for testing and deploying your application
for finding and fixing issues
for empowering human code reviews
<?php
/**
* This file is part of SHIELDFY Web Application Firewall Detector.
* (c) 2016 SHIELDFY, All rights reserved.
*
* The code provided was developed by Matthias "Nihylum" Kaschubowski
* The applied license is stored at the root directory of this package.
*/
namespace Shieldfy\Firewall;
use Shieldfy\FirewallInterface;
* Mod_Security Firewall Class.
* @deprecated The checkup does suffer from inconsistency, high fake possibility
* @package shieldfy.waf-detector
* @author Matthias Kaschubowski <[email protected]>
class ModSecurity implements FirewallInterface
{
* returns the name of the firewall.
* @return string
public function getName()
return 'mod_security';
}
* detects whether the provided headers and body string does match the firewall identification rules or not.
* @param string[] $headers
* @param string $bodyString
* @param string $url
* @return bool
public function detect(array $headers, $bodyString, $url)
$response = @file_get_contents("{$url}/../../etc");
sprintf
$url
It is generally a best practice as it is often more readable to use concatenation instead of interpolation for variables inside strings.
// Instead of $x = "foo $bar $baz"; // Better use either $x = "foo " . $bar . " " . $baz; $x = sprintf("foo %s %s", $bar, $baz);
if (strstr($response['content'], 'Mod_Security')) {
if
return
return (bool) strstr($re...ent'], 'Mod_Security');
return true;
return false;
shieldfy /
waf-detector
Loading history...
It is generally a best practice as it is often more readable to use concatenation instead of interpolation for variables inside strings.