Changeset 14723

Timestamp:

12/06/10 22:02:08 (18 months ago)

Author:

Alexander Trofimov

Message:

Ticket #2312

Location:

trunk/plugins/phpids/IDS

Files:

• Converter.php (modified) (5 diffs)
• default_filter.xml (modified) (5 diffs)

trunk/plugins/phpids/IDS/Converter.php

@@ -123 +123 @@
         $value = preg_replace('/(<\w+)\/+(\w+=?)/m', '$1/$2', $value);
         $value = preg_replace('/[^\\\:]\/\/(.*)$/m', '/**/$1', $value);
+        $value = preg_replace('/([^\-&])#.*[\r\n\v\f]/m', '$1', $value);
 
         return $value;
@@ -303 +304 @@
     {
         $matches = array();
-        if(preg_match_all('/(?:(?:\A|[^\d])0x[a-f\d]{2,}[a-f\d]*)+/im', $value, $matches)) {
+        if(preg_match_all('/(?:(?:\A|[^\d])0x[a-f\d]{3,}[a-f\d]*)+/im', $value, $matches)) {
             foreach($matches[0] as $match) {
                 $converted = '';
@@ -315 +316 @@
         }
         // take care of hex encoded ctrl chars
-        $value = preg_replace('/0x\d+/m', 1, $value);
+        $value = preg_replace('/0x\d+/m', ' 1 ', $value);
         
         return $value;
@@ -330 +331 @@
     public static function convertFromSQLKeywords($value)
     {
-        $pattern = array('/(?:IS\s+null)|(LIKE\s+null)|' .
-            '(?:(?:^|\W)IN[+\s]*\([\s\d"]+[^()]*\))/ims');
+        $pattern = array('/(?:is\s+null)|(like\s+null)|' .
+            '(?:(?:^|\W)in[+\s]*\([\s\d"]+[^()]*\))/ims');
         $value   = preg_replace($pattern, '"=0', $value);
+        
         $value   = preg_replace('/\W+\s*like\s*\W+/ims', '1" OR "1"', $value);
         $value   = preg_replace('/null[,"\s]/ims', ',0', $value);
@@ -340 +342 @@
         $value   = preg_replace('/(?:and\s+\d+\.?\d*)/ims', '', $value);
         $value   = preg_replace('/(?:\s+and\s+)/ims', ' or ', $value);
-        $pattern = array('/[^\w,(]NULL|\\\N|TRUE|FALSE|UTC_TIME|' .
-                         'LOCALTIME(?:STAMP)?|CURRENT_\w+|BINARY|' .
-                         '(?:(?:ASCII|SOUNDEX|FIND_IN_SET|' .
-                         'MD5|R?LIKE)[+\s]*\([^()]+\))|(?:-+\d)/ims');
+
+        $pattern = array('/[^\w,(]null|\\\n|true|false|utc_time|' .
+                         'localtime(?:stamp)?|current_\w+|binary|' .
+                         '(?:(?:ascii|soundex|find_in_set|' .
+                         'md5|r?like)[+\s]*\([^()]+\))|(?:-+\d)/ims');
         $value   = preg_replace($pattern, 0, $value);
-        $pattern = array('/(?:NOT\s+BETWEEN)|(?:IS\s+NOT)|(?:NOT\s+IN)|' .
-                         '(?:XOR|\WDIV\W|<>|RLIKE(?:\s+BINARY)?)|' .
-                         '(?:REGEXP\s+BINARY)|' .
-                         '(?:SOUNDS\s+LIKE)/ims');
+
+        $pattern = array('/(?:not\s+between)|(?:is\s+not)|(?:not\s+in)|' .
+                         '(?:xor|<>|rlike(?:\s+binary)?)|' .
+                         '(?:regexp\s+binary)|' .
+                         '(?:sounds\s+like)/ims');
         $value   = preg_replace($pattern, '!', $value);
         $value   = preg_replace('/"\s+\d/', '"', $value);
+        $value   = preg_replace('/(\W)div(\W)/ims', '$1 OR $2', $value);
         $value   = preg_replace('/\/(?:\d+|null)/', null, $value);
 

trunk/plugins/phpids/IDS/default_filter.xml

@@ -21 +21 @@
     </filter>
     <filter>
-        <id>69</id>
-        <rule><![CDATA[(?:[\s\d\/"]+(?:on\w+|style|poster|background)=[$"\w])]]></rule>
-        <description>finds malicious attribute injection attempts</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>6</impact>
-    </filter>   
-    <filter>
         <id>3</id>
         <rule><![CDATA[(?:^>[\w\s]*<\/?\w{2,}>)]]></rule>
@@ -229 +219 @@
     <filter>
         <id>21</id>
-        <rule><![CDATA[(?:,\s*(?:alert|showmodaldialog|eval)\s*,)|(?::\s*eval\s*[^\s])|([^:\s\w,.\/?+-]\s*)?(?<![a-z\/_@])(\s*return\s*)?(?:(?:document\s*\.)?(?:.+\/)?(?:alert|eval|msgbox|showmodaldialog|prompt|write(?:ln)?|confirm|dialog|open))\s*(?:[^a-z\s]|(?:\s*[^\s\w,.@\/+-]))|(?:java[\s\/]*\.[\s\/]*lang)|(?:\w\s*=\s*new\s+\w+)|(?:&\s*\w+\s*\)[^,])|(?:\+[\W\d]*new\s+\w+[\W\d]*\+)|(?:document\.\w)]]></rule>
+        <rule><![CDATA[(?:,\s*(?:alert|showmodaldialog|eval)\s*,)|(?::\s*eval\s*[^\s])|([^:\s\w,.\/?+-]\s*)?(?<![a-z\/_@])(\s*return\s*)?(?:(?:document\s*\.)?(?:.+\/)?(?:alert|eval|msgbox|showmodaldialog|prompt|write(?:ln)?|confirm|dialog|open))\s*(?:[^a-z\s\-]|(?:\s*[^\s\w,.@\/+-]))|(?:java[\s\/]*\.[\s\/]*lang)|(?:\w\s*=\s*new\s+\w+)|(?:&\s*\w+\s*\)[^,])|(?:\+[\W\d]*new\s+\w+[\W\d]*\+)|(?:document\.\w)]]></rule>
         <description>Detects very basic XSS probings</description>
         <tags>
@@ -603 +593 @@
     <filter>
         <id>57</id>
-        <rule><![CDATA[(?:select\s*\*\s*from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s*\(\s*space\s*\()]]></rule>
-        <description>Detects MySQL comment-/space-obfuscated injections</description>
+        <rule><![CDATA[(?:,.*[)\da-f"]"(?:".*"|\Z|[^"]+))|(?:select\s*\*\s*from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s*\(\s*space\s*\()]]></rule>
+        <description>Detects MySQL comment-/space-obfuscated injections and backtick termination</description>
         <tags>
             <tag>sqli</tag>
@@ -657 +647 @@
     <filter>
         <id>62</id>
-        <rule><![CDATA[(?:function[^(]*\([^)]*\))|(?:(?:delete|void|throw|instanceof|new|typeof)\W+\w+\s*[([])|([)\]]\s*\.\s*\w+\s*=)|(?:\(\s*new\s+\w+\s*\)\.)]]></rule>
+        <rule><![CDATA[(?:function[^(]*\([^)]*\))|(?:(?:delete|void|throw|instanceof|new|typeof)[^\w.]+\w+\s*[([])|([)\]]\s*\.\s*\w+\s*=)|(?:\(\s*new\s+\w+\s*\)\.)]]></rule>
         <description>Detects common function declarations and special JS operators</description>
         <tags>
@@ -737 +727 @@
         </tags>
         <impact>4</impact>
-    </filter>      
+    </filter>
+    <filter>
+        <id>71</id>
+        <rule><![CDATA[(?:[\s\d\/"]+(?:on\w+|style|poster|background)=[$"\w])]]></rule>
+        <description>finds malicious attribute injection attempts</description>
+        <tags>
+            <tag>xss</tag>
+            <tag>csrf</tag>
+        </tags>
+        <impact>6</impact>
+    </filter>   
 </filters>