← All changes | src/controller/class-malicious-bot.php +57 -7 6.2.4 → 6.3.0 View file →

		@@ -26,9 +26,9 @@
26	26	* Service for handling logic.
27	27	*
28	28	* @var Malicious_Bot_Component
29	29	*/
30		- protected $service;
	30	+ public $service;
31	31
32	32	/**
33	33	* Constructor for the Malicious_Bot class.
34	34	* Initializes the service and sets up necessary hooks.
		@@ -108,8 +108,12 @@
108	108	$used_hash = get_query_var( Malicious_Bot_Component::URL_QUERY );
109	109	$valid_hash = $this->service->get_hash();
110	110
111	111	if ( $used_hash === $valid_hash ) {
	112	+ if ( $this->is_cross_site_request() ) {
	113	+ return;
	114	+ }
	115	+
112	116	$known_bots = Known_Bots_Factory::create();
113	117	$bot_ips = $known_bots->get_all_bot_ips();
114	118
115	119	// Flatten 2D array into a single array.
		@@ -165,8 +169,55 @@
165	169	}
166	170	}
167	171
168	172	/**
	173	+ * Checks if the current request is a cross-site or embedded request.
	174	+ *
	175	+ * @return bool True if cross-site or embedded, false otherwise.
	176	+ */
	177	+ public function is_cross_site_request(): bool {
	178	+ $sec_fetch_site = defender_get_data_from_request( 'HTTP_SEC_FETCH_SITE', 's' );
	179	+ if ( is_string( $sec_fetch_site ) && 'cross-site' === strtolower( $sec_fetch_site ) ) {
	180	+ return true;
	181	+ }
	182	+
	183	+ $sec_fetch_dest = defender_get_data_from_request( 'HTTP_SEC_FETCH_DEST', 's' );
	184	+ if ( is_string( $sec_fetch_dest ) && in_array( strtolower( $sec_fetch_dest ), array( 'image', 'iframe', 'frame', 'embed', 'object', 'audio', 'video', 'track', 'style', 'script', 'font' ), true ) ) {
	185	+ return true;
	186	+ }
	187	+
	188	+ $sec_fetch_mode = defender_get_data_from_request( 'HTTP_SEC_FETCH_MODE', 's' );
	189	+ if ( is_string( $sec_fetch_mode ) && 'no-cors' === strtolower( $sec_fetch_mode ) ) {
	190	+ return true;
	191	+ }
	192	+
	193	+ $site_host = wp_parse_url( home_url(), PHP_URL_HOST );
	194	+ $site_host = is_string( $site_host ) ? strtolower( $site_host ) : '';
	195	+
	196	+ $http_host = defender_get_data_from_request( 'HTTP_HOST', 's' );
	197	+ if ( is_string( $http_host ) && '' !== $http_host ) {
	198	+ $http_host = strtolower( explode( ':', $http_host )[0] );
	199	+ } else {
	200	+ $http_host = '';
	201	+ }
	202	+
	203	+ foreach ( array( 'HTTP_REFERER', 'HTTP_ORIGIN' ) as $header ) {
	204	+ $header_val = defender_get_data_from_request( $header, 's' );
	205	+ if ( is_string( $header_val ) && '' !== $header_val ) {
	206	+ $header_host = wp_parse_url( $header_val, PHP_URL_HOST );
	207	+ if ( is_string( $header_host ) && '' !== $header_host ) {
	208	+ $header_host_lower = strtolower( $header_host );
	209	+ if ( $header_host_lower !== $site_host && ( '' === $http_host || $header_host_lower !== $http_host ) ) {
	210	+ return true;
	211	+ }
	212	+ }
	213	+ }
	214	+ }
	215	+
	216	+ return false;
	217	+ }
	218	+
	219	+ /**
169	220	* Injects the malicious bot URL into the footer of frontend pages.
170	221	* This URL is hidden.
171	222	*/
172	223	public function inject_footer() {
		@@ -188,19 +239,18 @@
188	239	if ( ! is_string( $hash ) || '' === trim( $hash ) ) {
189	240	return false;
190	241	}
191	242
192		- $uri = defender_get_data_from_request( 'REQUEST_URI', 's' );
193		- if ( ! is_string( $uri ) || '' === $uri ) {
	243	+ $uri = defender_get_data_from_request( 'REQUEST_URI', 's' );
	244	+ $path = is_string( $uri ) ? wp_parse_url( $uri, PHP_URL_PATH ) : null;
	245	+ if ( ! is_string( $path ) || '' === $path ) {
194	246	return false;
195	247	}
196	248
197		- // Get request path.
198		- $uri = wp_parse_url( $uri, PHP_URL_PATH );
199		- $uri = trim( $uri, '/' );
	249	+ $path = trim( $path, '/' );
200	250
201	251	// Always check last segment only.
202		- $segments = explode( '/', $uri );
	252	+ $segments = explode( '/', $path );
203	253	$last = end( $segments );
204	254
205	255	return $last === $hash;
206	256	}