defender-security / src / component / security-headers / class-sh-xss-protection.php

class-sh-xss-protection.php in Defender Security – Malware Scanner, Login Security & Firewall 5.8.1, at src/component/security-headers/class-sh-xss-protection.php

136 lines 3.3 KB

Raw Download Zip

1	<?php
2	/**
3	* Handles the implementation of the X-XSS-Protection header for security purposes.
4	*
5	* @package WP_Defender\Component\Security_Headers
6	*/
7
8	namespace WP_Defender\Component\Security_Headers;
9
10	use WP_Defender\Component\Security_Header;
11
12	/**
13	* Manages the X-XSS-Protection header which controls browser features.
14	*/
15	class Sh_XSS_Protection extends Security_Header {
16
17	/**
18	* Unique identifier for this security header rule.
19	*
20	* @var string
21	*/
22	public static $rule_slug = 'sh_xss_protection';
23
24	/**
25	* Checks if the Policy should be applied based on the current settings and site configuration.
26	*
27	* @return bool True if the header should be applied, false otherwise.
28	*/
29	public function check() {
30	$model = $this->get_model();
31
32	if ( ! $model->sh_xss_protection ) {
33	return false;
34	}
35	if ( isset( $model->sh_xss_protection_mode ) && '' !== $model->sh_xss_protection_mode ) {
36	return true;
37	}
38	$headers = $this->head_request( network_site_url(), self::$rule_slug );
39	if ( is_wp_error( $headers ) ) {
40	$this->log( sprintf( 'Self ping error: %s', $headers->get_error_message() ), wd_internal_log() );
41
42	return false;
43	}
44
45	if ( isset( $headers['x-xss-protection'] ) ) {
46	$header_xss_protection = is_array( $headers['x-xss-protection'] )
47	? $headers['x-xss-protection'][0]
48	: $headers['x-xss-protection'];
49	$content = strtolower( trim( $header_xss_protection ) );
50	$content = explode( ';', $content );
51	if ( 1 === count( $content ) ) {
52	$model->sh_xss_protection_mode = 'sanitize';
53	} else {
54	$content = explode( '=', $content[1] );
55	$model->sh_xss_protection_mode = $content[1];
56	}
57	$model->save();
58
59	return true;
60	}
61
62	return false;
63	}
64
65	/**
66	* Retrieves miscellaneous data related to the Policy.
67	*
68	* @return array Contains introductory text, mode, and values for the Policy.
69	*/
70	public function get_misc_data() {
71	$model = $this->get_model();
72
73	return array(
74	'intro_text' => esc_html__(
75	'The HTTP X-XSS-Protection response header that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks on Chrome, IE and Safari.',
76	'defender-security'
77	),
78	'mode' => $model->sh_xss_protection_mode ?? 'sanitize',
79	);
80	}
81
82	/**
83	* Registers hooks related to sending headers.
84	*/
85	public function add_hooks() {
86	add_action( 'send_headers', array( $this, 'append_header' ) );
87	}
88
89	/**
90	* Appends the header to the response.
91	*/
92	public function append_header() {
93	if ( headers_sent() ) {
94	return;
95	}
96	$model = $this->get_model();
97	if ( ! $this->maybe_submit_header( 'X-XSS-Protection', false ) ) {
98
99	return;
100	}
101	if ( true === $model->sh_xss_protection && in_array(
102	$model->sh_xss_protection_mode,
103	array(
104	'sanitize',
105	'block',
106	'none',
107	),
108	true
109	) ) {
110	$headers = '';
111	switch ( $model->sh_xss_protection_mode ) {
112	case 'sanitize':
113	$headers = 'X-XSS-Protection: 1';
114	break;
115	case 'block':
116	$headers = 'X-XSS-Protection: 1; mode=block';
117	break;
118	default:
119	break;
120	}
121	if ( strlen( $headers ) > 0 ) {
122	header( trim( $headers ) );
123	}
124	}
125	}
126
127	/**
128	* Retrieves the title of the Policy.
129	*
130	* @return string The title of the Policy.
131	*/
132	public function get_title() {
133	return esc_html__( 'X-XSS-Protection', 'defender-security' );
134	}
135	}
136