defender-security / src / model / setting / class-security-headers.php

class-security-headers.php in Defender Security – Malware Scanner, Login Security & Firewall 5.3.1, at src/model/setting/class-security-headers.php

372 lines 9.4 KB

Raw Download Zip

1	<?php
2	/**
3	* Handle security headers settings.
4	*
5	* @package WP_Defender\Model\Setting
6	*/
7
8	namespace WP_Defender\Model\Setting;
9
10	use Calotes\Model\Setting;
11	use WP_Defender\Component\Security_Headers\Sh_X_Frame;
12	use WP_Defender\Component\Security_Headers\Sh_Feature_Policy;
13	use WP_Defender\Component\Security_Headers\Sh_XSS_Protection;
14	use WP_Defender\Component\Security_Headers\Sh_Referrer_Policy;
15	use WP_Defender\Component\Security_Headers\Sh_Strict_Transport;
16	use WP_Defender\Component\Security_Headers\Sh_Content_Type_Options;
17
18	/**
19	* Model for security headers settings.
20	*/
21	class Security_Headers extends Setting {
22
23	/**
24	* Option name.
25	*
26	* @var string
27	*/
28	protected $table = 'wd_security_headers_settings';
29
30	/**
31	* Is X-Frame-Options activated.
32	*
33	* @var bool
34	* @defender_property
35	*/
36	public $sh_xframe = false;
37	/**
38	* X-Frame-Options value.
39	*
40	* @var string
41	* @defender_property
42	*/
43	public $sh_xframe_mode = 'sameorigin';
44	/**
45	* Is XSS Protection activated.
46	*
47	* @var bool
48	* @defender_property
49	*/
50	public $sh_xss_protection = false;
51	/**
52	* XSS Protection value.
53	*
54	* @var string
55	* @defender_property
56	*/
57	public $sh_xss_protection_mode = 'sanitize';
58	/**
59	* Is Content-Type Options activated.
60	*
61	* @var bool
62	* @defender_property
63	*/
64	public $sh_content_type_options = false;
65	/**
66	* Content-Type Options value.
67	*
68	* @var string
69	* @defender_property
70	*/
71	public $sh_content_type_options_mode = 'nosniff';
72	/**
73	* Is Strict Transport Security activated.
74	*
75	* @var bool
76	* @defender_property
77	*/
78	public $sh_strict_transport = false;
79	/**
80	* Should preload HSTS?
81	*
82	* @var int
83	* @defender_property
84	*/
85	public $hsts_preload = 0;
86	/**
87	* Should include subdomains?
88	*
89	* @var int
90	* @defender_property
91	*/
92	public $include_subdomain = 0;
93	/**
94	* HSTS cache duration.
95	*
96	* @var string
97	* @defender_property
98	*/
99	public $hsts_cache_duration = '30 days';
100	/**
101	* Is Referrer Policy activated.
102	*
103	* @var bool
104	* @defender_property
105	*/
106	public $sh_referrer_policy = false;
107	/**
108	* Referrer Policy value.
109	*
110	* @var string
111	* @defender_property
112	*/
113	public $sh_referrer_policy_mode = 'origin-when-cross-origin';
114	/**
115	* Is Feature Policy activated.
116	*
117	* @var bool
118	* @defender_property
119	*/
120	public $sh_feature_policy = false;
121	/**
122	* Feature Policy value.
123	*
124	* @var string
125	* @defender_property
126	*/
127	public $sh_feature_policy_mode = 'self';
128	/**
129	* Feature Policy URLs.
130	*
131	* @var string
132	* @defender_property
133	* @sanitize sanitize_textarea_field
134	*/
135	public $sh_feature_policy_urls = '';
136	/**
137	* Contains all the data generated by rules
138	*
139	* @var array
140	*/
141	public $data = array();
142
143	/**
144	* Define settings labels.
145	*
146	* @return array
147	*/
148	public function labels(): array {
149	return array(
150	'sh_xframe' => esc_html__( 'Enable X-Frame-Options', 'defender-security' ),
151	'sh_xframe_mode' => esc_html__( 'X-Frame-Options mode', 'defender-security' ),
152	'sh_xss_protection' => esc_html__( 'Enable X-XSS-Protection', 'defender-security' ),
153	'sh_xss_protection_mode' => esc_html__( 'X-XSS-Protection mode', 'defender-security' ),
154	'sh_content_type_options' => esc_html__( 'Enable X-Content-Type-Options', 'defender-security' ),
155	'sh_content_type_options_mode' => esc_html__( 'X-Content-Type-Options mode', 'defender-security' ),
156	'sh_strict_transport' => esc_html__( 'Enable Strict Transport', 'defender-security' ),
157	'hsts_preload' => esc_html__( 'HSTS Preload', 'defender-security' ),
158	'include_subdomain' => esc_html__( 'Include Subdomains', 'defender-security' ),
159	'hsts_cache_duration' => esc_html__( 'Browser caching', 'defender-security' ),
160	'sh_referrer_policy' => esc_html__( 'Enable Referrer Policy', 'defender-security' ),
161	'sh_referrer_policy_mode' => esc_html__( 'Referrer Information', 'defender-security' ),
162	'sh_feature_policy' => esc_html__( 'Enable Permissions-Policy', 'defender-security' ),
163	'sh_feature_policy_mode' => esc_html__( 'Permissions-Policy mode', 'defender-security' ),
164	'sh_feature_policy_urls' => esc_html__( 'Specific Origins', 'defender-security' ),
165	);
166	}
167
168	/**
169	* Get headers.
170	*
171	* @return array
172	*/
173	public function get_headers(): array {
174	return array(
175	Sh_X_Frame::$rule_slug => new Sh_X_Frame(),
176	Sh_XSS_Protection::$rule_slug => new Sh_XSS_Protection(),
177	Sh_Content_Type_Options::$rule_slug => new Sh_Content_Type_Options(),
178	Sh_Strict_Transport::$rule_slug => new Sh_Strict_Transport(),
179	Sh_Referrer_Policy::$rule_slug => new Sh_Referrer_Policy(),
180	Sh_Feature_Policy::$rule_slug => new Sh_Feature_Policy(),
181	);
182	}
183
184	/**
185	* Filter the security headers and return data as array.
186	*
187	* @param bool $sort Should headers be sorted.
188	*
189	* @return array
190	*/
191	public function get_headers_as_array( $sort = false ): array {
192	$headers = $this->get_headers();
193	$data = array();
194	foreach ( $headers as $header ) {
195	$data[ $header::$rule_slug ] = array(
196	'slug' => $header::$rule_slug,
197	'title' => $header->get_title(),
198	'diff' => $header->get_misc_data(),
199	);
200	}
201
202	if ( $sort ) {
203	ksort( $data );
204	}
205
206	return $data;
207	}
208
209	/**
210	* Get data values
211	*
212	* @param mixed $key The key to retrieve the value for.
213	*
214	* @return mixed\|null The value associated with the given key, or null if the key does not exist.
215	*/
216	public function get_data_values( $key ) {
217	if ( is_array( $this->data ) && isset( $this->data[ $key ] ) ) {
218	return $this->data[ $key ];
219	}
220
221	return null;
222	}
223
224	/**
225	* Set the value of a data key.
226	*
227	* @param mixed $key The key to set the value for.
228	* @param mixed $value The value to set. If null, the key will be unset.
229	*
230	* @return void
231	*/
232	public function set_data_values( $key, $value ) {
233	if ( null === $value ) {
234	unset( $this->data[ $key ] );
235	} elseif ( is_array( $this->data ) ) {
236	$this->data[ $key ] = $value;
237	}
238	$this->save();
239	}
240
241	/**
242	* Validates the security headers settings.
243	*
244	* @return void
245	*/
246	protected function after_validate(): void {
247	if ( true === $this->sh_xframe
248	&& ( empty( $this->sh_xframe_mode )
249	\|\| ! in_array( $this->sh_xframe_mode, array( 'sameorigin', 'deny' ), true ) )
250	) {
251	$this->errors[] = esc_html__( 'X-Frame-Options mode is invalid', 'defender-security' );
252	} elseif ( true === $this->sh_xss_protection
253	&& ( empty( $this->sh_xss_protection_mode )
254	\|\| ! in_array( $this->sh_xss_protection_mode, array( 'sanitize', 'block', 'none' ), true ) )
255	) {
256	$this->errors[] = esc_html__( 'X-XSS-Protection mode is invalid', 'defender-security' );
257	} elseif ( true === $this->sh_referrer_policy
258	&& ( empty( $this->sh_referrer_policy_mode )
259	\|\| ! in_array(
260	$this->sh_referrer_policy_mode,
261	array(
262	'no-referrer',
263	'no-referrer-when-downgrade',
264	'origin',
265	'origin-when-cross-origin',
266	'same-origin',
267	'strict-origin',
268	'strict-origin-when-cross-origin',
269	'unsafe-url',
270	),
271	true
272	)
273	)
274	) {
275	$this->errors[] = esc_html__( 'Referrer Policy mode is invalid', 'defender-security' );
276	}
277	}
278
279	/**
280	* Refresh headers.
281	*
282	* @return array
283	*/
284	public function refresh_headers(): array {
285	$defined_headers = $this->get_headers();
286	$enabled = array();
287	foreach ( $defined_headers as $header ) {
288	if ( true === $header->check() ) {
289	$enabled[] = array( 'title' => $header->get_title() );
290	}
291	}
292
293	return $enabled;
294	}
295
296	/**
297	* Get active, inactive or both types of headers.
298	*
299	* @param string $type Can be active\|inactive\|both. Default 'both'.
300	*
301	* @return array
302	*/
303	public function get_headers_by_type( string $type = 'both' ): array {
304	$headers = array(
305	'active' => array(),
306	'inactive' => array(),
307	);
308	if ( ! in_array( $type, array( 'active', 'inactive', 'both' ), true ) ) {
309	return $headers;
310	}
311
312	$url = network_admin_url( 'admin.php?page=wdf-advanced-tools&view=security-headers#' );
313	foreach ( $this->get_headers() as $header ) {
314	$key = true === $header->check() ? 'active' : 'inactive';
315	$headers[ $key ][] = array(
316	'title' => $header->get_title(),
317	'url' => $url . $header::$rule_slug,
318	);
319	}
320
321	return 'both' === $type ? $headers : $headers[ $type ];
322	}
323
324	/**
325	* Check if any of the security headers are activated.
326	*
327	* @return bool Returns true if any of the security headers are activated, false otherwise.
328	*/
329	public function is_any_activated(): bool {
330	if (
331	true === $this->sh_xframe
332	\|\| true === $this->sh_xss_protection
333	\|\| true === $this->sh_content_type_options
334	\|\| true === $this->sh_feature_policy
335	\|\| true === $this->sh_strict_transport
336	\|\| true === $this->sh_referrer_policy
337	) {
338	return true;
339	}
340
341	return false;
342	}
343
344	/**
345	* Get enabled headers.
346	*
347	* @param int $total How many headers to return.
348	*
349	* @return array
350	*/
351	public function get_enabled_headers( int $total = 3 ): array {
352	$defined_headers = $this->get_headers();
353	$enabled = array();
354	foreach ( $defined_headers as $header ) {
355	if ( true === $header->check() ) {
356	$enabled[ $header::$rule_slug ] = array( 'title' => $header->get_title() );
357	}
358	}
359
360	return array_slice( $enabled, 0, $total );
361	}
362
363	/**
364	* Get module name.
365	*
366	* @return string
367	*/
368	public static function get_module_name(): string {
369	return esc_html__( 'Security Headers', 'defender-security' );
370	}
371	}
372