request.php

<?php
namespace Bitrix\Security\Filter;
 
use Bitrix\Main\Config\Option;
use Bitrix\Main\Config\Ini;
use Bitrix\Main\Type\IRequestFilter;
 
class Request implements IRequestFilter
{
    const ACTION_NONE = 'none';
    const ACTION_CLEAR = 'clear';
    const ACTION_FILTER = 'filter';
 
    protected $auditors = [];
    protected $changedContext = [];
 
    private $action = 'filter';
    private $doLog = false;
    private $changedVars = [];
    private $isAuditorsTriggered = false;
    private $filteringMap = [
        'get' => [
            'Name' => '$_GET',
        ],
        'post' => [
            'Name' => '$_POST',
            'SkipRegExp' => '#^File\d+_\d+$#',
        ],
        'cookie' => [
            'Name' => '$_COOKIE',
        ],
        'json' => [
            'Name' => 'JSON',
        ],
        'data' => [
            'Name' => 'data',
        ]
    ];
    private static $validActions = [
        self::ACTION_NONE,
        self::ACTION_CLEAR,
        self::ACTION_FILTER,
    ];
 
    public function __construct($customOptions = array())
    {
        if (isset($customOptions['action']))
        {
            $this->setAction($customOptions['action']);
        }
        else
        {
            $this->setAction(Option::get('security', 'filter_action'));
        }
 
        if (isset($customOptions['log']))
        {
            $this->setLog($customOptions['log']);
        }
        else
        {
            $this->setLog(Option::get('security', 'filter_log'));
        }
    }
 
    public function setAuditors(array $auditors)
    {
        $this->auditors = $auditors;
        return $this;
    }
 
    public function getChangedVars()
    {
        return $this->changedVars;
    }
 
    public function filter(array $values, $isReturnChangedOnly = true)
    {
        $this->onFilterStarted();
 
        foreach ($values as $key => &$val)
        {
            if (!isset($this->filteringMap[$key]))
            {
                continue;
            }
 
            if (!is_array($val))
            {
                continue;
            }
 
            $val = $this->filterArray(
                $key,
                $val,
                $this->filteringMap[$key]['Name'],
                $this->filteringMap[$key]['SkipRegExp'] ?? ''
            );
        }
        unset($val);
 
        $this->onFilterFinished();
 
        if ($isReturnChangedOnly)
        {
            return array_intersect_key($values, $this->changedContext);
        }
        return $values;
    }
 
 
    public function isAuditorsTriggered()
    {
        return $this->isAuditorsTriggered;
    }
 
    protected function onFilterStarted()
    {
        $this->changedContext = array();
        $this->changedVars = array();
        $this->isAuditorsTriggered = false;
    }
 
    protected function onFilterFinished()
    {
    }
 
    protected function filterVar($context, $value, $name)
    {
        if (preg_match('#^[A-Za-z0-9_.,-]*$#D', $value))
            return $value;
 
        $filteredValue = \CSecurityHtmlEntity::decodeString($value);
        self::adjustPcreBacktrackLimit($filteredValue);
 
        $isValueChanged = false;
        foreach($this->auditors as $auditName => $auditor)
        {
            if ($auditor->process($filteredValue))
            {
                $this->isAuditorsTriggered = true;
 
                if ($this->isLogNeeded())
                {
                    $this->logVariable($value, $name, $auditName);
                }
 
                if ($this->isFilterAction())
                {
                    $isValueChanged = true;
                    $filteredValue = $auditor->getFilteredValue();
                }
                elseif ($this->isClearAction())
                {
                    $isValueChanged = true;
                    $filteredValue = '';
                    break;
                }
            }
        }
 
        if ($isValueChanged)
        {
            $this->pushChangedVar($context, $value, $name);
            return $filteredValue;
        }
        else
        {
            return $value;
        }
    }
 
    protected function filterArray($context, ?array $array, $name, $skipKeyPreg = '')
    {
        if (!is_array($array))
        {
            return null;
        }
 
        foreach($array as $key => $value)
        {
            if ($skipKeyPreg && preg_match($skipKeyPreg, $key))
                continue;
 
            $filteredKey =  $this->filterVar($context, $key, "{$name}['{$key}']");
            if ($filteredKey != $key)
            {
                unset($array[$key]);
                $key = $filteredKey;
            }
 
            if (is_array($value))
            {
                $array[$key] = $this->filterArray($context, $value, "{$name}['{$key}']", $skipKeyPreg);
            }
            else
            {
                $array[$key] = $this->filterVar($context, $value, "{$name}['{$key}']");
            }
        }
        return $array;
    }
 
    protected static function isActionValid($action)
    {
        return in_array($action, self::getValidActions());
    }
 
    protected static function logVariable($value, $name, $auditorName)
    {
        return \CSecurityEvent::getInstance()->doLog('SECURITY', 'SECURITY_FILTER_'.$auditorName, $name, $value);
    }
 
    protected static function adjustPcreBacktrackLimit($string)
    {
        if (!is_string($string))
            return false;
 
        $strlen = strlen($string) * 2;
        Ini::adjustPcreBacktrackLimit($strlen);
        return true;
    }
 
    protected static function getValidActions()
    {
        return self::$validActions;
    }
 
    protected function setAction($action)
    {
        if (self::isActionValid($action))
        {
            $this->action = $action;
        }
        return $this;
    }
 
    protected function setLog($log)
    {
        $this->doLog = (is_string($log) && $log == 'Y');
        return $this;
    }
 
    protected function isFilterAction()
    {
        return ($this->action === self::ACTION_FILTER);
    }
 
    protected function isClearAction()
    {
        return ($this->action === self::ACTION_CLEAR);
    }
 
    protected function isLogNeeded()
    {
        return $this->doLog;
    }
 
    protected function pushChangedVar($context, $value, $name)
    {
        $this->changedVars[$name] = $value;
        if (!isset($this->changedContext[$context]))
            $this->changedContext[$context] = 1;
        return $this;
    }
}