CSRF
+Token should be used inside hidden input, text input just used for demo purpose.
+ + ++ + "; + echo "Expected token: " . Request::session("csrf-token") . "
"; + echo Misc::verifyCsrfTokenPost() ? "Valid" : "Invalid"; + } + ?> +
An error occurred in the request.
Please contact the webmaster
"); + } + } + + private function autoload() + { + spl_autoload_register(function ($class) { + if (str_starts_with($class, __NAMESPACE__ . "\\")) { + $class = str_replace(__NAMESPACE__ . "\\", "", $class); + require_once "{$class}.php"; + } + }); + } +} diff --git a/function/Logger.php b/function/Logger.php new file mode 100644 index 0000000..21a1a29 --- /dev/null +++ b/function/Logger.php @@ -0,0 +1,75 @@ + "NOTICE", + E_USER_NOTICE => "NOTICE", + E_WARNING => "WARNING", + E_USER_DEPRECATED => "DEPRECATED", + E_DEPRECATED => "DEPRECATED", + E_USER_WARNING => "WARNING", + E_ERROR => "ERROR", + E_USER_ERROR => "ERROR", + default => "UNKNOWN", + }; + error_log("$levelName: $message"); + } + + public static function logPath(string $type): string + { + $path = Config::LOG_PATH[$type] ?? "filerouter_{date}.log"; + $path = str_replace("{date}", date("Y-m-d"), $path); + $file = $_SERVER["DOCUMENT_ROOT"] . $path; + if (file_exists($file) && filesize($file) >= Config::LOG_MAX_FILE_SIZE) { + $file = self::getNewLogFile($file); + } + return $file; + } + + private static function getNewLogFile($file) + { + $logDir = dirname($file); + $baseName = basename($file, '.log'); + $index = 1; + + do { + $newFile = $logDir . DIRECTORY_SEPARATOR . $baseName . '_' . $index . '.log'; + $index++; + } while (file_exists($newFile)); + + return $newFile; + } +} diff --git a/function/Misc.php b/function/Misc.php index 536d89a..f3d00c2 100644 --- a/function/Misc.php +++ b/function/Misc.php @@ -5,6 +5,8 @@ FileRouter A simple php router that allows to run code before accessing a file while keeping the file structure as the url structure. +https://github.com/Friedinger/FileRouter + by Friedinger (friedinger.org) */ @@ -18,6 +20,8 @@ */ final class Misc { + private static string $csrfToken; + /** * Starts a session if one is not already started and returns the session ID. * Session name and cookie parameters are set in the Config class. @@ -34,6 +38,59 @@ public static function session(): string|false return session_id(); } + /** + * Generates a CSRF token and stores it in the session. + * The token is a 64-character hexadecimal string. + * + * @param bool $regenerate Flag indicating if the token should be regenerated. + * @return string The generated CSRF token. + */ + public static function generateCsrfToken(): string + { + if (empty(self::$csrfToken)) { + self::$csrfToken = bin2hex(random_bytes(Config::CSRF_LENGTH / 2)); + Request::setSession(self::$csrfToken, Config::CSRF_TEMPLATE); + } + return self::$csrfToken; + } + + /** + * Verifies a CSRF token by comparing it to the token stored in the session. + * Regenerates the token after verification. + * + * @param string $token The token to verify. + * @return bool True if the token is valid, false otherwise. + */ + public static function verifyCsrfToken(string|null $token): bool + { + if ($token == null) return false; + $verify = hash_equals(Request::session(Config::CSRF_TEMPLATE) ?? "", $token); + self::generateCsrfToken(); + return $verify; + } + + /** + * Verifies a CSRF token from a GET request. + * The token is retrieved from the query string. + * + * @return bool True if the token is valid, false otherwise. + */ + public static function verifyCsrfTokenGet(): bool + { + return self::verifyCsrfToken(Request::get(Config::CSRF_PARAMETER)); + } + + /** + * Verifies a CSRF token from a POST request. + * The token is retrieved from the request body. + * + * @return bool True if the token is valid, false otherwise. + */ + public static function verifyCsrfTokenPost(): bool + { + return self::verifyCsrfToken(Request::post(Config::CSRF_PARAMETER)); + } + /** * Retrieves the MIME type of a file. * Uses mime_content_type as default, but also provides a custom list of MIME types based on file extension. diff --git a/function/Output.php b/function/Output.php index f12bf6a..6396522 100644 --- a/function/Output.php +++ b/function/Output.php @@ -5,6 +5,8 @@ FileRouter A simple php router that allows to run code before accessing a file while keeping the file structure as the url structure. +https://github.com/Friedinger/FileRouter + by Friedinger (friedinger.org) */ @@ -13,6 +15,7 @@ use DOMDocument; use DOMNode; +use DOMXPath; /** * Class Output @@ -48,8 +51,7 @@ public function __construct(string $content, bool $directInput = false) // Get content from file without processing php $output = file_get_contents($content); } - - $output = mb_convert_encoding($output, "HTML-ENTITIES", "UTF-8"); + $output = mb_encode_numericentity($output, [0x80, 0x10FFFF, 0, ~0], "UTF-8"); $this->dom->loadHTML($output, LIBXML_NOERROR); // Load html content into dom } @@ -87,6 +89,22 @@ public function replaceAll(string $tag, string $content): void $this->replaceAttributes($tag, $content); // Replace attributes with tag } + /** + * Replaces all occurrences of a given tag with the specified content. + * This method replaces both nodes and attributes with the given tag. + * Replaces the nodes itself, not only the content of them. + * The tag is case-insensitive. + * The content is sanitized to prevent XSS attacks. + * + * @param string $tag The tag to be replaced. + * @param string $content The content to replace the tag with. + * @return void + */ + public function replaceAllSafe(string $tag, string $content): void + { + $this->replaceAll($tag, htmlspecialchars($content)); + } + /** * Replaces the content of nodes with a specified tag with new content. * Preserves the tag and attributes of the nodes. @@ -135,7 +153,7 @@ public function getContent(string ...$tags): string|null $dom = $domNew; } $content = $dom->saveHTML(); // Save html content from dom - $content = mb_convert_encoding($content, "HTML-ENTITIES", "UTF-8"); + $content = mb_encode_numericentity($content, [0x80, 0x10FFFF, 0, ~0], "UTF-8"); $content = str_replace("%20", " ", $content); return trim($content); // Return html content as string } @@ -168,7 +186,7 @@ private function replaceNode(string $tag, string $content): void foreach (iterator_to_array($nodeList) as $node) { // Iterate over nodes with tag foreach ($replacement as $child) { $child = $child->cloneNode(true); - $node->parentNode->appendChild($child); // Append content as html nodes to parent node + $node->parentNode->insertBefore($child, $node); // Insert content as html nodes before old node } $node->parentNode->removeChild($node); // Remove old node } @@ -176,13 +194,15 @@ private function replaceNode(string $tag, string $content): void private function replaceAttributes(string $tag, string $content): void { - $nodeList = $this->dom->getElementsByTagName("*"); // Get all nodes - foreach ($nodeList as $node) { - foreach (iterator_to_array($node->attributes) as $attribute) { - $value = $attribute->value; // Get attribute value - if (stripos($value, "<{$tag}") !== false) { // Check if attribute value contains tag - $attribute->value = str_ireplace(["<{$tag}>", "<{$tag} />", "<{$tag}/>"], $content, $attribute->nodeValue); // Replace tag with content in attribute value - } + // Find nodes with attributes containing tag + $xpath = new DOMXPath($this->dom); + $query = "//" . "*[@*[contains(translate(., 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz'), '" . strtolower($tag) . "')]]"; + $nodes = $xpath->query($query); + + foreach ($nodes as $node) { // Iterate over nodes with attributes containing tag + foreach ($node->attributes as $attribute) { + // Replace tag with content in attribute value + $attribute->value = str_ireplace(["<{$tag}>", "<{$tag} />", "<{$tag}/>", "<{$tag}>"], $content, $attribute->value); } } } @@ -195,7 +215,7 @@ private function importNodes(string $value): array } $valueDom = new DOMDocument(); - $valueDom->loadHTML(mb_convert_encoding($value, 'HTML-ENTITIES', 'UTF-8'), LIBXML_NOERROR); // Load html value into dom + $valueDom->loadHTML(mb_encode_numericentity($value, [0x80, 0x10FFFF, 0, ~0], "UTF-8"), LIBXML_NOERROR); // Load html value into dom $importedNodes = []; foreach ($valueDom->getElementsByTagName("body")->item(0)->childNodes as $child) { array_push($importedNodes, $this->dom->importNode($child, true)); // Import nodes from value dom to main dom and add to array diff --git a/function/Proxy.php b/function/Proxy.php index 8a73474..02fb64f 100644 --- a/function/Proxy.php +++ b/function/Proxy.php @@ -5,6 +5,8 @@ FileRouter A simple php router that allows to run code before accessing a file while keeping the file structure as the url structure. +https://github.com/Friedinger/FileRouter + by Friedinger (friedinger.org) */ @@ -18,7 +20,7 @@ */ class Proxy { - private static $handleCustom; + private static mixed $handleCustom; /** * Loads and processes route file. @@ -61,38 +63,37 @@ public function handle(string $uri = null): bool */ public static function handleCustom(Output $content, Output $settings): Output { - $handleCustom = self::$handleCustom ?? null; // Get custom route file callable if set - if (isset($handleCustom)) { - $parameters = [[$content, $settings], [$content], []]; // Define parameter combinations - $success = false; // Flag indicating if callable was successful - foreach ($parameters as $parameter) { - try { - $return = call_user_func_array($handleCustom, $parameter); // Call function with parameters - if ($return instanceof Output) $content = $return; // Set content to return value if output - $success = true; - break; - } catch (\Throwable $e) { - // Continue with next parameter combination if callable failed - } - } - if (!$success) { - throw new Error(500, "Error in route file callable: {$e->getMessage()}"); // Error 500 if callable failed with all parameter combinations - } - } + // No handling if no custom route file callable set + if (!isset(self::$handleCustom)) return $content; + + // Get parameters of custom route file callable + $reflection = new \ReflectionFunction(self::$handleCustom); + $parameters = array_map(function ($parameter) use ($content, $settings) { + return match ($parameter->getName()) { + "content" => $content, + "settings" => $settings, + default => null, + }; + }, $reflection->getParameters()); + + $return = call_user_func_array(self::$handleCustom, $parameters); // Call custom route file callable with parameters + if ($return instanceof Output) $content = $return; // Set content to return value if output return $content; // Return handled content } private function getRouteFile(string $path): string|null { - $path = $_SERVER["DOCUMENT_ROOT"] . Config::PATH_PUBLIC . $path; // Combine document root, public path and URI to get file path + // Combine document root, public path and URI to get full path + $path = rtrim($_SERVER["DOCUMENT_ROOT"] . Config::PATH_PUBLIC . $path, '/'); - // Find route file in directory structure up to 100 directories deep - for ($iteration = 0; $iteration < 100; $iteration++) { + while ($path != rtrim($_SERVER["DOCUMENT_ROOT"] . Config::PATH_PUBLIC, '/')) { $file = "{$path}/_route.php"; // Construct route file path - if (file_exists($file)) return $file; // Check if route file exists - if ($path == $_SERVER["DOCUMENT_ROOT"] . Config::PATH_PUBLIC) break; // Stop if public path reached - $path = dirname($path) . "/"; // Move up one directory + if (file_exists($file)) { + return $file; // Check if route file exists + } + $path = dirname($path); // Move up one directory } + return null; // Return null if no route file found } } diff --git a/function/Redirect.php b/function/Redirect.php new file mode 100644 index 0000000..d406f40 --- /dev/null +++ b/function/Redirect.php @@ -0,0 +1,27 @@ + - Header: Home Protect Proxy + Header: Home Protect Proxy CSRF Error Redirect \ No newline at end of file diff --git a/public/csrf/index.php b/public/csrf/index.php new file mode 100644 index 0000000..b35382a --- /dev/null +++ b/public/csrf/index.php @@ -0,0 +1,22 @@ +Token should be used inside hidden input, text input just used for demo purpose.
+ + +