<?php

/**
 * Code related to the sitecheck.lib.php interface.
 *
 * PHP version 5
 *
 * @category   Library
 * @package    Sucuri
 * @subpackage SucuriScanner
 * @author     Daniel Cid <[email protected]>
 * @copyright  2010-2018 Sucuri Inc.
 * @license    https://www.gnu.org/licenses/gpl-2.0.txt GPL2
 * @link       https://wordpress.org/plugins/sucuri-scanner
 */

if (!defined('SUCURISCAN_INIT') || SUCURISCAN_INIT !== true) {
    if (!headers_sent()) {
        /* Report invalid access if possible. */
        header('HTTP/1.1 403 Forbidden');
    }
    exit(1);
}

/**
 * Controls the execution of the SiteCheck scanner.
 *
 * SiteCheck is a web application scanner that reads the source code of a
 * website to determine if it is serving malicious code, it scans the home page
 * and linked sub-pages, then compares the results with a list of signatures as
 * well as a list of blocklist services to see if other malware scanners have
 * flagged the website before. This operation may take a couple of seconds,
 * around twenty seconds in most cases; be sure to set enough timeout for the
 * operation to finish, otherwise the scanner will return innacurate
 * information.
 *
 * @category   Library
 * @package    Sucuri
 * @subpackage SucuriScanner
 * @author     Daniel Cid <[email protected]>
 * @copyright  2010-2018 Sucuri Inc.
 * @license    https://www.gnu.org/licenses/gpl-2.0.txt GPL2
 * @link       https://wordpress.org/plugins/sucuri-scanner
 * @see        https://sitecheck.sucuri.net/
 */
class SucuriScanSiteCheck extends SucuriScanAPI
{
    /**
     * Returns the URL that will be scanned by SiteCheck.
     *
     * @return string URL to be scanned.
     */
    private static function targetURL()
    {
        /* allow to set a custom URL for the scans */
        $custom = SucuriScanOption::getOption(':sitecheck_target');

        if ($custom) {
            return $custom;
        }

        return SucuriScan::getDomain();
    }

    /**
     * Executes a malware scan against the specified website.
     *
     * @see https://sitecheck.sucuri.net/
     *
     * @param  bool $clear Request the results from a fresh scan or not.
     * @return array|bool  JSON encoded website scan results.
     */
    public static function runMalwareScan($clear = false)
    {
        $params = array();
        $params['json'] = 1;
        $params['fromwp'] = 2;
        $params['scan'] = self::targetURL();

        /* force clear scan */
        if ($clear === true) {
            $params['clear'] = 1;
        }

        $args = array('assoc' => true, 'timeout' => 60);

        return self::apiCall('https://sitecheck.sucuri.net/', 'GET', $params, $args);
    }

    /**
     * Scans a website for malware using SiteCheck.
     *
     * This method will first check if the scan results have been cached by a
     * previous scan. The lifetime of the cache is defined in the global script
     * but usually it should not be higher than fifteen minutes. If the cache
     * exists it will be used to display the information in the dashboard.
     *
     * If the cache does not exists or has already expired, it will send a HTTP
     * request to the SiteCheck API service to execute a fresh scan, this takes
     * around twenty seconds, it will decode and process the response and render
     * the results in the dashboard.
     *
     * If the user sends a GET parameter named "s" with a valid domain name, it
     * will be used instead of the one of the current website. This is useful if
     * you want to test the functionality of the scanner in a different website
     * without access to its domain, which is basically the same thing that you
     * can do in the official SiteCheck website. This parameter also bypasses
     * the cache.
     *
     * @return array|bool SiteCheck scan results.
     */
    public static function scanAndCollectData()
    {
        $cache = new SucuriScanCache('sitecheck');

        if (SucuriScanRequest::post(':sitecheck_refresh') === 'true') {
            /* user requested to reset the sitecheck cache */
            $cache->delete('scan_results');
        }

        $results = $cache->get('scan_results', SUCURISCAN_SITECHECK_LIFETIME, 'array');

        /* return cached malware scan results. */
        if ($results && !empty($results)) {
            return $results;
        }

        /* delete expired cache */
        $cache->delete('scan_results');

        /* send HTTP request to SiteCheck's API service. */
        $results = self::runMalwareScan(true);

        /* check for error in the request's response. */
        if (is_string($results) || isset($results['SYSTEM']['ERROR'])) {
            if (isset($results['SYSTEM']['ERROR'])) {
                $results = implode("\x20", $results['SYSTEM']['ERROR']);
            }

            return SucuriScanInterface::error('SiteCheck error: ' . $results);
        }

        /* cache the results for some time. */
        $cache->add('scan_results', $results);

        return $results;
    }

    /**
     * Returns the amount of time left before the SiteCheck cache expires.
     *
     * @return string Time left before the SiteCheck cache expires.
     */
    private static function cacheLifetime()
    {
        $current = time();
        $cache = new SucuriScanCache('sitecheck');
        $timeDiff = $current - $cache->updatedAt();
        $timeLeft = SUCURISCAN_SITECHECK_LIFETIME - $timeDiff;

        return self::humanTime($current + $timeLeft);
    }

    /**
     * Generates the HTML section for the SiteCheck details.
     *
     * @return string HTML code to render the details section.
     */
    public static function details()
    {
        $params = array();
        $data = self::scanAndCollectData();
        $data['details'] = array();

        $params['SiteCheck.Metadata'] = '';
        $params['SiteCheck.Lifetime'] = self::cacheLifetime();

        $data['details'][] = sprintf(__('PHP Version: %s', 'sucuri-scanner'), phpversion());
        $data['details'][] = sprintf(__('Version: %s', 'sucuri-scanner'), SucuriScan::siteVersion());

        if (isset($data['SCAN']['SITE'])) {
            $params['SiteCheck.Website'] = $data['SCAN']['SITE'][0];
        }

        if (isset($data['SCAN']['IP'])) {
            $params['SiteCheck.ServerAddress'] = $data['SCAN']['IP'][0];
        }

        if (isset($data['SCAN']['HOSTING'])) {
            $data['details'][] = sprintf(__('Hosting: %s', 'sucuri-scanner'), apply_filters( 'sucuriscan_sitecheck_details_hosting', $data['SCAN']['HOSTING'][0] ));
        }

        if (isset($data['SCAN']['CMS'])) {
            $data['details'][] = sprintf(__('CMS: %s', 'sucuri-scanner'), $data['SCAN']['CMS'][0]);
        }

        if (isset($data['SYSTEM']['NOTICE'])) {
            $data['details'] = array_merge(
                $data['details'],
                $data['SYSTEM']['NOTICE']
            );
        }

        if (isset($data['SYSTEM']['INFO'])) {
            $data['details'] = array_merge(
                $data['details'],
                $data['SYSTEM']['INFO']
            );
        }

        if (isset($data['WEBAPP']['VERSION'])) {
            $data['details'] = array_merge(
                $data['details'],
                $data['WEBAPP']['VERSION']
            );
        }

        if (isset($data['WEBAPP']['WARN'])) {
            $data['details'] = array_merge(
                $data['details'],
                $data['WEBAPP']['WARN']
            );
        }

        if (isset($data['OUTDATEDSCAN'])) {
            foreach ($data['OUTDATEDSCAN'] as $outdated) {
                if (isset($outdated[0]) && isset($outdated[2])) {
                    $data['details'][] = $outdated[0] . ':' . $outdated[2];
                }
            }
        }

        foreach ($data['details'] as $text) {
            $parts = explode(':', $text, 2);

            if (count($parts) === 2) {
                /* prefer local version number over SiteCheck's */
                if (strpos($parts[0], 'WordPress version') !== false) {
                    continue;
                }

                /* redundant; we already know the CMS is WordPress */
                if (strpos($parts[0], 'CMS') !== false) {
                    continue;
                }

                $params['SiteCheck.Metadata'] .= SucuriScanTemplate::getSnippet(
                    'sitecheck-details',
                    array(
                        'SiteCheck.Title' => trim($parts[0]),
                        'SiteCheck.Value' => trim($parts[1]),
                    )
                );
            }
        }

        return SucuriScanTemplate::getSection('sitecheck-details', $params);
    }

    /**
     * Generates the HTML section for the SiteCheck malware.
     *
     * @return string HTML code to render the malware section.
     */
    public static function malware()
    {
        $params = array();
        $data = self::scanAndCollectData();

        $params['Malware.Content'] = '';
        $params['Malware.Color'] = 'green';
        $params['Malware.Title'] = __('Site is Clean', 'sucuri-scanner');
        $params['Malware.CleanVisibility'] = 'visible';
        $params['Malware.InfectedVisibility'] = 'hidden';

        if (isset($data['MALWARE']['WARN']) && !empty($data['MALWARE']['WARN'])) {
            $params['Malware.Color'] = 'red';
            $params['Malware.Title'] = __('Site is not Clean', 'sucuri-scanner');
            $params['Malware.CleanVisibility'] = 'hidden';
            $params['Malware.InfectedVisibility'] = 'visible';

            foreach ($data['MALWARE']['WARN'] as $mal) {
                $info = self::malwareDetails($mal);

                if ($info) {
                    $params['Malware.Content'] .= SucuriScanTemplate::getSnippet(
                        'sitecheck-malware',
                        array(
                            'Malware.InfectedURL' => $info['infected_url'],
                            'Malware.MalwareType' => $info['malware_type'],
                            'Malware.MalwareDocs' => $info['malware_docs'],
                            'Malware.AlertMessage' => $info['alert_message'],
                            'Malware.MalwarePayload' => $info['malware_payload'],
                        )
                    );
                }
            }
        }

        return SucuriScanTemplate::getSection('sitecheck-malware', $params);
    }

    /**
     * Generates the HTML section for the SiteCheck blocklist.
     *
     * @return string HTML code to render the blocklist section.
     */
    public static function blocklist()
    {
        $params = array();
        $data = self::scanAndCollectData();

        if (!isset($data['BLACKLIST']) || !is_array($data['BLACKLIST'])) {
            return ''; /* there is not enough information to render */
        }

        $params['Blocklist.Title'] = __('Not blocklisted', 'sucuri-scanner');
        $params['Blocklist.Color'] = 'green';
        $params['Blocklist.Content'] = '';

        foreach ($data['BLACKLIST'] as $type => $proof) {
            foreach ($proof as $info) {
                $url = $info[1];
                $title = @preg_replace(
                    '/Domain (clean|blacklisted) (on|by) (the )?/',
                    '' /* remove unnecessary text from the output */,
                    substr($info[0], 0, strrpos($info[0], ':'))
                );

                $params['Blocklist.Content'] .= SucuriScanTemplate::getSnippet(
                    'sitecheck-blocklist',
                    array(
                        'Blocklist.URL' => $url,
                        'Blocklist.Status' => $type,
                        'Blocklist.Service' => $title,
                    )
                );
            }
        }

        if (isset($data['BLACKLIST']['WARN'])) {
            $params['Blocklist.Title'] = __('In the blocklist', 'sucuri-scanner');
            $params['Blocklist.Color'] = 'red';
        }

        return SucuriScanTemplate::getSection('sitecheck-blocklist', $params);
    }

    /**
     * Generates the HTML section for the SiteCheck recommendations.
     *
     * @return string HTML code to render the recommendations section.
     */
    public static function recommendations()
    {
        $data = self::scanAndCollectData();
  
        if (!isset($data['RECOMMENDATIONS'])) {
            return;
        }

        $params = array();
        $params['Recommendations.Content'] = '';
        $params['Recommendations.Color'] = 'blue';

        foreach ($data['RECOMMENDATIONS'] as $recommendation) {
            if (count($recommendation) < 3) {
                continue;
            }

            $params['Recommendations.Content'] .= SucuriScanTemplate::getSnippet(
                'sitecheck-recommendations',
                array(
                    'Recommendations.Title' => $recommendation[0],
                    'Recommendations.Value' => $recommendation[1],
                    'Recommendations.URL' => $recommendation[2],
                )
            );
        }
        
        return SucuriScanTemplate::getSection('sitecheck-recommendations', $params);
    }

    /**
     * Returns the title for the iFrames section.
     *
     * @return string Title for the iFrames section.
     */
    public static function iFramesTitle()
    {
        $data = self::scanAndCollectData();
        $niframes = isset($data['LINKS']['IFRAME']) && is_array($data['LINKS']['IFRAME'])
            ? count($data['LINKS']['IFRAME'])
            : 0;

        return sprintf(__('iFrames: %d', 'sucuri-scanner'), $niframes);
    }

    /**
     * Returns the title for the links section.
     *
     * @return string Title for the links section.
     */
    public static function linksTitle()
    {
        $data = self::scanAndCollectData();
        $nlinks = isset($data['LINKS']['URL']) && is_array($data['LINKS']['URL'])
            ? count($data['LINKS']['URL'])
            : 0;

        return sprintf(__('Links: %d', 'sucuri-scanner'), $nlinks);
    }

    /**
     * Returns the title for the scripts section.
     *
     * @return string Title for the scripts section.
     */
    public static function scriptsTitle()
    {
        $data = self::scanAndCollectData();
        $total = 0; /* all type of scripts */

        if (isset($data['LINKS']['JSLOCAL'])) {
            $total += count($data['LINKS']['JSLOCAL']);
        }

        if (isset($data['LINKS']['JSEXTERNAL'])) {
            $total += count($data['LINKS']['JSEXTERNAL']);
        }

        return sprintf(__('Scripts: %d', 'sucuri-scanner'), $total);
    }

    /**
     * Returns the content for the iFrames section.
     *
     * @return string Content for the iFrames section.
     */
    public static function iFramesContent()
    {
        $data = self::scanAndCollectData();
        return isset($data['LINKS']['IFRAME']) ? $data['LINKS']['IFRAME'] : array();
    }

    /**
     * Returns the content for the links section.
     *
     * @return string Content for the links section.
     */
    public static function linksContent()
    {
        $data = self::scanAndCollectData();
        return isset($data['LINKS']['URL']) ? $data['LINKS']['URL'] : array();
    }

    /**
     * Returns the content for the scripts section.
     *
     * @return array Content for the scripts section.
     */
    public static function scriptsContent()
    {
        $links = array();
        $data = self::scanAndCollectData();

        if (isset($data['LINKS']['JSLOCAL'])) {
            $links = array_merge($links, $data['LINKS']['JSLOCAL']);
        }

        if (isset($data['LINKS']['JSEXTERNAL'])) {
            $links = array_merge($links, $data['LINKS']['JSEXTERNAL']);
        }

        return $links;
    }

    /**
     * Extract detailed information from a SiteCheck malware payload.
     *
     * @param  array $malware Array with two entries with basic malware information.
     * @return array          Detailed information of the malware found by SiteCheck.
     */
    public static function malwareDetails($malware = array())
    {
        if (count($malware) < 2) {
            return array(/* empty details */);
        }

        $data = array(
            'alert_message' => '',
            'infected_url' => '',
            'malware_type' => '',
            'malware_docs' => '',
            'malware_payload' => '',
        );

        // Extract the information from the alert message.
        $alert_parts = explode(':', $malware[0], 2);

        if (isset($alert_parts[1])) {
            $data['alert_message'] = $alert_parts[0];
            $data['infected_url'] = trim($alert_parts[1]);
        }

        // Extract the information from the malware message.
        $malware_parts = explode("\n", $malware[1], 2);

        if (isset($malware_parts[1])) {
            $pattern = ".\x20Details:\x20";
            if (strpos($malware_parts[0], $pattern) !== false) {
                $offset = strpos($malware_parts[0], $pattern);
                $data['malware_type'] = substr($malware_parts[0], 0, $offset);
                $data['malware_docs'] = substr($malware_parts[0], $offset + 11);
            }

            $data['malware_payload'] = trim($malware_parts[1]);
        }

        return $data;
    }

    /**
     * Returns a JSON-encoded object with the malware scan results.
     *
     * @codeCoverageIgnore - Notice that there is a test case that covers this
     * code, but since the WP-Send-JSON method uses die() to stop any further
     * output it means that XDebug cannot cover the next line, leaving a report
     * with a missing line in the coverage. Since the test case takes care of
     * the functionality of this code we will assume that it is fully covered.
     *
     * @return void
     */
    public static function ajaxMalwareScan()
    {
        if (SucuriScanRequest::post('form_action') !== 'malware_scan') {
            return;
        }

        ob_start();

        $response = array();

        $response['malware'] = SucuriScanSiteCheck::malware();
        $response['blocklist'] = SucuriScanSiteCheck::blocklist();
        $response['recommendations'] = SucuriScanSiteCheck::recommendations();

        $response['iframes'] = array(
            'title' => SucuriScanSiteCheck::iFramesTitle(),
            'content' => SucuriScanSiteCheck::iFramesContent(),
        );
        $response['links'] = array(
            'title' => SucuriScanSiteCheck::linksTitle(),
            'content' => SucuriScanSiteCheck::linksContent(),
        );
        $response['scripts'] = array(
            'title' => SucuriScanSiteCheck::scriptsTitle(),
            'content' => SucuriScanSiteCheck::scriptsContent(),
        );

        $errors = ob_get_clean(); /* capture possible errors */

        if (!empty($errors)) {
            $response['malware'] = '';
            $response['blocklist'] = '';
            $response['recommendations'] = '';
        }

        wp_send_json($response, 200);
    }

    /**
     * Returns the HTML to configure the API SiteCheck service.
     *
     * @return string HTML for the API SiteCheck service option.
     */
    public static function targetURLOption()
    {
        $params = array();

        if (SucuriScanInterface::checkNonce()) {
            $custom = SucuriScanRequest::post(':sitecheck_target');
            if ($custom !== false) {
                SucuriScanOption::updateOption(':sitecheck_target', $custom);
            }
        }

        $params['SiteCheck.Target'] = self::targetURL();

        return SucuriScanTemplate::getSection('sitecheck-target', $params);
    }
}