arc\noxss

Complexity

Total Complexity

26

Size/Duplication

Total Lines	144
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	0

Test Coverage

Coverage

79.37%

Importance

Changes	9
Bugs	1	Features	4

5 Methods

Rating	Name	Duplication	Size	Complexity
B	detect()	0	20	7
B	_gatherXSSInput()	0	20	8
A	prevent()	0	19	4
B	_checkForProblems()	0	20	6
A	ignore()	0	4	1

<?php
/*
 * This file is part of the Ariadne Component Library.
 *
 * (c) Muze <info@muze.nl>
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */
namespace arc;

/**
 *	noxss is an XSS attack detection and prevention class. It contains two methods, detect and prevent.
 *  The detect() method must be called at the start of handling any request, e.g. in your front loader / router
 *  The prevent() method must be called at the end of handling any request.
 *
 *	Usage:
 *    <?php
 *        \arc\noxss::detect();
 *        \\ handle request normally
 *        \arc\noxss::prevent();
 *    ?>
 */
final class noxss
{
    /**
     * @var (bool) A flag to indicate if there might be an XSS attack going on
     */
    public static $potentialXSS = false;

    /**
     * @var (array) A container for inputs potentially containing XSS attacks
     */
    public static $xss;

    /**
     * @var (string) buffered output caught by prevent.
     */
    public static $output;

    /**
     * @var (string) Regular expression that matches any input containing quotes, tag start or end delimiters or &.
     * I don't know any XSS attack that doesn't require at least one of these characters.
     */
    public static $reXSS = '/[\'"<>&]/';

    /**
     * @var (array) A list of _SERVER variables sent by client header and thus potential attack vectors, can be set
     * by user when needed / used.
     */
    public static $xssHeaders = [ 'PHP_AUTH_USER', 'PHP_AUTH_PW' ];

    /**
     * @var (int) Minimum length of an input to qualify as a potential XSS attack.
     */
    public static $minimumLength = 10;

    /**
     * @var (array) A list of inputs to ignore, keyed to the input method - GET, POST, COOKIE, SERVER
     */
    public static $ignoreList = [];

    /**
     * This method checks all user inputs ( get/post/cookie variables, client sent headers ) for potential XSS attacks
     * If found it flags these and sets self::$potentialXSS to true and starts an output buffer
     */
    public static function detect()
    {
        foreach ([ 'GET' => $_GET, 'POST' => $_POST, 'COOKIE' => $_COOKIE ] as $method => $inputs) {
            if (is_array( $inputs )) {
                self::_gatherXSSInput( $inputs, $method );
            }
        }
        foreach (self::$xssHeaders as $header) {
            if (array_key_exists( $header, $_SERVER )) {
                self::_gatherXSSInput( $_SERVER[$header], 'SERVER' );
            }
        }

        if (!self::$potentialXSS && count( self::$xss )) {
            // An input with problematic tokens has been spotted, start the output buffer once
            // to check the output for an occurance of that input _unchanged_
            ob_start();
            self::$potentialXSS = true;
        }
    }

    private static function _gatherXSSInput($input, $method, $name = null)
    {
        if (is_array( $input )) {
            foreach ($input as $key => $value) {
                if (!isset($name)) {
                    self::_gatherXSSInput( $value, $method, $key );
                } else {
                    self::_gatherXSSInput( $value, $method, $name );
                }
            }
        } else {
            $input = (string) $input;
            if (( !array_key_exists( $method, self::$ignoreList ) || !array_key_exists( $name, self::$ignoreList[$method] ) )
                && ( strlen( $input ) > self::$minimumLength )
                && preg_match( self::$reXSS, $input, $matches))
            {
                self::$xss[ $method ][ strlen($input) ][] = $input;
            }
        }
    }

    /**
     * This method checks if self::$potentialXSS to see if an XSS attack might be going on. If so
     * the output buffer is ended and the output content retrieved. All inputs flagged as potential XSS attacks
     * are checked to see if any of these is in the output content _in_unchanged_form_ !
     * If so, there is a vulnerability to XSS which is being exploited ( or at least triggered ) and the only
     * safe option is to not sent the output but sent a 400 Bad Request header instead.
     * This method doesn't actually send this header but it does throw an exception allowing you to handle it
     * any way you see fit
     *
     * @param callable $f (optional) A method to call when a potential xss attack is detected. Takes one argument: the output
     *                    generated by this request so far. If not set prevent() will just sent a 400 Bad Request header if a potential xss attack
     *                    is detected.
     */
    public static function prevent($f = null)
    {
        if (self::$potentialXSS) {
            self::$output = ob_get_contents();
            ob_end_clean();

            $xssDetected = self::_checkForProblems();

            if ($xssDetected) {
                if (is_callable($f)) {
                    $f( self::$output );
                } else {
                    header( 'HTTP/1.1 400 Bad Request' );
                }
            } else {
                echo self::$output;
            }
        }
    }

    private static function _checkForProblems()
    {
        // sort by length of string so longer strings are matched first
        // key is set to the length of the string by detect()
        foreach (self::$xss as $inputs) {
            krsort( $inputs, SORT_NUMERIC );
            foreach ($inputs as $values) {
                if (is_array($values)) {
                    foreach ($values as $value) {
                        if (false !== strpos( self::$output, $value)) {
                            // One of the potential XSS attack inputs has been found _unchanged_ in the output
                            return true;
                        }
                    }
                }
            }
        }

        return false;
    }

    public static function ignore($name, $method = 'GET')
    {
        self::$ignoreList[$method][$name] = 1;
    }
}