| 1 |
<?php |
| 2 |
/** |
| 3 |
* Author: Hoang Ngo |
| 4 |
*/ |
| 5 |
|
| 6 |
namespace WP_Defender\Component\Security_Headers; |
| 7 |
|
| 8 |
use WP_Defender\Component\Security_Header; |
| 9 |
|
| 10 |
class Sh_XSS_Protection extends Security_Header { |
| 11 |
static $rule_slug = 'sh_xss_protection'; |
| 12 |
|
| 13 |
public function check() { |
| 14 |
$model = $this->get_model(); |
| 15 |
|
| 16 |
if ( ! $model->sh_xss_protection ) { |
| 17 |
return false; |
| 18 |
} |
| 19 |
if ( isset( $model->sh_xss_protection_mode ) && ! empty( $model->sh_xss_protection_mode ) ) { |
| 20 |
return true; |
| 21 |
} |
| 22 |
$headers = $this->head_request( network_site_url(), self::$rule_slug ); |
| 23 |
if ( is_wp_error( $headers ) ) { |
| 24 |
$this->log( sprintf( 'Self ping error: %s', $headers->get_error_message() ) ); |
| 25 |
|
| 26 |
return false; |
| 27 |
} |
| 28 |
|
| 29 |
if ( isset( $headers['x-xss-protection'] ) ) { |
| 30 |
$header_xss_protection = is_array( $headers['x-xss-protection'] ) |
| 31 |
? $headers['x-xss-protection'][0] |
| 32 |
: $headers['x-xss-protection']; |
| 33 |
$content = strtolower( trim( $header_xss_protection ) ); |
| 34 |
$content = explode( ';', $content ); |
| 35 |
if ( 1 === count( $content ) ) { |
| 36 |
$model->sh_xss_protection_mode = 'sanitize'; |
| 37 |
} else { |
| 38 |
$content = explode( '=', $content[1] ); |
| 39 |
$model->sh_xss_protection_mode = $content[1]; |
| 40 |
} |
| 41 |
$model->save(); |
| 42 |
|
| 43 |
return true; |
| 44 |
} |
| 45 |
|
| 46 |
return false; |
| 47 |
} |
| 48 |
|
| 49 |
/** |
| 50 |
* @return array |
| 51 |
*/ |
| 52 |
public function get_misc_data() { |
| 53 |
$model = $this->get_model(); |
| 54 |
|
| 55 |
return array( |
| 56 |
'intro_text' => esc_html__( 'The HTTP X-XSS-Protection response header that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks on Chrome, IE and Safari.', 'wpdef' ), |
| 57 |
'mode' => $model->sh_xss_protection_mode ?? 'sanitize', |
| 58 |
); |
| 59 |
} |
| 60 |
|
| 61 |
public function add_hooks() { |
| 62 |
add_action( 'send_headers', array( $this, 'append_header' ) ); |
| 63 |
} |
| 64 |
|
| 65 |
public function append_header() { |
| 66 |
if ( headers_sent() ) { |
| 67 |
return; |
| 68 |
} |
| 69 |
$model = $this->get_model(); |
| 70 |
if ( ! $this->maybe_submit_header( 'X-XSS-Protection', false ) ) { |
| 71 |
|
| 72 |
return; |
| 73 |
} |
| 74 |
if ( true === $model->sh_xss_protection && in_array( $model->sh_xss_protection_mode, array( 'sanitize', 'block', 'none' ), true ) ) { |
| 75 |
$headers = ''; |
| 76 |
switch ( $model->sh_xss_protection_mode ) { |
| 77 |
case 'sanitize': |
| 78 |
$headers = 'X-XSS-Protection: 1'; |
| 79 |
break; |
| 80 |
case 'block': |
| 81 |
$headers = 'X-XSS-Protection: 1; mode=block'; |
| 82 |
break; |
| 83 |
default: |
| 84 |
break; |
| 85 |
} |
| 86 |
if ( strlen( $headers ) > 0 ) { |
| 87 |
header( trim( $headers ) ); |
| 88 |
} |
| 89 |
} |
| 90 |
} |
| 91 |
|
| 92 |
/** |
| 93 |
* @return string |
| 94 |
*/ |
| 95 |
public function get_title() { |
| 96 |
return __( 'X-XSS-Protection', 'wpdef' ); |
| 97 |
} |
| 98 |
} |
| 99 |
|
