isValidApiKey($apiKey)) { throw new InvalidArgumentException('Invalid API key format. API key should start with "sk_" and be at least 20 characters.'); } $this->apiKey = $apiKey; $this->config = $options; $this->apiUrl = $options['api_url'] ?? $this->detectApiUrl(); $this->timeout = $options['timeout'] ?? self::DEFAULT_TIMEOUT; $this->debug = $options['debug'] ?? false; $this->cacheDir = $options['cache_dir'] ?? $this->getDefaultCacheDir(); if ($this->cacheDir && !is_dir($this->cacheDir)) { @mkdir($this->cacheDir, 0755, true); } // ==================== AUTO-BADGE SETUP ==================== self::$instance = $this; $showBadge = $this->config['show_badge'] ?? true; // Start output buffering to inject the badge automatically before if ($showBadge && !self::$bufferStarted && php_sapi_name() !== 'cli') { ob_start([$this, 'injectBadgeCallback']); self::$bufferStarted = true; } // ======================================================= $this->log("Kriosa initialized", [ 'version' => self::VERSION, 'api_url' => $this->apiUrl, 'cache_enabled' => $this->cacheDir !== null ]); } // FIX: verified hostname suffix for each bot, used for reverse+forward // DNS confirmation below. This is the standard way Google/Bing/etc. // document verifying their own crawlers — never trust the UA string alone. private const GOOD_BOT_HOST_SUFFIXES = [ 'Googlebot' => ['googlebot.com', 'google.com'], 'Bingbot' => ['search.msn.com'], 'Slurp' => ['crawl.yahoo.net'], 'DuckDuckBot' => ['duckduckgo.com'], 'Baiduspider' => ['baidu.com', 'baidu.jp'], 'YandexBot' => ['yandex.ru', 'yandex.net', 'yandex.com'], 'facebookexternalhit' => ['facebook.com', 'fbsv.net'], 'Applebot' => ['applebot.apple.com'], ]; /** * FIX: the previous isGoodBot() trusted the client-supplied User-Agent * header alone — sending "User-Agent: Googlebot" bypassed protect() * entirely, with no call to the API and no local check. This verifies * the claim with reverse DNS (does the IP resolve to the bot's real * domain?) then forward-confirms (does that hostname resolve back to * the same IP?), exactly like Google/Bing document doing it themselves. * Twitterbot/LinkedInBot/PetalBot have no small, stable published * verification domain, so they're intentionally left off this list — * they now go through normal protect() like any other client. * DNS failure or mismatch = NOT verified, falls through to protect(). */ private function isVerifiedGoodBot(): bool { $userAgent = $_SERVER['HTTP_USER_AGENT'] ?? ''; if ($userAgent === '') return false; $matchedBot = null; foreach (self::GOOD_BOT_HOST_SUFFIXES as $bot => $suffixes) { if (stripos($userAgent, $bot) !== false) { $matchedBot = $bot; break; } } if ($matchedBot === null) return false; $ip = $this->getClientIp(); if (!$this->isValidIp($ip)) return false; $hostname = @gethostbyaddr($ip); if (!$hostname || $hostname === $ip) return false; $hostnameLower = strtolower(rtrim($hostname, '.')); $verifiedSuffix = false; foreach (self::GOOD_BOT_HOST_SUFFIXES[$matchedBot] as $suffix) { if ($hostnameLower === $suffix || substr($hostnameLower, -strlen('.' . $suffix)) === '.' . $suffix) { $verifiedSuffix = true; break; } } if (!$verifiedSuffix) return false; // Forward-confirm: the claimed hostname must resolve back to this IP. $forwardIp = @gethostbyname($hostname); return $forwardIp === $ip; } public function protect(): bool { if ($this->isVerifiedGoodBot()) { error_log("KRIOSA: Allowing verified good bot - " . $_SERVER['HTTP_USER_AGENT']); self::$isProtected = true; // Mark as protected to show badge return true; } $startTime = microtime(true); $requestId = $this->generateRequestId(); $this->log("Security check started", ['request_id' => $requestId]); try { $requestData = $this->buildRequestData($requestId); $cachedResult = $this->getCachedResult($requestData); if ($cachedResult !== null) { $this->log("Cache hit", ['request_id' => $requestId]); self::$isProtected = true; return $cachedResult; } $result = $this->callApi($requestData, $requestId); if ($result['allowed']) { self::$isProtected = true; // Mark as protected to show badge $this->cacheResult($requestData, $result['allowed']); } else { $this->showBlockPage($result); } $processingTime = (microtime(true) - $startTime) * 1000; $this->log("Security check completed", [ 'request_id' => $requestId, 'allowed' => $result['allowed'], 'processing_time_ms' => round($processingTime, 2) ]); return $result['allowed']; } catch (Exception $e) { $this->log("Security check failed", [ 'request_id' => $requestId, 'error' => $e->getMessage() ]); $allowed = !($this->config['fail_closed'] ?? false); if ($allowed) self::$isProtected = true; return $allowed; } } private function showBlockPage(array $result): void { http_response_code(403); header('X-Kriosa-Blocked: true'); $refId = substr(md5(uniqid()), 0, 12); echo << 403 - Access Denied

Access Denied

The server could not process your request.
Please verify your input and try again.

REF: {$refId}

Secure Connection

HTML; exit; } public static function quick(string $apiKey): bool { static $instance = null; if ($instance === null) $instance = new self($apiKey); return $instance->protect(); } public function check(): array { $startTime = microtime(true); $requestId = $this->generateRequestId(); try { $requestData = $this->buildRequestData($requestId); $result = $this->callApi($requestData, $requestId); $result['processing_time_ms'] = round((microtime(true) - $startTime) * 1000, 2); $result['request_id'] = $requestId; $result['kriosa_version'] = self::VERSION; return $result; } catch (Exception $e) { return [ 'allowed' => true, 'error' => $e->getMessage(), 'processing_time_ms' => round((microtime(true) - $startTime) * 1000, 2), 'request_id' => $requestId, 'kriosa_version' => self::VERSION, 'fallback' => true ]; } } private function buildRequestData(string $requestId): array { $server = $_SERVER; $ip = $this->getClientIp(); $userAgent = $server['HTTP_USER_AGENT'] ?? ''; $method = $server['REQUEST_METHOD'] ?? 'GET'; $uri = $server['REQUEST_URI'] ?? '/'; // FIX: Safely check session status to prevent PHP warnings $hasSession = session_status() === PHP_SESSION_ACTIVE; $sessionId = $hasSession ? session_id() : null; $userId = $hasSession ? ($_SESSION['user_id'] ?? $_SESSION['userid'] ?? $_SESSION['uid'] ?? 0) : 0; $username = $hasSession ? ($_SESSION['username'] ?? $_SESSION['user'] ?? $_SESSION['email'] ?? null) : null; $tenantId = $hasSession ? ($_SESSION['tenant_id'] ?? $_SESSION['tenant'] ?? null) : null; $companyId = $hasSession ? ($_SESSION['company_id'] ?? $_SESSION['company'] ?? null) : null; $isAuthenticated = ($userId > 0) || !empty($server['HTTP_AUTHORIZATION']) || !empty($server['HTTP_X_API_KEY']); return [ 'api_key' => $this->apiKey, 'request_id' => $requestId, 'timestamp' => time(), 'source' => 'kriosa_php_sdk_v3', 'ip_address' => $ip, 'user_agent' => $userAgent, 'session_id' => $sessionId, 'session_user_id' => $userId, 'session_username' => $username, 'session_tenant_id' => $tenantId, 'session_company_id' => $companyId, 'method' => $method, 'resource' => $uri, 'path' => $uri, 'query_string' => $server['QUERY_STRING'] ?? '', 'payload' => $this->getPayload(), 'query_params' => $_GET, 'headers' => $this->getRelevantHeaders(), 'is_authenticated' => $isAuthenticated, 'sdk_version' => self::VERSION, 'sdk_language' => 'php', 'php_version' => PHP_VERSION ]; } private function getPayload(): array { $contentType = $_SERVER['CONTENT_TYPE'] ?? ''; if (strpos($contentType, 'application/json') !== false) { $input = file_get_contents('php://input'); if ($input) { $data = json_decode($input, true); if (is_array($data)) return $data; } } return $_POST; } private function getRelevantHeaders(): array { $headers = []; $relevant = [ 'HTTP_REFERER' => 'Referer', 'HTTP_ORIGIN' => 'Origin', 'HTTP_ACCEPT_LANGUAGE' => 'Accept-Language', 'HTTP_ACCEPT_ENCODING' => 'Accept-Encoding', 'HTTP_X_FORWARDED_FOR' => 'X-Forwarded-For', 'HTTP_X_REAL_IP' => 'X-Real-IP', 'HTTP_X_REQUEST_ID' => 'X-Request-Id' ]; foreach ($relevant as $serverKey => $headerName) { if (isset($_SERVER[$serverKey]) && $_SERVER[$serverKey]) $headers[$headerName] = $_SERVER[$serverKey]; } return $headers; } /** * FIX: CF-Connecting-IP / X-Real-IP / X-Forwarded-For are ordinary * client-supplied headers unless something in front of PHP (a real proxy * or CDN) strips whatever the client sent and sets its own. Trusting * them unconditionally let any attacker forge their reported IP, which * undermines anything downstream keyed on ip_address (blocking, * allowlisting, rate limiting, this event log's IP column). * Pass 'trusted_proxies' => ['1.2.3.4', '10.0.0.0/8', ...] in the SDK * options for any reverse proxy/CDN actually in front of this app; with * none configured, only REMOTE_ADDR is trusted, same as having no proxy. */ private function isFromTrustedProxy(): bool { $remoteAddr = $_SERVER['REMOTE_ADDR'] ?? ''; if ($remoteAddr === '') return false; $trusted = $this->config['trusted_proxies'] ?? []; foreach ($trusted as $entry) { if (strpos($entry, '/') !== false) { if ($this->ipInCidr($remoteAddr, $entry)) return true; } elseif ($entry === $remoteAddr) { return true; } } return false; } private function ipInCidr(string $ip, string $cidr): bool { [$subnet, $bits] = array_pad(explode('/', $cidr, 2), 2, null); if ($bits === null || !$this->isValidIp($ip) || !$this->isValidIp($subnet)) return false; if (strpos($ip, ':') !== false || strpos($subnet, ':') !== false) { return false; // IPv6 CIDR matching not supported here; list exact IPv6 addresses instead. } $ipLong = ip2long($ip); $subnetLong = ip2long($subnet); if ($ipLong === false || $subnetLong === false) return false; $mask = -1 << (32 - (int)$bits); return ($ipLong & $mask) === ($subnetLong & $mask); } private function getClientIp(): string { $ip = null; $trustProxyHeaders = $this->isFromTrustedProxy(); if ($trustProxyHeaders && isset($_SERVER['HTTP_CF_CONNECTING_IP'])) $ip = $_SERVER['HTTP_CF_CONNECTING_IP']; elseif ($trustProxyHeaders && isset($_SERVER['HTTP_X_REAL_IP'])) $ip = $_SERVER['HTTP_X_REAL_IP']; elseif ($trustProxyHeaders && isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { $ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']); $ip = trim($ips[0]); } elseif (isset($_SERVER['REMOTE_ADDR']) && !empty($_SERVER['REMOTE_ADDR'])) $ip = $_SERVER['REMOTE_ADDR']; else $ip = '127.0.0.1'; // FIX: validate the format before trusting it — a forwarded header // (even from a trusted proxy) could contain garbage. if (!$this->isValidIp((string)$ip)) { $ip = $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1'; } if ($ip === '::1' || $ip === '0:0:0:0:0:0:0:1') $ip = '127.0.0.1'; if (empty($ip) || $ip === '0.0.0.0') $ip = '127.0.0.1'; return $ip; } private function isValidIp(string $ip): bool { return filter_var($ip, FILTER_VALIDATE_IP) !== false; } private function callApi(array $requestData, string $requestId): array { if (!function_exists('curl_init')) return $this->fallbackResponse('cURL not available'); $ch = curl_init($this->apiUrl); $jsonData = json_encode($requestData); if ($jsonData === false) return $this->fallbackResponse('JSON encoding failed'); $headers = [ 'Content-Type: application/json', 'Accept: application/json', 'User-Agent: Kriosa-PHP-SDK/' . self::VERSION, 'X-Request-ID: ' . $requestId ]; curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_POSTFIELDS => $jsonData, CURLOPT_HTTPHEADER => $headers, CURLOPT_TIMEOUT => $this->timeout, CURLOPT_CONNECTTIMEOUT => 3, CURLOPT_SSL_VERIFYPEER => true, CURLOPT_SSL_VERIFYHOST => 2, CURLOPT_FOLLOWLOCATION => true, CURLOPT_MAXREDIRS => 2 ]); $response = curl_exec($ch); $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); $curlError = curl_error($ch); curl_close($ch); if ($response === false) return $this->fallbackResponse($curlError); if ($httpCode === 403) return ['allowed' => false, 'reason' => 'attack_blocked']; if ($httpCode !== 200) return $this->fallbackResponse("HTTP {$httpCode}"); $result = json_decode($response, true); if (!is_array($result)) return $this->fallbackResponse('Invalid JSON response'); return $result; } private function fallbackResponse(string $reason = ''): array { if ($this->hasLocalAttackPattern()) return ['allowed' => false, 'reason' => 'local_pattern_match']; // FIX: this path (curl unavailable, timeout, non-200, bad JSON) used to // always fail OPEN regardless of config, while protect()'s exception // handler already respected fail_closed. Someone who set // fail_closed => true expecting "block everything if Kriosa can't be // reached" was not getting that on the most common failure paths. if ($this->config['fail_closed'] ?? false) { return ['allowed' => false, 'fallback' => true, 'reason' => $reason ?: 'fail_closed']; } return ['allowed' => true, 'fallback' => true, 'reason' => $reason]; } private function hasLocalAttackPattern(): bool { $rawInput = json_encode($_POST) . ' ' . json_encode($_GET) . ' ' . ($_SERVER['REQUEST_URI'] ?? ''); // FIX: REQUEST_URI is not URL-decoded by PHP, so "; cat /etc/passwd" // sent as ";%20cat%20/etc/passwd" never matched the separator+command // pattern below. Check both the raw and decoded forms. $input = $rawInput . ' ' . urldecode($rawInput); $patterns = [ '/\b(union\s+select|select.*from|insert\s+into|delete\s+from|drop\s+table)\b/i', '/]*>.*<\/script[^>]*>/is', '/javascript\s*:/i', // FIX: old rule was '/;.*(ls|dir|cat|whoami|id|pwd)/i' — no word // boundary and no required argument, so it matched ordinary text // containing ";... validate", "; pwd=x", "; category", etc. // This only fires on a separator immediately followed by a real // command name at a word boundary, with a shell-shaped argument // or as the very end of the string — the same shape used in the // WAF's strict command patterns. '/[;&|]\s*(?:ls|dir|cat|whoami|id|pwd|rm|mv|cp|wget|curl|bash|sh|cmd|powershell)\b(?:\s+(?:-{1,2}[a-z0-9]|[\/~]|\.{1,2}\/)|\s*$)/i', '/\.\.\//', '/\.\.\\\\/', // FIX: '/\$\w+/' matched ANY dollar sign followed by a word // character — "$50", "$price", "$_GET" mentioned in plain text — // which isn't an attack signal at all. Removed; PHP variable // injection into a template is better caught by the specific // command/script patterns above, not by punctuation alone. ]; foreach ($patterns as $pattern) { if (preg_match($pattern, $input)) return true; } return false; } private function getCachedResult(array $requestData): ?bool { if (!$this->cacheDir) return null; $cacheFile = $this->cacheDir . '/' . $this->getCacheKey($requestData) . '.cache'; if (file_exists($cacheFile) && (time() - filemtime($cacheFile)) < self::CACHE_TTL) { $data = @unserialize(@file_get_contents($cacheFile)); if (is_array($data) && isset($data['allowed'])) return $data['allowed']; } return null; } private function cacheResult(array $requestData, bool $allowed): void { if (!$this->cacheDir) return; $cacheFile = $this->cacheDir . '/' . $this->getCacheKey($requestData) . '.cache'; @file_put_contents($cacheFile, serialize(['allowed' => $allowed, 'cached_at' => time()])); $this->maybeGarbageCollectCache(); } /** * FIX: nothing ever deleted a cache file — getCachedResult() only * ignores one once it's past CACHE_TTL, it never removes it. Scoping * the cache key to the full request (above) means a busy site now * creates roughly one file per unique request instead of one per * route, so with zero eviction the directory only ever grows and can * eventually hit disk/inode limits. Runs a cheap sweep on a small * fraction of requests instead of scanning the directory every time. */ private function maybeGarbageCollectCache(): void { if (!$this->cacheDir) return; // ~1 in 200 cache writes triggers a sweep; keeps the average // per-request cost near zero while still bounding growth. try { if (random_int(1, 200) !== 1) return; } catch (Exception $e) { return; } $files = @glob($this->cacheDir . '/kriosa_*.cache'); if (!$files) return; $now = time(); foreach ($files as $file) { $mtime = @filemtime($file); if ($mtime !== false && ($now - $mtime) >= self::CACHE_TTL) { @unlink($file); } } } /** * FIX: the old key was just resource+method, so it ignored payload, * query params, IP, and headers entirely. getCachedResult() is checked * BEFORE calling the API — so the first legitimate allowed request to, * say, POST /login made every other POST /login (any IP, any payload) * auto-allowed for CACHE_TTL. Only "allowed" results are ever cached * (see protect()), but a cache that can't tell requests apart defeats * the point of checking each one. Hashing the full request (minus the * per-request fields that always differ) scopes the cache to requests * that actually look the same. */ private function getCacheKey(array $requestData): string { $cacheable = $requestData; unset($cacheable['request_id'], $cacheable['timestamp'], $cacheable['session_id']); return 'kriosa_' . md5($this->apiKey . '|' . json_encode($cacheable)); } private function isValidApiKey(string $apiKey): bool { return strpos($apiKey, 'sk_') === 0 && strlen($apiKey) >= 20; } private function detectApiUrl(): string { $host = $_SERVER['HTTP_HOST'] ?? ''; if (strpos($host, 'localhost') !== false || strpos($host, '127.0.0.1') !== false) return 'http://localhost/kriosa/api.php/v1/protect'; return 'https://kriosa.com/api.php/v1/protect'; } private function getDefaultCacheDir(): ?string { $tempDir = sys_get_temp_dir() . '/kriosa_cache'; if (is_writable(dirname($tempDir))) return $tempDir; if (is_writable(__DIR__)) return __DIR__ . '/.kriosa_cache'; return null; } private function generateRequestId(): string { return 'req_' . uniqid() . '_' . bin2hex(random_bytes(4)); } private function log(string $message, array $context = []): void { if (!$this->debug) return; $log = date('Y-m-d H:i:s') . " [KRIOSA] " . $message; if (!empty($context)) $log .= " " . json_encode($context); error_log($log); } // ==================== AUTO-BADGE INJECTION METHODS ==================== /** * Output buffer callback to inject the badge before */ public function injectBadgeCallback($buffer) { if (!self::$isProtected) return $buffer; if ($this->isAdminPage()) return $buffer; // Skip injection for AJAX, API, or JSON responses $isAjax = isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest'; $isApi = strpos($_SERVER['REQUEST_URI'] ?? '', '/api/') !== false; $isJson = strpos($_SERVER['CONTENT_TYPE'] ?? '', 'application/json') !== false; if ($isAjax || $isApi || $isJson) return $buffer; if (self::$badgeInjected) return $buffer; self::$badgeInjected = true; $badgePosition = $this->config['badge_position'] ?? 'bottom-right'; $badgeSize = $this->config['badge_size'] ?? 'small'; $badgeHtml = $this->getBadgeHtml($badgePosition, $badgeSize); // Inject before closing body tag if (stripos($buffer, '') !== false) { return str_ireplace('', $badgeHtml . "\n", $buffer); } elseif (stripos($buffer, '') !== false) { return str_ireplace('', $badgeHtml . "\n", $buffer); } return $buffer . "\n" . $badgeHtml; } private function isAdminPage(): bool { $adminPaths = ['/admin', '/wp-admin', '/administrator', '/login', '/register']; $uri = $_SERVER['REQUEST_URI'] ?? ''; foreach ($adminPaths as $path) { if (strpos($uri, $path) !== false) return true; } return false; } /** * Allow users to manually disable the badge if needed */ public static function disableBadge(): void { self::$badgeInjected = true; } private function getBadgeHtml($position, $size): string { return ' Protected by Kriosa '; } } // ==================== GLOBAL HELPER FUNCTIONS ==================== function kriosa_protect(string $apiKey): bool { return Kriosa::quick($apiKey); } function kriosa_check(string $apiKey): array { static $instance = null; if ($instance === null) $instance = new Kriosa($apiKey); return $instance->check(); } // ==================== AUTO-EXECUTION ==================== if (defined('KRIOSA_API_KEY') && constant('KRIOSA_API_KEY') && !defined('KRIOSA_SKIP_AUTO')) { if (!kriosa_protect(constant('KRIOSA_API_KEY'))) { http_response_code(403); die('Request blocked by Kriosa Security'); } }