defender-security / src / model / setting / class-security-headers.php

class-security-headers.php in Defender Security – Malware Scanner, Login Security & Firewall 6.2.3, at src/model/setting/class-security-headers.php

364 lines 9.2 KB

Raw Download Zip

1	<?php
2	/**
3	* Handle security headers settings.
4	*
5	* @package WP_Defender\Model\Setting
6	*/
7
8	namespace WP_Defender\Model\Setting;
9
10	use Calotes\Model\Setting;
11	use WP_Defender\Component\Security_Headers\Sh_X_Frame;
12	use WP_Defender\Component\Security_Headers\Sh_Feature_Policy;
13	use WP_Defender\Component\Security_Headers\Sh_XSS_Protection;
14	use WP_Defender\Component\Security_Headers\Sh_Referrer_Policy;
15	use WP_Defender\Component\Security_Headers\Sh_Strict_Transport;
16	use WP_Defender\Component\Security_Headers\Sh_Content_Type_Options;
17
18	/**
19	* Model for security headers settings.
20	*/
21	class Security_Headers extends Setting {
22
23	/**
24	* Option name.
25	*
26	* @var string
27	*/
28	protected $table = 'wd_security_headers_settings';
29
30	/**
31	* Is X-Frame-Options activated.
32	*
33	* @var bool
34	* @defender_property
35	*/
36	public $sh_xframe = false;
37	/**
38	* X-Frame-Options value.
39	*
40	* @var string
41	* @defender_property
42	*/
43	public $sh_xframe_mode = 'sameorigin';
44	/**
45	* Is XSS Protection activated.
46	*
47	* @var bool
48	* @defender_property
49	*/
50	public $sh_xss_protection = false;
51	/**
52	* XSS Protection value.
53	*
54	* @var string
55	* @defender_property
56	*/
57	public $sh_xss_protection_mode = 'sanitize';
58	/**
59	* Is Content-Type Options activated.
60	*
61	* @var bool
62	* @defender_property
63	*/
64	public $sh_content_type_options = false;
65	/**
66	* Content-Type Options value.
67	*
68	* @var string
69	* @defender_property
70	*/
71	public $sh_content_type_options_mode = 'nosniff';
72	/**
73	* Is Strict Transport Security activated.
74	*
75	* @var bool
76	* @defender_property
77	*/
78	public $sh_strict_transport = false;
79	/**
80	* Should preload HSTS?
81	*
82	* @var int
83	* @defender_property
84	*/
85	public $hsts_preload = 0;
86	/**
87	* Should include subdomains?
88	*
89	* @var int
90	* @defender_property
91	*/
92	public $include_subdomain = 0;
93	/**
94	* HSTS cache duration.
95	*
96	* @var string
97	* @defender_property
98	*/
99	public $hsts_cache_duration = '30 days';
100	/**
101	* Is Referrer Policy activated.
102	*
103	* @var bool
104	* @defender_property
105	*/
106	public $sh_referrer_policy = false;
107	/**
108	* Referrer Policy value.
109	*
110	* @var string
111	* @defender_property
112	*/
113	public $sh_referrer_policy_mode = 'origin-when-cross-origin';
114	/**
115	* Is Feature Policy activated.
116	*
117	* @var bool
118	* @defender_property
119	*/
120	public $sh_feature_policy = false;
121	/**
122	* Feature Policy value.
123	*
124	* @var string
125	* @defender_property
126	*/
127	public $sh_feature_policy_mode = 'self';
128	/**
129	* Feature Policy URLs.
130	*
131	* @var string
132	* @defender_property
133	* @sanitize sanitize_textarea_field
134	*/
135	public $sh_feature_policy_urls = '';
136	/**
137	* Contains all the data generated by rules
138	*
139	* @var array
140	*/
141	public $data = array();
142
143	/**
144	* Define settings labels.
145	*
146	* @return array
147	*/
148	public function labels(): array {
149	return array(
150	'sh_xframe' => esc_html__( 'Enable X-Frame-Options', 'defender-security' ),
151	'sh_xframe_mode' => esc_html__( 'X-Frame-Options mode', 'defender-security' ),
152	'sh_xss_protection' => esc_html__( 'Enable X-XSS-Protection', 'defender-security' ),
153	'sh_xss_protection_mode' => esc_html__( 'X-XSS-Protection mode', 'defender-security' ),
154	'sh_content_type_options' => esc_html__( 'Enable X-Content-Type-Options', 'defender-security' ),
155	'sh_content_type_options_mode' => esc_html__( 'X-Content-Type-Options mode', 'defender-security' ),
156	'sh_strict_transport' => esc_html__( 'Enable Strict Transport', 'defender-security' ),
157	'hsts_preload' => esc_html__( 'HSTS Preload', 'defender-security' ),
158	'include_subdomain' => esc_html__( 'Include Subdomains', 'defender-security' ),
159	'hsts_cache_duration' => esc_html__( 'Browser caching', 'defender-security' ),
160	'sh_referrer_policy' => esc_html__( 'Enable Referrer Policy', 'defender-security' ),
161	'sh_referrer_policy_mode' => esc_html__( 'Referrer Information', 'defender-security' ),
162	'sh_feature_policy' => esc_html__( 'Enable Permissions-Policy', 'defender-security' ),
163	'sh_feature_policy_mode' => esc_html__( 'Permissions-Policy mode', 'defender-security' ),
164	'sh_feature_policy_urls' => esc_html__( 'Specific Origins', 'defender-security' ),
165	);
166	}
167
168	/**
169	* Get headers.
170	*
171	* @return array
172	*/
173	public function get_headers(): array {
174	return array(
175	Sh_X_Frame::$rule_slug => new Sh_X_Frame(),
176	Sh_XSS_Protection::$rule_slug => new Sh_XSS_Protection(),
177	Sh_Content_Type_Options::$rule_slug => new Sh_Content_Type_Options(),
178	Sh_Strict_Transport::$rule_slug => new Sh_Strict_Transport(),
179	Sh_Referrer_Policy::$rule_slug => new Sh_Referrer_Policy(),
180	Sh_Feature_Policy::$rule_slug => new Sh_Feature_Policy(),
181	);
182	}
183
184	/**
185	* Filter the security headers and return data as array.
186	*
187	* @param bool $sort Should headers be sorted.
188	*
189	* @return array
190	*/
191	public function get_headers_as_array( $sort = false ): array {
192	$headers = $this->get_headers();
193	$data = array();
194	foreach ( $headers as $header ) {
195	$data[ $header::$rule_slug ] = array(
196	'slug' => $header::$rule_slug,
197	'title' => $header->get_title(),
198	'diff' => $header->get_misc_data(),
199	);
200	}
201
202	if ( $sort ) {
203	ksort( $data );
204	}
205
206	return $data;
207	}
208
209	/**
210	* Get data values
211	*
212	* @param mixed $key The key to retrieve the value for.
213	*
214	* @return mixed\|null The value associated with the given key, or null if the key does not exist.
215	*/
216	public function get_data_values( $key ) {
217	if ( is_array( $this->data ) && isset( $this->data[ $key ] ) ) {
218	return $this->data[ $key ];
219	}
220
221	return null;
222	}
223
224	/**
225	* Set the value of a data key.
226	*
227	* @param mixed $key The key to set the value for.
228	* @param mixed $value The value to set. If null, the key will be unset.
229	*
230	* @return void
231	*/
232	public function set_data_values( $key, $value ) {
233	if ( null === $value ) {
234	unset( $this->data[ $key ] );
235	} elseif ( is_array( $this->data ) ) {
236	$this->data[ $key ] = $value;
237	}
238	$this->save();
239	}
240
241	/**
242	* Validates the security headers settings.
243	*
244	* @return void
245	*/
246	protected function after_validate(): void {
247	if ( true === $this->sh_xframe && ! in_array( $this->sh_xframe_mode, array( 'sameorigin', 'deny' ), true ) ) {
248	$this->errors[] = esc_html__( 'X-Frame-Options mode is invalid', 'defender-security' );
249	} elseif ( true === $this->sh_xss_protection && ! in_array( $this->sh_xss_protection_mode, array( 'sanitize', 'block', 'none' ), true ) ) {
250	$this->errors[] = esc_html__( 'X-XSS-Protection mode is invalid', 'defender-security' );
251	} elseif ( true === $this->sh_referrer_policy
252	&& ! in_array(
253	$this->sh_referrer_policy_mode,
254	array(
255	'no-referrer',
256	'no-referrer-when-downgrade',
257	'origin',
258	'origin-when-cross-origin',
259	'same-origin',
260	'strict-origin',
261	'strict-origin-when-cross-origin',
262	'unsafe-url',
263	),
264	true
265	)
266	) {
267	$this->errors[] = esc_html__( 'Referrer Policy mode is invalid', 'defender-security' );
268	}
269	}
270
271	/**
272	* Refresh headers.
273	*
274	* @return array
275	*/
276	public function refresh_headers(): array {
277	$defined_headers = $this->get_headers();
278	$enabled = array();
279	foreach ( $defined_headers as $header ) {
280	if ( true === $header->check() ) {
281	$enabled[] = array( 'title' => $header->get_title() );
282	}
283	}
284
285	return $enabled;
286	}
287
288	/**
289	* Get active, inactive or both types of headers.
290	*
291	* @param string $type Can be active\|inactive\|both. Default 'both'.
292	*
293	* @return array
294	*/
295	public function get_headers_by_type( string $type = 'both' ): array {
296	$headers = array(
297	'active' => array(),
298	'inactive' => array(),
299	);
300	if ( ! in_array( $type, array( 'active', 'inactive', 'both' ), true ) ) {
301	return $headers;
302	}
303
304	$url = network_admin_url( 'admin.php?page=wdf-advanced-tools&view=security-headers#' );
305	foreach ( $this->get_headers() as $header ) {
306	$key = true === $header->check() ? 'active' : 'inactive';
307	$headers[ $key ][] = array(
308	'title' => $header->get_title(),
309	'url' => $url . $header::$rule_slug,
310	);
311	}
312
313	return 'both' === $type ? $headers : $headers[ $type ];
314	}
315
316	/**
317	* Check if any of the security headers are activated.
318	*
319	* @return bool Returns true if any of the security headers are activated, false otherwise.
320	*/
321	public function is_any_activated(): bool {
322	if (
323	true === $this->sh_xframe
324	\|\| true === $this->sh_xss_protection
325	\|\| true === $this->sh_content_type_options
326	\|\| true === $this->sh_feature_policy
327	\|\| true === $this->sh_strict_transport
328	\|\| true === $this->sh_referrer_policy
329	) {
330	return true;
331	}
332
333	return false;
334	}
335
336	/**
337	* Get enabled headers.
338	*
339	* @param int $total How many headers to return.
340	*
341	* @return array
342	*/
343	public function get_enabled_headers( int $total = 3 ): array {
344	$defined_headers = $this->get_headers();
345	$enabled = array();
346	foreach ( $defined_headers as $header ) {
347	if ( true === $header->check() ) {
348	$enabled[ $header::$rule_slug ] = array( 'title' => $header->get_title() );
349	}
350	}
351
352	return array_slice( $enabled, 0, $total );
353	}
354
355	/**
356	* Get module name.
357	*
358	* @return string
359	*/
360	public static function get_module_name(): string {
361	return esc_html__( 'Security Policy', 'defender-security' );
362	}
363	}
364