Added new firewall engine whitelist processor. Moved legacy whitelist rule processor to its own ruleset. Removed preg_replace to improve performance. Added test for new engine whitelist rules.

dave83649 · dave83649 · commit e7793eef6f3a · 2022-04-06T16:33:38.000+02:00
diff --git a/src/Extensions/WordPress/Extension.php b/src/Extensions/WordPress/Extension.php
@@ -12,8 +12,32 @@ class Extension implements ExtensionInterface
      * @var array
      */
     public $options = array(
-    'patchstack_basic_firewall_roles' => array('administrator', 'editor', 'author'),
-    'patchstack_custom_whitelist_rules' => ''
+        'patchstack_basic_firewall_roles' => array('administrator', 'editor', 'author'),
+        'patchstack_custom_whitelist_rules' => ''
+    );
+
+    /**
+     * The request parameter values exploded into pairs.
+     *
+     * @var array
+     */
+    private $requestParams = array(
+        'method' => 'method',
+        'rulesFile' => 'rules->file',
+        'rulesRawPost' => 'rules->raw->post',
+        'rulesUri' => 'rules->uri',
+        'rulesHeadersAll' => 'rules->headers->all',
+        'rulesHeadersKeys' => 'rules->headers->keys',
+        'rulesHeadersValues' => 'rules->headers->values',
+        'rulesHeadersCombinations' => 'rules->headers->combinations',
+        'rulesBodyAll' => 'rules->body->all',
+        'rulesBodyKeys' => 'rules->body->keys',
+        'rulesBodyValues' => 'rules->body->values',
+        'rulesBodyCombinations' => 'rules->body->combinations',
+        'rulesParamsAll' => 'rules->params->all',
+        'rulesParamsKeys' => 'rules->params->keys',
+        'rulesParamsValues' => 'rules->params->values',
+        'rulesParamsCombinations' => 'rules->params->combinations'
     );
 
     /**
@@ -194,14 +218,12 @@ private function isWhitelistedCustom()
             if (count($t) == 2) {
                 $val = strtolower(trim($t[1]));
                 switch (strtolower($t[0])) {
-                  // IP address match.
-                    case 'ip':
+                    case 'ip': // IP address match.
                         if ($ip == $val) {
                             return true;
                         }
                         break;
-                  // Payload match.
-                    case 'payload':
+                    case 'payload': // Payload match.
                         if (count($_POST) > 0 && strpos(strtolower(print_r($_POST, true)), $val) !== false) {
                             return true;
                         }
@@ -210,8 +232,7 @@ private function isWhitelistedCustom()
                             return true;
                         }
                         break;
-                        // URL match.
-                    case 'url':
+                    case 'url': // URL match.
                         if (strpos(strtolower($_SERVER['REQUEST_URI']), $val) !== false) {
                             return true;
                         }
@@ -225,6 +246,10 @@ private function isWhitelistedCustom()
 
     /**
      * Determine if the request is whitelisted.
+     *
+     * @param array $whitelistRules
+     * @param array $request
+     * @return boolean
      */
     public function isWhitelisted($whitelistRules, $request)
     {
@@ -239,28 +264,28 @@ public function isWhitelisted($whitelistRules, $request)
         }
 
         // Grab visitor's IP address and request data.
-        $client_ip = $this->getIpAddress();
+        $clientIp = $this->getIpAddress();
         $requests  = $request;
 
         foreach ($whitelistRules as $whitelist) {
-            $whitelist_rule = json_decode($whitelist['rule']);
+            $whitelistRule = json_decode($whitelist['rule']);
 
             // If an IP address match is given, determine if it matches.
-            $ip = isset($whitelist_rule->rules, $whitelist_rule->rules->ip_address) ? $whitelist_rule->rules->ip_address : null;
+            $ip = isset($whitelistRule->rules, $whitelistRule->rules->ip_address) ? $whitelistRule->rules->ip_address : null;
             if (!is_null($ip)) {
                 if (strpos($ip, '*') !== false) {
-                    $whitelisted_ip = $this->plugin->ban->check_wildcard_rule($client_ip, $ip);
+                    $isWhitelistedIp = $this->plugin->ban->check_wildcard_rule($clientIp, $ip);
                 } elseif (strpos($ip, '-') !== false) {
-                    $whitelisted_ip = $this->plugin->ban->check_range_rule($client_ip, $ip);
+                    $isWhitelistedIp = $this->plugin->ban->check_range_rule($clientIp, $ip);
                 } elseif (strpos($ip, '/') !== false) {
-                    $whitelisted_ip = $this->plugin->ban->check_subnet_mask_rule($client_ip, $ip);
-                } elseif ($client_ip == $ip) {
-                    $whitelisted_ip = true;
+                    $isWhitelistedIp = $this->plugin->ban->check_subnet_mask_rule($clientIp, $ip);
+                } elseif ($clientIp == $ip) {
+                    $isWhitelistedIp = true;
                 } else {
-                    $whitelisted_ip = false;
+                    $isWhitelistedIp = false;
                 }
             } else {
-                $whitelisted_ip = true;
+                $isWhitelistedIp = true;
             }
 
             foreach ($requests as $key => $request) {
@@ -269,21 +294,20 @@ public function isWhitelisted($whitelistRules, $request)
                     $key = 'rulesBodyAll';
                 }
 
-                if ($whitelist_rule->method == $requests['method'] || $whitelist_rule->method == 'ALL') {
-                    $test = strtolower(preg_replace('/(?!^)[A-Z]{2,}(?=[A-Z][a-z])|[A-Z][a-z]/', '->$0', $key));
-                    $exp = explode('->', $test);
+                if (isset($this->requestParams[$key]) && ($whitelistRule->method == $requests['method'] || $whitelistRule->method == 'ALL')) {
+                    $exp = explode('->', $this->requestParams[$key]);
 
                     // Determine if a rule exists for this request.
-                    $rule = $whitelist_rule;
+                    $rule = $whitelistRule;
                     foreach ($exp as $var) {
                         if (!isset($rule->$var)) {
-                               $rule = null;
-                               continue;
+                            $rule = null;
+                            continue;
                         }
                         $rule = $rule->$var;
                     }
 
-                    if (!is_null($rule) && substr($key, 0, 4) == 'rule' && $this->isRuleMatch($rule, $request) && $whitelisted_ip) {
+                    if (!is_null($rule) && substr($key, 0, 4) == 'rule' && $this->isRuleMatch($rule, $request) && $isWhitelistedIp) {
                         return true;
                     }
                 }
diff --git a/src/Processor.php b/src/Processor.php
@@ -29,6 +29,13 @@ class Processor
      */
     private $whitelistRules = array();
 
+    /**
+     * The legacy whitelist rules to process.
+     *
+     * @var array
+     */
+    private $whitelistRulesLegacy = array();
+
     /**
      * Firewall datasets which can be interacted with by the firewall rules.
      *
@@ -82,24 +89,29 @@ class Processor
      *
      * @param ExtensionInterface $extension
      * @param array $firewallRules
-     * @param array $firewallRulesLegacy
      * @param array $whitelistRules
      * @param array $options
+     * @param array $datasets
+     * @param array $firewallRulesLegacy
+     * @param array $whitelistRulesLegacy
+     * @return void
      */
     public function __construct(
         ExtensionInterface $extension,
         $firewallRules = array(),
-        $firewallRulesLegacy = array(),
         $whitelistRules = array(),
         $options = array(),
-        $datasets = array()
+        $datasets = array(),
+        $firewallRulesLegacy = array(),
+        $whitelistRulesLegacy = array()
     ) {
         $this->extension = $extension;
         $this->firewallRules = $firewallRules;
-        $this->firewallRulesLegacy = $firewallRulesLegacy;
         $this->whitelistRules = $whitelistRules;
         $this->options = array_merge($this->options, $options);
         $this->dataset = $datasets;
+        $this->firewallRulesLegacy = $firewallRulesLegacy;
+        $this->whitelistRulesLegacy = $whitelistRulesLegacy;
 
         $this->secret = isset($options['secret']) ? $options['secret'] : 'secret';
         $this->request = new Request($this->options);
@@ -109,6 +121,7 @@ public function __construct(
     /**
      * Magic getter for the options.
      *
+     * @param string $name
      * @return mixed
      */
     public function __get($name)
@@ -132,22 +145,14 @@ public function launch($mustExit = true)
             $this->extension->forceExit(22);
         }
 
-        // Check for whitelist.
+        // Check for whitelist based on the legacy whitelist rules.
         $request  = $this->request->capture();
-        if ($this->extension->isWhitelisted($this->whitelistRules, $request)) {
+        if ($this->extension->isWhitelisted($this->whitelistRulesLegacy, $request)) {
             return true;
         }
 
-        // Grab the IP address of the request.
-        $ip = $this->extension->getIpAddress();
-
-        // Run the legacy firewall rules processor for backwards compatibility.
-        if (count($this->firewallRulesLegacy) > 0) {
-            $this->launchLegacy(true, $request, $ip);
-        }
-
-        // Determine if we have any firewall rules loaded.
-        if (count($this->firewallRules) == 0) {
+        // Determine if we have any firewall and/or whitelist rules loaded.
+        if (count($this->firewallRules) == 0 && count($this->whitelistRules) == 0) {
             return true;
         }
 
@@ -159,9 +164,15 @@ public function launch($mustExit = true)
             \Laravel\SerializableClosure\SerializableClosure::setSecretKey($this->secret);
         }
 
+        // Grab the IP address of the request.
+        $ip = $this->extension->getIpAddress();
+
         // Store the datasets in a shorter variable for easy access.
         $dataset = $this->dataset;
-        foreach ($this->firewallRules as $rule) {
+
+        // Merge the rules together. First iterate through the whitelist rules.
+        $rules = array_merge($this->whitelistRules, $this->firewallRules);
+        foreach ($rules as $rule) {
             // Get the firewall rule and extract it.
             $vpatch = base64_decode($rule->rule);
             if (!$vpatch) {
@@ -202,9 +213,16 @@ public function launch($mustExit = true)
             } elseif ($rule->type == 'REDIRECT') {
                 $this->extension->logRequest($rule->id, $request, 'REDIRECT');
                 $this->response->redirect($rule->type_params, $mustExit);
+            } elseif ($rule->type == 'WHITELIST') {
+                return $mustExit;
             }
         }
 
+        // Run the legacy firewall rules processor for backwards compatibility.
+        if (count($this->firewallRulesLegacy) > 0) {
+            $this->launchLegacy(true, $request, $ip);
+        }
+
         return true;
     }
 
@@ -223,6 +241,26 @@ public function launchLegacy($mustExit = true, $request = array(), $ip = '')
         $client_ip = $ip == '' ? $this->extension->getIpAddress() : $ip;
         $requests  = count($request) == 0 ? $this->request->capture() : $request;
 
+        // The request parameter values exploded into pairs.
+        $requestParams = array(
+            'method' => 'method',
+            'rulesFile' => 'rules->file',
+            'rulesRawPost' => 'rules->raw->post',
+            'rulesUri' => 'rules->uri',
+            'rulesHeadersAll' => 'rules->headers->all',
+            'rulesHeadersKeys' => 'rules->headers->keys',
+            'rulesHeadersValues' => 'rules->headers->values',
+            'rulesHeadersCombinations' => 'rules->headers->combinations',
+            'rulesBodyAll' => 'rules->body->all',
+            'rulesBodyKeys' => 'rules->body->keys',
+            'rulesBodyValues' => 'rules->body->values',
+            'rulesBodyCombinations' => 'rules->body->combinations',
+            'rulesParamsAll' => 'rules->params->all',
+            'rulesParamsKeys' => 'rules->params->keys',
+            'rulesParamsValues' => 'rules->params->values',
+            'rulesParamsCombinations' => 'rules->params->combinations'
+        );
+
         // Iterate through all root objects.
         foreach ($this->firewallRulesLegacy as $firewall_rule) {
             $rule_terms = json_decode($firewall_rule['rule']);
@@ -255,8 +293,10 @@ public function launchLegacy($mustExit = true, $request = array(), $ip = '')
 
                 // Determine if the requesting method matches.
                 if ($rule_terms->method == $requests['method'] || $rule_terms->method == 'ALL' || $rule_terms->method == 'GET' || ($rule_terms->method == 'FILES' && $this->extension->isFileUploadRequest())) {
-                    $test = strtolower(preg_replace('/(?!^)[A-Z]{2,}(?=[A-Z][a-z])|[A-Z][a-z]/', '->$0', $key));
-                    $exp  = explode('->', $test);
+                    if (!isset($requestParams[$key])) {
+                        continue;
+                    }
+                    $exp  = explode('->', $requestParams[$key]);
 
                     // Determine if a rule exists for this request.
                     $rule = $rule_terms;
@@ -296,7 +336,7 @@ public function launchLegacy($mustExit = true, $request = array(), $ip = '')
     /**
      * Determine if the request matches the given firewall or whitelist rule.
      *
-     * @param string       $rule
+     * @param string $rule
      * @param string|array $request
      * @return bool
      */
diff --git a/tests/FirewallDatasetTest.php b/tests/FirewallDatasetTest.php
@@ -46,7 +46,6 @@ private function setUpFirewallProcessor(array $rules)
             $rules,
             [],
             [],
-            [],
             $this->datasets
         );
     }
diff --git a/tests/FirewallLegacyTest.php b/tests/FirewallLegacyTest.php
@@ -39,6 +39,9 @@ private function setUpFirewallProcessor(array $rules)
         $this->processor = new Processor(
             new Extension(),
             [],
+            [],
+            [],
+            [],
             $rules
         );
     }
diff --git a/tests/WhitelistTest.php b/tests/WhitelistTest.php
diff --git a/tests/data/Whitelist.json b/tests/data/Whitelist.json

Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,6 @@ private function setUpFirewallProcessor(array $rules)`
`46`	`46`	`$rules,`
`47`	`47`	`[],`
`48`	`48`	`[],`
`49`		`- [],`
`50`	`49`	`$this->datasets`
`51`	`50`	`);`
`52`	`51`	`}`