1 | <?php |
||
12 | class Bootup |
||
13 | { |
||
14 | /** |
||
15 | * filter request inputs |
||
16 | * |
||
17 | * Ensures inputs are well formed UTF-8 |
||
18 | * When not, assumes Windows-1252 and converts to UTF-8 |
||
19 | * Tests only values, not keys |
||
20 | * |
||
21 | * @param int $normalization_form |
||
22 | * @param string $leading_combining |
||
23 | */ |
||
24 | 1 | public static function filterRequestInputs($normalization_form = 4 /* n::NFC */, $leading_combining = '◌') |
|
62 | |||
63 | /** |
||
64 | * Filter current REQUEST_URI . |
||
65 | * |
||
66 | * @param string|null $uri <p>If null is set, then the server REQUEST_URI will be used.</p> |
||
67 | * @param bool $exit |
||
68 | * |
||
69 | * @return mixed |
||
70 | */ |
||
71 | 1 | public static function filterRequestUri($uri = null, $exit = true) |
|
72 | { |
||
73 | 1 | if (null === $uri) { |
|
74 | |||
75 | 1 | if (!isset($_SERVER['REQUEST_URI'])) { |
|
76 | 1 | return false; |
|
77 | } |
||
78 | |||
79 | 1 | $uri = $_SERVER['REQUEST_URI']; |
|
80 | } |
||
81 | |||
82 | 1 | $uriOrig = $uri; |
|
83 | |||
84 | // |
||
85 | // Ensures the URL is well formed UTF-8 |
||
86 | // |
||
87 | |||
88 | 1 | if (UTF8::is_utf8(\rawurldecode($uri)) === true) { |
|
89 | 1 | return $uri; |
|
90 | } |
||
91 | |||
92 | // |
||
93 | // When not, assumes Windows-1252 and redirects to the corresponding UTF-8 encoded URL |
||
94 | // |
||
95 | |||
96 | 1 | $uri = (string)\preg_replace_callback( |
|
97 | 1 | '/[\x80-\xFF]+/', |
|
98 | function ($m) { |
||
99 | 1 | return \rawurlencode($m[0]); |
|
100 | 1 | }, |
|
101 | 1 | $uri |
|
102 | ); |
||
103 | |||
104 | 1 | $uri = (string)\preg_replace_callback( |
|
105 | 1 | '/(?:%[89A-F][0-9A-F])+/i', |
|
106 | 1 | function ($m) { |
|
107 | 1 | return \rawurlencode(UTF8::rawurldecode($m[0])); |
|
108 | 1 | }, |
|
109 | 1 | $uri |
|
110 | ); |
||
111 | |||
112 | if ( |
||
113 | 1 | $uri !== $uriOrig |
|
114 | && |
||
115 | 1 | $exit === true |
|
116 | && |
||
117 | 1 | \headers_sent() === false |
|
118 | ) { |
||
119 | // Use ob_start() to buffer content and avoid problem of headers already sent... |
||
120 | $severProtocol = ($_SERVER['SERVER_PROTOCOL'] ?? 'HTTP/1.1'); |
||
121 | \header($severProtocol . ' 301 Moved Permanently'); |
||
122 | \header('Location: ' . $uri); |
||
|
|||
123 | exit(); |
||
124 | } |
||
125 | |||
126 | 1 | return $uri; |
|
127 | } |
||
128 | |||
129 | /** |
||
130 | * Normalizes to UTF-8 NFC, converting from WINDOWS-1252 when needed. |
||
131 | * |
||
132 | * @param mixed $input |
||
133 | * @param int $normalization_form |
||
134 | * @param string $leading_combining |
||
135 | * |
||
136 | * @return mixed |
||
137 | */ |
||
138 | 1 | public static function filterString($input, int $normalization_form = 4 /* n::NFC */, string $leading_combining = '◌') |
|
142 | |||
143 | /** |
||
144 | * Get random bytes via "random_bytes()" |
||
145 | * |
||
146 | * @param int $length <p>output length</p> |
||
147 | * |
||
148 | * @return string|false <p>false on error</p> |
||
149 | * |
||
150 | * @throws \Exception <p>If it was not possible to gather sufficient entropy.</p> |
||
151 | */ |
||
152 | 1 | public static function get_random_bytes($length) |
|
166 | |||
167 | /** |
||
168 | * bootstrap |
||
169 | */ |
||
170 | 1 | public static function initAll() |
|
176 | |||
177 | /** |
||
178 | * Determines if the current version of PHP is equal to or greater than the supplied value. |
||
179 | * |
||
180 | * @param string $version <p>e.g. "7.1"<p> |
||
181 | * |
||
182 | * @return bool <p>Return <strong>true</strong> if the current version is $version or higher</p> |
||
183 | */ |
||
184 | 4 | public static function is_php($version): bool |
|
196 | } |
||
197 |
'Location: ' . $uri
can contain request data and is used in response header context(s) leading to a potential security vulnerability.1 path for user data to reach this point
REQUEST_URI
from$_SERVER,
and$uri
is assignedin src/voku/helper/Bootup.php on line 79
$uri
is passed through preg_replace_callback()in src/voku/helper/Bootup.php on line 101
$uri
is assignedin src/voku/helper/Bootup.php on line 96
$uri
is passed through preg_replace_callback()in src/voku/helper/Bootup.php on line 109
$uri
is assignedin src/voku/helper/Bootup.php on line 104
Response Splitting Attacks
Allowing an attacker to set a response header, opens your application to response splitting attacks; effectively allowing an attacker to send any response, he would like.
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: