FM / src

/var/www/vhosts/ihelp.ro/_OLD/vendor/laminas/laminas-diactoros/src/

/var/www/vhosts/ihelp.ro/_OLD/vendor/laminas/laminas-diactoros/src

Name	Size	Mode	Actions
Exception/	-	0755	rm
functions/	-	0755	rm
Request/	-	0755	rm
Response/	-	0755	rm
AbstractSerializer.php	4586	0644	edit dl rm
CallbackStream.php	3429	0644	edit dl rm
ConfigProvider.php	1577	0644	edit dl rm
HeaderSecurity.php	5438	0644	edit dl rm
MessageTrait.php	12928	0644	edit dl rm
Module.php	521	0644	edit dl rm
PhpInputStream.php	1841	0644	edit dl rm
RelativeStream.php	3846	0644	edit dl rm
Request.php	2119	0644	edit dl rm
RequestFactory.php	662	0644	edit dl rm
RequestTrait.php	10196	0644	edit dl rm
Response.php	6026	0644	edit dl rm
ResponseFactory.php	727	0644	edit dl rm
ServerRequest.php	6591	0644	edit dl rm
ServerRequestFactory.php	3088	0644	edit dl rm
Stream.php	8258	0644	edit dl rm
StreamFactory.php	1488	0644	edit dl rm
UploadedFile.php	7667	0644	edit dl rm
UploadedFileFactory.php	1040	0644	edit dl rm
Uri.php	17753	0644	edit dl rm
UriFactory.php	621	0644	edit dl rm

Edit: /var/www/vhosts/ihelp.ro/_OLD/vendor/laminas/laminas-diactoros/src/HeaderSecurity.php (5438B)

<?php

/**
 * @see       https://github.com/laminas/laminas-diactoros for the canonical source repository
 * @copyright https://github.com/laminas/laminas-diactoros/blob/master/COPYRIGHT.md
 * @license   https://github.com/laminas/laminas-diactoros/blob/master/LICENSE.md New BSD License
 */

declare(strict_types=1);

namespace Laminas\Diactoros;

use function get_class;
use function gettype;
use function in_array;
use function is_numeric;
use function is_object;
use function is_string;
use function ord;
use function preg_match;
use function sprintf;
use function strlen;

/**
 * Provide security tools around HTTP headers to prevent common injection vectors.
 *
 * Code is largely lifted from the Laminas\Http\Header\HeaderValue implementation in
 * Laminas, released with the copyright and license below.
 *
 * @copyright Copyright (c) 2005-2015 Laminas (https://www.zend.com)
 * @license   https://getlaminas.org/license/new-bsd New BSD License
 */
final class HeaderSecurity
{
    /**
     * Private constructor; non-instantiable.
     * @codeCoverageIgnore
     */
    private function __construct()
    {
    }

/**
     * Filter a header value
     *
     * Ensures CRLF header injection vectors are filtered.
     *
     * Per RFC 7230, only VISIBLE ASCII characters, spaces, and horizontal
     * tabs are allowed in values; header continuations MUST consist of
     * a single CRLF sequence followed by a space or horizontal tab.
     *
     * This method filters any values not allowed from the string, and is
     * lossy.
     *
     * @see http://en.wikipedia.org/wiki/HTTP_response_splitting
     */
    public static function filter(string $value) : string
    {
        $value  = (string) $value;
        $length = strlen($value);
        $string = '';
        for ($i = 0; $i < $length; $i += 1) {
            $ascii = ord($value[$i]);

// Detect continuation sequences
            if ($ascii === 13) {
                $lf = ord($value[$i + 1]);
                $ws = ord($value[$i + 2]);
                if ($lf === 10 && in_array($ws, [9, 32], true)) {
                    $string .= $value[$i] . $value[$i + 1];
                    $i += 1;
                }

continue;
            }

// Non-visible, non-whitespace characters
            // 9 === horizontal tab
            // 32-126, 128-254 === visible
            // 127 === DEL
            // 255 === null byte
            if (($ascii < 32 && $ascii !== 9)
                || $ascii === 127
                || $ascii > 254
            ) {
                continue;
            }

$string .= $value[$i];
        }

return $string;
    }

/**
     * Validate a header value.
     *
     * Per RFC 7230, only VISIBLE ASCII characters, spaces, and horizontal
     * tabs are allowed in values; header continuations MUST consist of
     * a single CRLF sequence followed by a space or horizontal tab.
     *
     * @param string|int|float $value
     * @see http://en.wikipedia.org/wiki/HTTP_response_splitting
     */
    public static function isValid($value) : bool
    {
        $value  = (string) $value;

// Look for:
        // \n not preceded by \r, OR
        // \r not followed by \n, OR
        // \r\n not followed by space or horizontal tab; these are all CRLF attacks
        if (preg_match("#(?:(?:(?<!\r)\n)|(?:\r(?!\n))|(?:\r\n(?![ \t])))#", $value)) {
            return false;
        }

// Non-visible, non-whitespace characters
        // 9 === horizontal tab
        // 10 === line feed
        // 13 === carriage return
        // 32-126, 128-254 === visible
        // 127 === DEL (disallowed)
        // 255 === null byte (disallowed)
        if (preg_match('/[^\x09\x0a\x0d\x20-\x7E\x80-\xFE]/', $value)) {
            return false;
        }

return true;
    }

/**
     * Assert a header value is valid.
     *
     * @param mixed $value Value to be tested. This method asserts it is a string or number.
     * @throws Exception\InvalidArgumentException for invalid values
     */
    public static function assertValid($value)
    {
        if (! is_string($value) && ! is_numeric($value)) {
            throw new Exception\InvalidArgumentException(sprintf(
                'Invalid header value type; must be a string or numeric; received %s',
                (is_object($value) ? get_class($value) : gettype($value))
            ));
        }
        if (! self::isValid($value)) {
            throw new Exception\InvalidArgumentException(sprintf(
                '"%s" is not valid header value',
                $value
            ));
        }
    }

/**
     * Assert whether or not a header name is valid.
     *
     * @see http://tools.ietf.org/html/rfc7230#section-3.2
     * @param mixed $name
     * @throws Exception\InvalidArgumentException
     */
    public static function assertValidName($name)
    {
        if (! is_string($name)) {
            throw new Exception\InvalidArgumentException(sprintf(
                'Invalid header name type; expected string; received %s',
                (is_object($name) ? get_class($name) : gettype($name))
            ));
        }
        if (! preg_match('/^[a-zA-Z0-9\'`#$%&*+.^_|~!-]+$/', $name)) {
            throw new Exception\InvalidArgumentException(sprintf(
                '"%s" is not valid header name',
                $name
            ));
        }
    }
}

254 ) { continue; } $string .= $value[$i]; } return $string; } /** * Validate a header value. * * Per RFC 7230, only VISIBLE ASCII characters, spaces, and horizontal * tabs are allowed in values; header continuations MUST consist of * a single CRLF sequence followed by a space or horizontal tab. * * @param string|int|float $value * @see http://en.wikipedia.org/wiki/HTTP_response_splitting */ public static function isValid($value) : bool { $value = (string) $value; // Look for: // \n not preceded by \r, OR // \r not followed by \n, OR // \r\n not followed by space or horizontal tab; these are all CRLF attacks if (preg_match("#(?:(?:(?