]\#]+))?' . // 7: Query string - '(?:\#([a-z0-9._~%!$&\'()*+,;=:@-]*))?' . // 8: Fragment - '#i', - $string, $array, PREG_SET_ORDER | PREG_OFFSET_CAPTURE - ); +// Utilities: Arrays - // Format the $array - static $parts = array( - 1 => 'scheme', 2 => 'userinfo', 3 => 'host', 4 => 'port', - 5 => 'path', 6 => 'file', 7 => 'query', 8 => 'fragment' - ); - $default = array(''); - foreach(array_keys($array) as $uri) { - $_uri = & $array[$uri]; - array_rename_keys($_uri, $parts, TRUE, $default); - $offset = $_uri['scheme'][1]; // Scheme's offset = URI's offset - foreach(array_keys($_uri) as $part) { - $_uri[$part] = & $_uri[$part][0]; // Remove offsets - } - } - - foreach(array_keys($array) as $uri) { - $_uri = & $array[$uri]; - if ($_uri['scheme'] === '') { - unset($array[$uri]); // Considererd harmless - continue; - } - unset($_uri[0]); // Matched string itself - $_uri['area']['offset'] = $offset; // Area offset for area_measure() - } - - return $array; -} - -// Normalize an array of URI arrays -// NOTE: Give me the uri_pickup() results -function uri_pickup_normalize(& $pickups, $destructive = TRUE) +// Count leaves (A leaf = value that is not an array, or an empty array) +function array_count_leaves($array = array(), $count_empty = FALSE) { - if (! is_array($pickups)) return $pickups; + if (! is_array($array) || (empty($array) && $count_empty)) return 1; - if ($destructive) { - foreach (array_keys($pickups) as $key) { - $_key = & $pickups[$key]; - $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : ''; - $_key['host'] = isset($_key['host']) ? host_normalize($_key['host']) : ''; - $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : ''; - $_key['path'] = isset($_key['path']) ? strtolower(path_normalize($_key['path'])) : ''; - $_key['file'] = isset($_key['file']) ? file_normalize($_key['file']) : ''; - $_key['query'] = isset($_key['query']) ? query_normalize($_key['query']) : ''; - $_key['fragment'] = isset($_key['fragment']) ? strtolower($_key['fragment']) : ''; - } - } else { - foreach (array_keys($pickups) as $key) { - $_key = & $pickups[$key]; - $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : ''; - $_key['host'] = isset($_key['host']) ? strtolower($_key['host']) : ''; - $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : ''; - $_key['path'] = isset($_key['path']) ? path_normalize($_key['path']) : ''; - } + // Recurse + $count = 0; + foreach ($array as $part) { + $count += array_count_leaves($part, $count_empty); } - - return $pickups; + return $count; } -// An URI array => An URI (See uri_pickup()) -// USAGE: -// $pickups = uri_pickup('a string include some URIs'); -// $uris = array(); -// foreach (array_keys($pickups) as $key) { -// $uris[$key] = uri_pickup_implode($pickups[$key]); -// } -function uri_pickup_implode($uri = array()) +// An array-leaves to a flat array +function array_flat_leaves($array, $unique = TRUE) { - if (empty($uri) || ! is_array($uri)) return NULL; + if (! is_array($array)) return $array; $tmp = array(); - if (isset($uri['scheme']) && $uri['scheme'] !== '') { - $tmp[] = & $uri['scheme']; - $tmp[] = '://'; - } - if (isset($uri['userinfo']) && $uri['userinfo'] !== '') { - $tmp[] = & $uri['userinfo']; - $tmp[] = '@'; - } - if (isset($uri['host']) && $uri['host'] !== '') { - $tmp[] = & $uri['host']; - } - if (isset($uri['port']) && $uri['port'] !== '') { - $tmp[] = ':'; - $tmp[] = & $uri['port']; - } - if (isset($uri['path']) && $uri['path'] !== '') { - $tmp[] = & $uri['path']; - } - if (isset($uri['file']) && $uri['file'] !== '') { - $tmp[] = & $uri['file']; - } - if (isset($uri['query']) && $uri['query'] !== '') { - $tmp[] = '?'; - $tmp[] = & $uri['query']; - } - if (isset($uri['fragment']) && $uri['fragment'] !== '') { - $tmp[] = '#'; - $tmp[] = & $uri['fragment']; + foreach(array_keys($array) as $key) { + if (is_array($array[$key])) { + // Recurse + foreach(array_flat_leaves($array[$key]) as $_value) { + $tmp[] = $_value; + } + } else { + $tmp[] = & $array[$key]; + } } - return implode('', $tmp); + return $unique ? array_values(array_unique($tmp)) : $tmp; } // $array['something'] => $array['wanted'] @@ -328,646 +207,28 @@ function array_rename_keys(& $array, $keys = array('from' => 'to'), $force = FAL return TRUE; } -// --------------------- -// Area pickup - -// Pickup all of markup areas -function area_pickup($string = '', $method = array()) -{ - $area = array(); - if (empty($method)) return $area; - - // Anchor tag pair by preg_match and preg_match_all() - // [OK] - // [OK] Good site! - // [OK] test - // [OK] visit http://nasty.example.com/ - // [OK] discount foobar - // [NG] visit http://ng.example.com _not_ended_ - $regex = '#]*\bhref\b[^>]*>.*?]*(>)#is'; - if (isset($method['area_anchor'])) { - $areas = array(); - $count = isset($method['asap']) ? - preg_match($regex, $string) : - preg_match_all($regex, $string, $areas); - if (! empty($count)) $area['area_anchor'] = $count; - } - if (isset($method['uri_anchor'])) { - $areas = array(); - preg_match_all($regex, $string, $areas, PREG_SET_ORDER | PREG_OFFSET_CAPTURE); - foreach(array_keys($areas) as $_area) { - $areas[$_area] = array( - $areas[$_area][0][1], // Area start () - $areas[$_area][1][1], // Area end () - ); - } - if (! empty($areas)) $area['uri_anchor'] = $areas; - } - - // phpBB's "BBCode" pair by preg_match and preg_match_all() - // [OK] [url][/url] - // [OK] [url]http://nasty.example.com/[/url] - // [OK] [link]http://nasty.example.com/[/link] - // [OK] [url=http://nasty.example.com]visit http://nasty.example.com/[/url] - // [OK] [link http://nasty.example.com/]buy something[/link] - $regex = '#\[(url|link)\b[^\]]*\].*?\[/\1\b[^\]]*(\])#is'; - if (isset($method['area_bbcode'])) { - $areas = array(); - $count = isset($method['asap']) ? - preg_match($regex, $string) : - preg_match_all($regex, $string, $areas, PREG_SET_ORDER); - if (! empty($count)) $area['area_bbcode'] = $count; - } - if (isset($method['uri_bbcode'])) { - $areas = array(); - preg_match_all($regex, $string, $areas, PREG_SET_ORDER | PREG_OFFSET_CAPTURE); - foreach(array_keys($areas) as $_area) { - $areas[$_area] = array( - $areas[$_area][0][1], // Area start ([url]) - $areas[$_area][2][1], // Area end ([/url]) - ); - } - if (! empty($areas)) $area['uri_bbcode'] = $areas; - } - - // Various Wiki syntax - // [text_or_uri>text_or_uri] - // [text_or_uri:text_or_uri] - // [text_or_uri|text_or_uri] - // [text_or_uri->text_or_uri] - // [text_or_uri text_or_uri] // MediaWiki - // MediaWiki: [http://nasty.example.com/ visit http://nasty.example.com/] - - return $area; -} - -// If in doubt, it's a little doubtful -// if (Area => inside <= Area) $brief += -1 -function area_measure($areas, & $array, $belief = -1, $a_key = 'area', $o_key = 'offset') -{ - if (! is_array($areas) || ! is_array($array)) return; - - $areas_keys = array_keys($areas); - foreach(array_keys($array) as $u_index) { - $offset = isset($array[$u_index][$o_key]) ? - intval($array[$u_index][$o_key]) : 0; - foreach($areas_keys as $a_index) { - if (isset($array[$u_index][$a_key])) { - $offset_s = intval($areas[$a_index][0]); - $offset_e = intval($areas[$a_index][1]); - // [Area => inside <= Area] - if ($offset_s < $offset && $offset < $offset_e) { - $array[$u_index][$a_key] += $belief; - } - } - } - } -} - -// --------------------- -// Spam-uri pickup - -// Preprocess: Removing uninterest part for URI detection -function spam_uri_removing_hocus_pocus($binary = '', $method = array()) -{ - $length = 4 ; // 'http'(1) and '://'(2) and 'fqdn'(1) - if (is_array($method)) { - // ''(1) or ''(4) - // '[uri'(4) or ']'(1) or '[/uri]'(6) - if (isset($method['area_anchor']) || isset($method['uri_anchor']) || - isset($method['area_bbcode']) || isset($method['uri_bbcode'])) - $length = 1; // Seems not effective - } - - // Removing sequential spaces and too short lines - $binary = strings($binary, $length, TRUE, FALSE); // Multibyte NOT needed - - // Remove words (has no '<>[]:') between spaces - $binary = preg_replace('/[ \t][\w.,()\ \t]+[ \t]/', ' ', $binary); - - return $binary; -} - -// Preprocess: Domain exposure callback (See spam_uri_pickup_preprocess()) -// http://victim.example.org/?foo+site:nasty.example.com+bar -// => http://nasty.example.com/?refer=victim.example.org -// NOTE: 'refer=' is not so good for (at this time). -// Consider about using IP address of the victim, try to avoid that. -function _preg_replace_callback_domain_exposure($matches = array()) -{ - $result = ''; - - // Preserve the victim URI as a complicity or ... - if (isset($matches[5])) { - $result = - $matches[1] . '://' . // scheme - $matches[2] . '/' . // victim.example.org - $matches[3]; // The rest of all (before victim) - } - - // Flipped URI - if (isset($matches[4])) { - $result = - $matches[1] . '://' . // scheme - $matches[4] . // nasty.example.com - '/?refer=' . strtolower($matches[2]) . // victim.example.org - ' ' . $result; - } - - return $result; -} - -// Preprocess: rawurldecode() and adding space(s) and something -// to detect/count some URIs _if possible_ -// NOTE: It's maybe danger to var_dump(result). [e.g. 'javascript:'] -// [OK] http://victim.example.org/?site:nasty.example.org -// [OK] http://victim.example.org/nasty.example.org -// [OK] http://victim.example.org/go?http%3A%2F%2Fnasty.example.org -// [OK] http://victim.example.org/http://nasty.example.org -function spam_uri_pickup_preprocess($string = '', $method = array()) -{ - if (! is_string($string)) return ''; - - $string = spam_uri_removing_hocus_pocus(rawurldecode($string), $method); - //var_dump(htmlspecialchars($string)); - - // Domain exposure (simple) - // http://victim.example.org/nasty.example.org/path#frag - // => http://nasty.example.org/?refer=victim.example.org and original - $string = preg_replace( - '#h?ttp://' . - '(' . - 'ime\.nu' . '|' . // 2ch.net - 'ime\.st' . '|' . // 2ch.net - 'link\.toolbot\.com' . '|' . - 'urlx\.org' . - ')' . - '/([a-z0-9.%_-]+\.[a-z0-9.%_-]+)#i', // nasty.example.org - 'http://$2/?refer=$1 $0', // Preserve $0 or remove? - $string - ); - - // Domain exposure (gate-big5) - // http://victim.example.org/gate/big5/nasty.example.org/path - // => http://nasty.example.org/?refer=victim.example.org and original - $string = preg_replace( - '#h?ttp://' . - '(' . - 'big5.51job.com' . '|' . - 'big5.china.com' . '|' . - 'big5.xinhuanet.com' . '|' . - ')' . - '/gate/big5' . - '/([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . - '#i', // nasty.example.org - 'http://$2/?refer=$1 $0', // Preserve $0 or remove? - $string - ); - - // Domain exposure (site:) See _preg_replace_callback_domain_exposure() - $string = preg_replace_callback( - array( - '#(h?ttp)://' . // 1:Scheme - // 2:Host - '(' . - '(?:[a-z0-9_.-]+\.)?[a-z0-9_-]+\.[a-z0-9_-]+' . - // Something Google: http://www.google.com/supported_domains - // AltaVista: http://es.altavista.com/web/results?q=site%3Anasty.example.org+foobar - // Live Search: search.live.com - // MySpace: http://sads.myspace.com/Modules/Search/Pages/Search.aspx?_snip_&searchString=site:nasty.example.org - // (also searchresults.myspace.com) - // alltheweb.com - // search.bbc.co.uk - // search.orange.co.uk - // ... - ')' . - '/' . - '([a-z0-9?=&.%_/\'\\\+-]+)' . // 3:path/?query=foo+bar+ - '\bsite:([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . // 4:site:nasty.example.com - '()' . // 5:Preserve or remove? - '#i', - ), - '_preg_replace_callback_domain_exposure', - $string - ); - - // URI exposure (uriuri => uri uri) - $string = preg_replace( - array( - '#(? nntps://example.org -// NOTE: Keep the static lists simple. See also port_normalize(). -function scheme_normalize($scheme = '', $abbrevs_harmfull = TRUE) -{ - // Abbreviations they have no intention of link - static $abbrevs = array( - 'ttp' => 'http', - 'ttps' => 'https', - ); - - // Aliases => normalized ones - static $aliases = array( - 'pop' => 'pop3', - 'news' => 'nntp', - 'imap4' => 'imap', - 'snntp' => 'nntps', - 'snews' => 'nntps', - 'spop3' => 'pop3s', - 'pops' => 'pop3s', - ); - - if (! is_string($scheme)) return ''; - - $scheme = strtolower($scheme); - if (isset($abbrevs[$scheme])) { - $scheme = $abbrevs_harmfull ? $abbrevs[$scheme] : ''; - } - if (isset($aliases[$scheme])) { - $scheme = $aliases[$scheme]; - } - - return $scheme; -} - -// Hostname normlization (Destructive) -// www.foo => www.foo ('foo' seems TLD) -// www.foo.bar => foo.bar -// www.10.20 => www.10.20 (Invalid hostname) -// NOTE: -// 'www' is mostly used as traditional hostname of WWW server. -// 'www.foo.bar' may be identical with 'foo.bar'. -function host_normalize($host = '') -{ - if (! is_string($host)) return ''; - - $host = strtolower($host); - $matches = array(); - if (preg_match('/^www\.(.+\.[a-z]+)$/', $host, $matches)) { - return $matches[1]; - } else { - return $host; - } -} - -// Port normalization: Suppress the (redundant) default port -// HTTP://example.org:80/ => http://example.org/ -// HTTP://example.org:8080/ => http://example.org:8080/ -// HTTPS://example.org:443/ => https://example.org/ -function port_normalize($port, $scheme, $scheme_normalize = FALSE) -{ - // Schemes that users _maybe_ want to add protocol-handlers - // to their web browsers. (and attackers _maybe_ want to use ...) - // Reference: http://www.iana.org/assignments/port-numbers - static $array = array( - // scheme => default port - 'ftp' => 21, - 'ssh' => 22, - 'telnet' => 23, - 'smtp' => 25, - 'tftp' => 69, - 'gopher' => 70, - 'finger' => 79, - 'http' => 80, - 'pop3' => 110, - 'sftp' => 115, - 'nntp' => 119, - 'imap' => 143, - 'irc' => 194, - 'wais' => 210, - 'https' => 443, - 'nntps' => 563, - 'rsync' => 873, - 'ftps' => 990, - 'telnets' => 992, - 'imaps' => 993, - 'ircs' => 994, - 'pop3s' => 995, - 'mysql' => 3306, - ); - - // intval() converts '0-1' to '0', so preg_match() rejects these invalid ones - if (! is_numeric($port) || $port < 0 || preg_match('/[^0-9]/i', $port)) - return ''; - - $port = intval($port); - if ($scheme_normalize) $scheme = scheme_normalize($scheme); - if (isset($array[$scheme]) && $port == $array[$scheme]) - $port = ''; // Ignore the defaults - - return $port; -} - -// Path normalization -// http://example.org => http://example.org/ -// http://example.org#hoge => http://example.org/#hoge -// http://example.org/path/a/b/./c////./d => http://example.org/path/a/b/c/d -// http://example.org/path/../../a/../back => http://example.org/back -function path_normalize($path = '', $divider = '/', $add_root = TRUE) +// Remove redundant values from array() +function array_unique_recursive($array = array()) { - if (! is_string($divider)) return is_string($path) ? $path : ''; - - if ($add_root) { - $first_div = & $divider; - } else { - $first_div = ''; - } - if (! is_string($path) || $path == '') return $first_div; - - if (strpos($path, $divider, strlen($path) - strlen($divider)) === FALSE) { - $last_div = ''; - } else { - $last_div = & $divider; - } - - $array = explode($divider, $path); - - // Remove paddings ('//' and '/./') - foreach(array_keys($array) as $key) { - if ($array[$key] == '' || $array[$key] == '.') { - unset($array[$key]); - } - } + if (! is_array($array)) return $array; - // Remove back-tracks ('/../') $tmp = array(); - foreach($array as $value) { - if ($value == '..') { - array_pop($tmp); + foreach($array as $key => $value){ + if (is_array($value)) { + $array[$key] = array_unique_recursive($value); } else { - array_push($tmp, $value); - } - } - $array = & $tmp; - - if (empty($array)) { - return $first_div; - } else { - return $first_div . implode($divider, $array) . $last_div; - } -} - -// DirectoryIndex normalize (Destructive and rough) -// TODO: sample.en.ja.html.gz => sample.html -function file_normalize($file = 'index.html.en') -{ - static $simple_defaults = array( - 'default.htm' => TRUE, - 'default.html' => TRUE, - 'default.asp' => TRUE, - 'default.aspx' => TRUE, - 'index' => TRUE, // Some system can omit the suffix - ); - - static $content_suffix = array( - // index.xxx, sample.xxx - 'htm' => TRUE, - 'html' => TRUE, - 'shtml' => TRUE, - 'jsp' => TRUE, - 'php' => TRUE, - 'php3' => TRUE, - 'php4' => TRUE, - 'pl' => TRUE, - 'py' => TRUE, - 'rb' => TRUE, - 'cgi' => TRUE, - 'xml' => TRUE, - ); - - static $language_suffix = array( - // Reference: Apache 2.0.59 'AddLanguage' default - 'ca' => TRUE, - 'cs' => TRUE, // cs - 'cz' => TRUE, // cs - 'de' => TRUE, - 'dk' => TRUE, // da - 'el' => TRUE, - 'en' => TRUE, - 'eo' => TRUE, - 'es' => TRUE, - 'et' => TRUE, - 'fr' => TRUE, - 'he' => TRUE, - 'hr' => TRUE, - 'it' => TRUE, - 'ja' => TRUE, - 'ko' => TRUE, - 'ltz' => TRUE, - 'nl' => TRUE, - 'nn' => TRUE, - 'no' => TRUE, - 'po' => TRUE, - 'pt' => TRUE, - 'pt-br' => TRUE, - 'ru' => TRUE, - 'sv' => TRUE, - 'zh-cn' => TRUE, - 'zh-tw' => TRUE, - - // Reference: Apache 2.0.59 default 'index.html' variants - 'ee' => TRUE, - 'lb' => TRUE, - 'var' => TRUE, - ); - - static $charset_suffix = array( - // Reference: Apache 2.0.59 'AddCharset' default - 'iso8859-1' => TRUE, // ISO-8859-1 - 'latin1' => TRUE, // ISO-8859-1 - 'iso8859-2' => TRUE, // ISO-8859-2 - 'latin2' => TRUE, // ISO-8859-2 - 'cen' => TRUE, // ISO-8859-2 - 'iso8859-3' => TRUE, // ISO-8859-3 - 'latin3' => TRUE, // ISO-8859-3 - 'iso8859-4' => TRUE, // ISO-8859-4 - 'latin4' => TRUE, // ISO-8859-4 - 'iso8859-5' => TRUE, // ISO-8859-5 - 'latin5' => TRUE, // ISO-8859-5 - 'cyr' => TRUE, // ISO-8859-5 - 'iso-ru' => TRUE, // ISO-8859-5 - 'iso8859-6' => TRUE, // ISO-8859-6 - 'latin6' => TRUE, // ISO-8859-6 - 'arb' => TRUE, // ISO-8859-6 - 'iso8859-7' => TRUE, // ISO-8859-7 - 'latin7' => TRUE, // ISO-8859-7 - 'grk' => TRUE, // ISO-8859-7 - 'iso8859-8' => TRUE, // ISO-8859-8 - 'latin8' => TRUE, // ISO-8859-8 - 'heb' => TRUE, // ISO-8859-8 - 'iso8859-9' => TRUE, // ISO-8859-9 - 'latin9' => TRUE, // ISO-8859-9 - 'trk' => TRUE, // ISO-8859-9 - 'iso2022-jp'=> TRUE, // ISO-2022-JP - 'jis' => TRUE, // ISO-2022-JP - 'iso2022-kr'=> TRUE, // ISO-2022-KR - 'kis' => TRUE, // ISO-2022-KR - 'iso2022-cn'=> TRUE, // ISO-2022-CN - 'cis' => TRUE, // ISO-2022-CN - 'big5' => TRUE, - 'cp-1251' => TRUE, // ru, WINDOWS-1251 - 'win-1251' => TRUE, // ru, WINDOWS-1251 - 'cp866' => TRUE, // ru - 'koi8-r' => TRUE, // ru, KOI8-r - 'koi8-ru' => TRUE, // ru, KOI8-r - 'koi8-uk' => TRUE, // ru, KOI8-ru - 'ua' => TRUE, // ru, KOI8-ru - 'ucs2' => TRUE, // ru, ISO-10646-UCS-2 - 'ucs4' => TRUE, // ru, ISO-10646-UCS-4 - 'utf8' => TRUE, - - // Reference: Apache 2.0.59 default 'index.html' variants - 'euc-kr' => TRUE, - 'gb2312' => TRUE, - ); - - // May uncompress by web browsers on the fly - // Must be at the last of the filename - // Reference: Apache 2.0.59 'AddEncoding' - static $encoding_suffix = array( - 'z' => TRUE, - 'gz' => TRUE, - ); - - if (! is_string($file)) return ''; - $_file = strtolower($file); - if (isset($simple_defaults[$_file])) return ''; - - - // Roughly removing language/character-set/encoding suffixes - // References: - // * Apache 2 document about 'Content-negotiaton', 'mod_mime' and 'mod_negotiation' - // http://httpd.apache.org/docs/2.0/content-negotiation.html - // http://httpd.apache.org/docs/2.0/mod/mod_mime.html - // http://httpd.apache.org/docs/2.0/mod/mod_negotiation.html - // * http://www.iana.org/assignments/character-sets - // * RFC3066: Tags for the Identification of Languages - // http://www.ietf.org/rfc/rfc3066.txt - // * ISO 639: codes of 'language names' - $suffixes = explode('.', $_file); - $body = array_shift($suffixes); - if ($suffixes) { - // Remove the last .gz/.z - $last_key = end(array_keys($suffixes)); - if (isset($encoding_suffix[$suffixes[$last_key]])) { - unset($suffixes[$last_key]); - } - } - // Cut language and charset suffixes - foreach($suffixes as $key => $value){ - if (isset($language_suffix[$value]) || isset($charset_suffix[$value])) { - unset($suffixes[$key]); - } - } - if (empty($suffixes)) return $body; - - // Index.xxx - $count = count($suffixes); - reset($suffixes); - $current = current($suffixes); - if ($body == 'index' && $count == 1 && isset($content_suffix[$current])) return ''; - - return $file; -} - -// Sort query-strings if possible (Destructive and rough) -// [OK] &&&&f=d&b&d&c&a=0dd => a=0dd&b&c&d&f=d -// [OK] nothing==&eg=dummy&eg=padding&eg=foobar => eg=foobar -function query_normalize($string = '', $equal = TRUE, $equal_cutempty = TRUE, $stortolower = TRUE) -{ - if (! is_string($string)) return ''; - if ($stortolower) $string = strtolower($string); - - $array = explode('&', $string); - - // Remove '&' paddings - foreach(array_keys($array) as $key) { - if ($array[$key] == '') { - unset($array[$key]); - } - } - - // Consider '='-sepalated input and paddings - if ($equal) { - $equals = $not_equals = array(); - foreach ($array as $part) { - if (strpos($part, '=') === FALSE) { - $not_equals[] = $part; + if (isset($tmp[$value])) { + unset($array[$key]); } else { - list($key, $value) = explode('=', $part, 2); - $value = ltrim($value, '='); - if (! $equal_cutempty || $value != '') { - $equals[$key] = $value; - } + $tmp[$value] = TRUE; } } - - $array = & $not_equals; - foreach ($equals as $key => $value) { - $array[] = $key . '=' . $value; - } - unset($equals); } - natsort($array); - return implode('&', $array); + return $array; } + // --------------------- // Part One : Checker @@ -1005,21 +266,6 @@ function generate_glob_regex($string = '', $divider = '/') return $string; } -// Rough hostname checker -// [OK] 192.168. -// TODO: Strict digit, 0x, CIDR, IPv6 -function is_ip($string = '') -{ - if (preg_match('/^' . - '(?:[0-9]{1,3}\.){3}[0-9]{1,3}' . '|' . - '(?:[0-9]{1,3}\.){1,3}' . '$/', - $string)) { - return 4; // Seems IPv4(dot-decimal) - } else { - return 0; // Seems not IP - } -} - // Generate host (FQDN, IPv4, ...) regex // 'localhost' : Matches with 'localhost' only // 'example.org' : Matches with 'example.org' only (See host_normalize() about 'www') @@ -1054,6 +300,21 @@ function generate_host_regex($string = '', $divider = '/') } } +// Rough hostname checker +// [OK] 192.168. +// TODO: Strict digit, 0x, CIDR, IPv6 +function is_ip($string = '') +{ + if (preg_match('/^' . + '(?:[0-9]{1,3}\.){3}[0-9]{1,3}' . '|' . + '(?:[0-9]{1,3}\.){1,3}' . '$/', + $string)) { + return 4; // Seems IPv4(dot-decimal) + } else { + return 0; // Seems not IP + } +} + function get_blocklist($list = '') { static $regexes; @@ -1151,6 +412,10 @@ function blocklist_distiller(& $hosts, $keys = array('goodhost', 'badhost'), $as return $blocked; } + +// --------------------- + + // Default (enabled) methods and thresholds (for content insertion) function check_uri_spam_method($times = 1, $t_area = 0, $rule = TRUE) { @@ -1411,62 +676,6 @@ function check_uri_spam($target = '', $method = array()) return $progress; } -// Count leaves (A leaf = value that is not an array, or an empty array) -function array_count_leaves($array = array(), $count_empty = FALSE) -{ - if (! is_array($array) || (empty($array) && $count_empty)) return 1; - - // Recurse - $count = 0; - foreach ($array as $part) { - $count += array_count_leaves($part, $count_empty); - } - return $count; -} - -// An array-leaves to a flat array -function array_flat_leaves($array, $unique = TRUE) -{ - if (! is_array($array)) return $array; - - $tmp = array(); - foreach(array_keys($array) as $key) { - if (is_array($array[$key])) { - // Recurse - foreach(array_flat_leaves($array[$key]) as $_value) { - $tmp[] = $_value; - } - } else { - $tmp[] = & $array[$key]; - } - } - - return $unique ? array_values(array_unique($tmp)) : $tmp; -} - -// An array() to an array leaf -function array_leaf($array = array('A', 'B', 'C.D'), $stem = FALSE, $edge = TRUE) -{ - if (! is_array($array)) return $array; - - $leaf = array(); - $tmp = & $leaf; - foreach($array as $arg) { - if (! is_string($arg) && ! is_int($arg)) continue; - $tmp[$arg] = array(); - $parent = & $tmp; - $tmp = & $tmp[$arg]; - } - if ($stem) { - $parent[key($parent)] = & $edge; - } else { - $parent = key($parent); - } - - return $leaf; // array('A' => array('B' => 'C.D')) -} - - // --------------------- // Reporting @@ -1570,20 +779,6 @@ function summarize_detail_newtral($progress = array()) ')'; } -// ksort() by domain -function ksort_by_domain(& $array) -{ - $sort = array(); - foreach(array_keys($array) as $key) { - $sort[delimiter_reverse($key)] = $key; - } - ksort($sort, SORT_STRING); - $result = array(); - foreach($sort as $key) { - $result[$key] = & $array[$key]; - } - $array = $result; -} // Check responsibility-root of the FQDN // 'foo.bar.example.com' => 'example.com' (.com has the last whois for it) @@ -1600,7 +795,7 @@ function whois_responsibility($fqdn = 'foo.bar.example.com', $parent = FALSE, $i } if (! is_string($fqdn)) return ''; - if (is_ip($fqdn)) return $fqdn; + if (is_ip($fqdn)) return $fqdn; if (! isset($domain)) { $domain = array(); diff --git a/spam/spam_pickup.php b/spam/spam_pickup.php new file mode 100644 index 0000000..1c82649 --- /dev/null +++ b/spam/spam_pickup.php @@ -0,0 +1,788 @@ +"\'\[\]/\#?@]*)' . // 2: Userinfo (Username) + '@)?' . + '(' . + // 3: Host + '\[[0-9a-f:.]+\]' . '|' . // IPv6([colon-hex and dot]): RFC2732 + '(?:[0-9]{1,3}\.){3}[0-9]{1,3}' . '|' . // IPv4(dot-decimal): 001.22.3.44 + '[a-z0-9_-][a-z0-9_.-]+[a-z0-9_-]' . // hostname(FQDN) : foo.example.org + ')' . + '(?::([0-9]*))?' . // 4: Port + '((?:/+[^\s<>"\'\[\]/\#]+)*/+)?' . // 5: Directory path or path-info + '([^\s<>"\'\[\]\#?]+)?' . // 6: File? + '(?:\?([^\s<>"\'\[\]\#]+))?' . // 7: Query string + '(?:\#([a-z0-9._~%!$&\'()*+,;=:@-]*))?' . // 8: Fragment + '#i', + $string, $array, PREG_SET_ORDER | PREG_OFFSET_CAPTURE + ); + + // Format the $array + static $parts = array( + 1 => 'scheme', 2 => 'userinfo', 3 => 'host', 4 => 'port', + 5 => 'path', 6 => 'file', 7 => 'query', 8 => 'fragment' + ); + $default = array(''); + foreach(array_keys($array) as $uri) { + $_uri = & $array[$uri]; + array_rename_keys($_uri, $parts, TRUE, $default); + $offset = $_uri['scheme'][1]; // Scheme's offset = URI's offset + foreach(array_keys($_uri) as $part) { + $_uri[$part] = & $_uri[$part][0]; // Remove offsets + } + } + + foreach(array_keys($array) as $uri) { + $_uri = & $array[$uri]; + if ($_uri['scheme'] === '') { + unset($array[$uri]); // Considererd harmless + continue; + } + unset($_uri[0]); // Matched string itself + $_uri['area']['offset'] = $offset; // Area offset for area_measure() + } + + return $array; +} + +// Pickupped URI array => An URI (See uri_pickup()) +// USAGE: +// $pickups = uri_pickup('a string include some URIs'); +// $uris = array(); +// foreach (array_keys($pickups) as $key) { +// $uris[$key] = uri_pickup_implode($pickups[$key]); +// } +function uri_pickup_implode($uri = array()) +{ + if (empty($uri) || ! is_array($uri)) return NULL; + + $tmp = array(); + if (isset($uri['scheme']) && $uri['scheme'] !== '') { + $tmp[] = & $uri['scheme']; + $tmp[] = '://'; + } + if (isset($uri['userinfo']) && $uri['userinfo'] !== '') { + $tmp[] = & $uri['userinfo']; + $tmp[] = '@'; + } + if (isset($uri['host']) && $uri['host'] !== '') { + $tmp[] = & $uri['host']; + } + if (isset($uri['port']) && $uri['port'] !== '') { + $tmp[] = ':'; + $tmp[] = & $uri['port']; + } + if (isset($uri['path']) && $uri['path'] !== '') { + $tmp[] = & $uri['path']; + } + if (isset($uri['file']) && $uri['file'] !== '') { + $tmp[] = & $uri['file']; + } + if (isset($uri['query']) && $uri['query'] !== '') { + $tmp[] = '?'; + $tmp[] = & $uri['query']; + } + if (isset($uri['fragment']) && $uri['fragment'] !== '') { + $tmp[] = '#'; + $tmp[] = & $uri['fragment']; + } + + return implode('', $tmp); +} + + +// --------------------- +// URI normalization + +// Normalize an array of URI arrays +// NOTE: Give me the uri_pickup() results +function uri_pickup_normalize(& $pickups, $destructive = TRUE) +{ + if (! is_array($pickups)) return $pickups; + + if ($destructive) { + foreach (array_keys($pickups) as $key) { + $_key = & $pickups[$key]; + $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : ''; + $_key['host'] = isset($_key['host']) ? host_normalize($_key['host']) : ''; + $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : ''; + $_key['path'] = isset($_key['path']) ? strtolower(path_normalize($_key['path'])) : ''; + $_key['file'] = isset($_key['file']) ? file_normalize($_key['file']) : ''; + $_key['query'] = isset($_key['query']) ? query_normalize($_key['query']) : ''; + $_key['fragment'] = isset($_key['fragment']) ? strtolower($_key['fragment']) : ''; + } + } else { + foreach (array_keys($pickups) as $key) { + $_key = & $pickups[$key]; + $_key['scheme'] = isset($_key['scheme']) ? scheme_normalize($_key['scheme']) : ''; + $_key['host'] = isset($_key['host']) ? strtolower($_key['host']) : ''; + $_key['port'] = isset($_key['port']) ? port_normalize($_key['port'], $_key['scheme'], FALSE) : ''; + $_key['path'] = isset($_key['path']) ? path_normalize($_key['path']) : ''; + } + } + + return $pickups; +} + +// Scheme normalization: Renaming the schemes +// snntp://example.org => nntps://example.org +// NOTE: Keep the static lists simple. See also port_normalize(). +function scheme_normalize($scheme = '', $abbrevs_harmfull = TRUE) +{ + // Abbreviations they have no intention of link + static $abbrevs = array( + 'ttp' => 'http', + 'ttps' => 'https', + ); + + // Aliases => normalized ones + static $aliases = array( + 'pop' => 'pop3', + 'news' => 'nntp', + 'imap4' => 'imap', + 'snntp' => 'nntps', + 'snews' => 'nntps', + 'spop3' => 'pop3s', + 'pops' => 'pop3s', + ); + + if (! is_string($scheme)) return ''; + + $scheme = strtolower($scheme); + if (isset($abbrevs[$scheme])) { + $scheme = $abbrevs_harmfull ? $abbrevs[$scheme] : ''; + } + if (isset($aliases[$scheme])) { + $scheme = $aliases[$scheme]; + } + + return $scheme; +} + +// Hostname normlization (Destructive) +// www.foo => www.foo ('foo' seems TLD) +// www.foo.bar => foo.bar +// www.10.20 => www.10.20 (Invalid hostname) +// NOTE: +// 'www' is mostly used as traditional hostname of WWW server. +// 'www.foo.bar' may be identical with 'foo.bar'. +function host_normalize($host = '') +{ + if (! is_string($host)) return ''; + + $host = strtolower($host); + $matches = array(); + if (preg_match('/^www\.(.+\.[a-z]+)$/', $host, $matches)) { + return $matches[1]; + } else { + return $host; + } +} + +// Port normalization: Suppress the (redundant) default port +// HTTP://example.org:80/ => http://example.org/ +// HTTP://example.org:8080/ => http://example.org:8080/ +// HTTPS://example.org:443/ => https://example.org/ +function port_normalize($port, $scheme, $scheme_normalize = FALSE) +{ + // Schemes that users _maybe_ want to add protocol-handlers + // to their web browsers. (and attackers _maybe_ want to use ...) + // Reference: http://www.iana.org/assignments/port-numbers + static $array = array( + // scheme => default port + 'ftp' => 21, + 'ssh' => 22, + 'telnet' => 23, + 'smtp' => 25, + 'tftp' => 69, + 'gopher' => 70, + 'finger' => 79, + 'http' => 80, + 'pop3' => 110, + 'sftp' => 115, + 'nntp' => 119, + 'imap' => 143, + 'irc' => 194, + 'wais' => 210, + 'https' => 443, + 'nntps' => 563, + 'rsync' => 873, + 'ftps' => 990, + 'telnets' => 992, + 'imaps' => 993, + 'ircs' => 994, + 'pop3s' => 995, + 'mysql' => 3306, + ); + + // intval() converts '0-1' to '0', so preg_match() rejects these invalid ones + if (! is_numeric($port) || $port < 0 || preg_match('/[^0-9]/i', $port)) + return ''; + + $port = intval($port); + if ($scheme_normalize) $scheme = scheme_normalize($scheme); + if (isset($array[$scheme]) && $port == $array[$scheme]) + $port = ''; // Ignore the defaults + + return $port; +} + +// Path normalization +// http://example.org => http://example.org/ +// http://example.org#hoge => http://example.org/#hoge +// http://example.org/path/a/b/./c////./d => http://example.org/path/a/b/c/d +// http://example.org/path/../../a/../back => http://example.org/back +function path_normalize($path = '', $divider = '/', $add_root = TRUE) +{ + if (! is_string($divider)) return is_string($path) ? $path : ''; + + if ($add_root) { + $first_div = & $divider; + } else { + $first_div = ''; + } + if (! is_string($path) || $path == '') return $first_div; + + if (strpos($path, $divider, strlen($path) - strlen($divider)) === FALSE) { + $last_div = ''; + } else { + $last_div = & $divider; + } + + $array = explode($divider, $path); + + // Remove paddings ('//' and '/./') + foreach(array_keys($array) as $key) { + if ($array[$key] == '' || $array[$key] == '.') { + unset($array[$key]); + } + } + + // Remove back-tracks ('/../') + $tmp = array(); + foreach($array as $value) { + if ($value == '..') { + array_pop($tmp); + } else { + array_push($tmp, $value); + } + } + $array = & $tmp; + + if (empty($array)) { + return $first_div; + } else { + return $first_div . implode($divider, $array) . $last_div; + } +} + +// DirectoryIndex normalize (Destructive and rough) +// TODO: sample.en.ja.html.gz => sample.html +function file_normalize($file = 'index.html.en') +{ + static $simple_defaults = array( + 'default.htm' => TRUE, + 'default.html' => TRUE, + 'default.asp' => TRUE, + 'default.aspx' => TRUE, + 'index' => TRUE, // Some system can omit the suffix + ); + + static $content_suffix = array( + // index.xxx, sample.xxx + 'htm' => TRUE, + 'html' => TRUE, + 'shtml' => TRUE, + 'jsp' => TRUE, + 'php' => TRUE, + 'php3' => TRUE, + 'php4' => TRUE, + 'pl' => TRUE, + 'py' => TRUE, + 'rb' => TRUE, + 'cgi' => TRUE, + 'xml' => TRUE, + ); + + static $language_suffix = array( + // Reference: Apache 2.0.59 'AddLanguage' default + 'ca' => TRUE, + 'cs' => TRUE, // cs + 'cz' => TRUE, // cs + 'de' => TRUE, + 'dk' => TRUE, // da + 'el' => TRUE, + 'en' => TRUE, + 'eo' => TRUE, + 'es' => TRUE, + 'et' => TRUE, + 'fr' => TRUE, + 'he' => TRUE, + 'hr' => TRUE, + 'it' => TRUE, + 'ja' => TRUE, + 'ko' => TRUE, + 'ltz' => TRUE, + 'nl' => TRUE, + 'nn' => TRUE, + 'no' => TRUE, + 'po' => TRUE, + 'pt' => TRUE, + 'pt-br' => TRUE, + 'ru' => TRUE, + 'sv' => TRUE, + 'zh-cn' => TRUE, + 'zh-tw' => TRUE, + + // Reference: Apache 2.0.59 default 'index.html' variants + 'ee' => TRUE, + 'lb' => TRUE, + 'var' => TRUE, + ); + + static $charset_suffix = array( + // Reference: Apache 2.0.59 'AddCharset' default + 'iso8859-1' => TRUE, // ISO-8859-1 + 'latin1' => TRUE, // ISO-8859-1 + 'iso8859-2' => TRUE, // ISO-8859-2 + 'latin2' => TRUE, // ISO-8859-2 + 'cen' => TRUE, // ISO-8859-2 + 'iso8859-3' => TRUE, // ISO-8859-3 + 'latin3' => TRUE, // ISO-8859-3 + 'iso8859-4' => TRUE, // ISO-8859-4 + 'latin4' => TRUE, // ISO-8859-4 + 'iso8859-5' => TRUE, // ISO-8859-5 + 'latin5' => TRUE, // ISO-8859-5 + 'cyr' => TRUE, // ISO-8859-5 + 'iso-ru' => TRUE, // ISO-8859-5 + 'iso8859-6' => TRUE, // ISO-8859-6 + 'latin6' => TRUE, // ISO-8859-6 + 'arb' => TRUE, // ISO-8859-6 + 'iso8859-7' => TRUE, // ISO-8859-7 + 'latin7' => TRUE, // ISO-8859-7 + 'grk' => TRUE, // ISO-8859-7 + 'iso8859-8' => TRUE, // ISO-8859-8 + 'latin8' => TRUE, // ISO-8859-8 + 'heb' => TRUE, // ISO-8859-8 + 'iso8859-9' => TRUE, // ISO-8859-9 + 'latin9' => TRUE, // ISO-8859-9 + 'trk' => TRUE, // ISO-8859-9 + 'iso2022-jp'=> TRUE, // ISO-2022-JP + 'jis' => TRUE, // ISO-2022-JP + 'iso2022-kr'=> TRUE, // ISO-2022-KR + 'kis' => TRUE, // ISO-2022-KR + 'iso2022-cn'=> TRUE, // ISO-2022-CN + 'cis' => TRUE, // ISO-2022-CN + 'big5' => TRUE, + 'cp-1251' => TRUE, // ru, WINDOWS-1251 + 'win-1251' => TRUE, // ru, WINDOWS-1251 + 'cp866' => TRUE, // ru + 'koi8-r' => TRUE, // ru, KOI8-r + 'koi8-ru' => TRUE, // ru, KOI8-r + 'koi8-uk' => TRUE, // ru, KOI8-ru + 'ua' => TRUE, // ru, KOI8-ru + 'ucs2' => TRUE, // ru, ISO-10646-UCS-2 + 'ucs4' => TRUE, // ru, ISO-10646-UCS-4 + 'utf8' => TRUE, + + // Reference: Apache 2.0.59 default 'index.html' variants + 'euc-kr' => TRUE, + 'gb2312' => TRUE, + ); + + // May uncompress by web browsers on the fly + // Must be at the last of the filename + // Reference: Apache 2.0.59 'AddEncoding' + static $encoding_suffix = array( + 'z' => TRUE, + 'gz' => TRUE, + ); + + if (! is_string($file)) return ''; + $_file = strtolower($file); + if (isset($simple_defaults[$_file])) return ''; + + // Roughly removing language/character-set/encoding suffixes + // References: + // * Apache 2 document about 'Content-negotiaton', 'mod_mime' and 'mod_negotiation' + // http://httpd.apache.org/docs/2.0/content-negotiation.html + // http://httpd.apache.org/docs/2.0/mod/mod_mime.html + // http://httpd.apache.org/docs/2.0/mod/mod_negotiation.html + // * http://www.iana.org/assignments/character-sets + // * RFC3066: Tags for the Identification of Languages + // http://www.ietf.org/rfc/rfc3066.txt + // * ISO 639: codes of 'language names' + $suffixes = explode('.', $_file); + $body = array_shift($suffixes); + if ($suffixes) { + // Remove the last .gz/.z + $last_key = end(array_keys($suffixes)); + if (isset($encoding_suffix[$suffixes[$last_key]])) { + unset($suffixes[$last_key]); + } + } + // Cut language and charset suffixes + foreach($suffixes as $key => $value){ + if (isset($language_suffix[$value]) || isset($charset_suffix[$value])) { + unset($suffixes[$key]); + } + } + if (empty($suffixes)) return $body; + + // Index.xxx + $count = count($suffixes); + reset($suffixes); + $current = current($suffixes); + if ($body == 'index' && $count == 1 && isset($content_suffix[$current])) return ''; + + return $file; +} + +// Sort query-strings if possible (Destructive and rough) +// [OK] &&&&f=d&b&d&c&a=0dd => a=0dd&b&c&d&f=d +// [OK] nothing==&eg=dummy&eg=padding&eg=foobar => eg=foobar +function query_normalize($string = '', $equal = TRUE, $equal_cutempty = TRUE, $stortolower = TRUE) +{ + if (! is_string($string)) return ''; + if ($stortolower) $string = strtolower($string); + + $array = explode('&', $string); + + // Remove '&' paddings + foreach(array_keys($array) as $key) { + if ($array[$key] == '') { + unset($array[$key]); + } + } + + // Consider '='-sepalated input and paddings + if ($equal) { + $equals = $not_equals = array(); + foreach ($array as $part) { + if (strpos($part, '=') === FALSE) { + $not_equals[] = $part; + } else { + list($key, $value) = explode('=', $part, 2); + $value = ltrim($value, '='); + if (! $equal_cutempty || $value != '') { + $equals[$key] = $value; + } + } + } + + $array = & $not_equals; + foreach ($equals as $key => $value) { + $array[] = $key . '=' . $value; + } + unset($equals); + } + + natsort($array); + return implode('&', $array); +} + +// --------------------- +// Area pickup + +// Pickup all of markup areas +function area_pickup($string = '', $method = array()) +{ + $area = array(); + if (empty($method)) return $area; + + // Anchor tag pair by preg_match and preg_match_all() + // [OK] + // [OK] Good site! + // [OK] test + // [OK] visit http://nasty.example.com/ + // [OK] discount foobar + // [NG] visit http://ng.example.com _not_ended_ + $regex = '#]*\bhref\b[^>]*>.*?]*(>)#is'; + if (isset($method['area_anchor'])) { + $areas = array(); + $count = isset($method['asap']) ? + preg_match($regex, $string) : + preg_match_all($regex, $string, $areas); + if (! empty($count)) $area['area_anchor'] = $count; + } + if (isset($method['uri_anchor'])) { + $areas = array(); + preg_match_all($regex, $string, $areas, PREG_SET_ORDER | PREG_OFFSET_CAPTURE); + foreach(array_keys($areas) as $_area) { + $areas[$_area] = array( + $areas[$_area][0][1], // Area start () + $areas[$_area][1][1], // Area end () + ); + } + if (! empty($areas)) $area['uri_anchor'] = $areas; + } + + // phpBB's "BBCode" pair by preg_match and preg_match_all() + // [OK] [url][/url] + // [OK] [url]http://nasty.example.com/[/url] + // [OK] [link]http://nasty.example.com/[/link] + // [OK] [url=http://nasty.example.com]visit http://nasty.example.com/[/url] + // [OK] [link http://nasty.example.com/]buy something[/link] + $regex = '#\[(url|link)\b[^\]]*\].*?\[/\1\b[^\]]*(\])#is'; + if (isset($method['area_bbcode'])) { + $areas = array(); + $count = isset($method['asap']) ? + preg_match($regex, $string) : + preg_match_all($regex, $string, $areas, PREG_SET_ORDER); + if (! empty($count)) $area['area_bbcode'] = $count; + } + if (isset($method['uri_bbcode'])) { + $areas = array(); + preg_match_all($regex, $string, $areas, PREG_SET_ORDER | PREG_OFFSET_CAPTURE); + foreach(array_keys($areas) as $_area) { + $areas[$_area] = array( + $areas[$_area][0][1], // Area start ([url]) + $areas[$_area][2][1], // Area end ([/url]) + ); + } + if (! empty($areas)) $area['uri_bbcode'] = $areas; + } + + // Various Wiki syntax + // [text_or_uri>text_or_uri] + // [text_or_uri:text_or_uri] + // [text_or_uri|text_or_uri] + // [text_or_uri->text_or_uri] + // [text_or_uri text_or_uri] // MediaWiki + // MediaWiki: [http://nasty.example.com/ visit http://nasty.example.com/] + + return $area; +} + +// If in doubt, it's a little doubtful +// if (Area => inside <= Area) $brief += -1 +function area_measure($areas, & $array, $belief = -1, $a_key = 'area', $o_key = 'offset') +{ + if (! is_array($areas) || ! is_array($array)) return; + + $areas_keys = array_keys($areas); + foreach(array_keys($array) as $u_index) { + $offset = isset($array[$u_index][$o_key]) ? + intval($array[$u_index][$o_key]) : 0; + foreach($areas_keys as $a_index) { + if (isset($array[$u_index][$a_key])) { + $offset_s = intval($areas[$a_index][0]); + $offset_e = intval($areas[$a_index][1]); + // [Area => inside <= Area] + if ($offset_s < $offset && $offset < $offset_e) { + $array[$u_index][$a_key] += $belief; + } + } + } + } +} + + +// --------------------- +// Spam-uri pickup + +// Preprocess: Removing uninterest part for URI detection +function spam_uri_removing_hocus_pocus($binary = '', $method = array()) +{ + $length = 4 ; // 'http'(1) and '://'(2) and 'fqdn'(1) + if (is_array($method)) { + // ''(1) or ''(4) + // '[uri'(4) or ']'(1) or '[/uri]'(6) + if (isset($method['area_anchor']) || isset($method['uri_anchor']) || + isset($method['area_bbcode']) || isset($method['uri_bbcode'])) + $length = 1; // Seems not effective + } + + // Removing sequential spaces and too short lines + $binary = strings($binary, $length, TRUE, FALSE); // Multibyte NOT needed + + // Remove words (has no '<>[]:') between spaces + $binary = preg_replace('/[ \t][\w.,()\ \t]+[ \t]/', ' ', $binary); + + return $binary; +} + +// Preprocess: Domain exposure callback (See spam_uri_pickup_preprocess()) +// http://victim.example.org/?foo+site:nasty.example.com+bar +// => http://nasty.example.com/?refer=victim.example.org +// NOTE: 'refer=' is not so good for (at this time). +// Consider about using IP address of the victim, try to avoid that. +function _preg_replace_callback_domain_exposure($matches = array()) +{ + $result = ''; + + // Preserve the victim URI as a complicity or ... + if (isset($matches[5])) { + $result = + $matches[1] . '://' . // scheme + $matches[2] . '/' . // victim.example.org + $matches[3]; // The rest of all (before victim) + } + + // Flipped URI + if (isset($matches[4])) { + $result = + $matches[1] . '://' . // scheme + $matches[4] . // nasty.example.com + '/?refer=' . strtolower($matches[2]) . // victim.example.org + ' ' . $result; + } + + return $result; +} + +// Preprocess: rawurldecode() and adding space(s) and something +// to detect/count some URIs _if possible_ +// NOTE: It's maybe danger to var_dump(result). [e.g. 'javascript:'] +// [OK] http://victim.example.org/?site:nasty.example.org +// [OK] http://victim.example.org/nasty.example.org +// [OK] http://victim.example.org/go?http%3A%2F%2Fnasty.example.org +// [OK] http://victim.example.org/http://nasty.example.org +function spam_uri_pickup_preprocess($string = '', $method = array()) +{ + if (! is_string($string)) return ''; + + $string = spam_uri_removing_hocus_pocus(rawurldecode($string), $method); + //var_dump(htmlspecialchars($string)); + + // Domain exposure (simple) + // http://victim.example.org/nasty.example.org/path#frag + // => http://nasty.example.org/?refer=victim.example.org and original + $string = preg_replace( + '#h?ttp://' . + '(' . + 'ime\.nu' . '|' . // 2ch.net + 'ime\.st' . '|' . // 2ch.net + 'link\.toolbot\.com' . '|' . + 'urlx\.org' . + ')' . + '/([a-z0-9.%_-]+\.[a-z0-9.%_-]+)#i', // nasty.example.org + 'http://$2/?refer=$1 $0', // Preserve $0 or remove? + $string + ); + + // Domain exposure (gate-big5) + // http://victim.example.org/gate/big5/nasty.example.org/path + // => http://nasty.example.org/?refer=victim.example.org and original + $string = preg_replace( + '#h?ttp://' . + '(' . + 'big5.51job.com' . '|' . + 'big5.china.com' . '|' . + 'big5.xinhuanet.com' . '|' . + ')' . + '/gate/big5' . + '/([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . + '#i', // nasty.example.org + 'http://$2/?refer=$1 $0', // Preserve $0 or remove? + $string + ); + + // Domain exposure (site:) See _preg_replace_callback_domain_exposure() + $string = preg_replace_callback( + array( + '#(h?ttp)://' . // 1:Scheme + // 2:Host + '(' . + '(?:[a-z0-9_.-]+\.)?[a-z0-9_-]+\.[a-z0-9_-]+' . + // Something Google: http://www.google.com/supported_domains + // AltaVista: http://es.altavista.com/web/results?q=site%3Anasty.example.org+foobar + // Live Search: search.live.com + // MySpace: http://sads.myspace.com/Modules/Search/Pages/Search.aspx?_snip_&searchString=site:nasty.example.org + // (also searchresults.myspace.com) + // alltheweb.com + // search.bbc.co.uk + // search.orange.co.uk + // ... + ')' . + '/' . + '([a-z0-9?=&.%_/\'\\\+-]+)' . // 3:path/?query=foo+bar+ + '\bsite:([a-z0-9.%_-]+\.[a-z0-9.%_-]+)' . // 4:site:nasty.example.com + '()' . // 5:Preserve or remove? + '#i', + ), + '_preg_replace_callback_domain_exposure', + $string + ); + + // URI exposure (uriuri => uri uri) + $string = preg_replace( + array( + '#(? -- 2.11.0