<?php
/**
 * Suspicious filename detector.
 *
 * @package LocalGuardScanner
 */

namespace LocalGuardScanner\Detection\File;

use LocalGuardScanner\Domain\Detection\Evidence;
use LocalGuardScanner\Domain\Detection\MalwareHeuristicDetector;
use LocalGuardScanner\Domain\Detection\ScannableObject;

/**
 * Detects executable double extensions and misleading core names.
 */
final class FilenameDetector implements MalwareHeuristicDetector {
	/** @return string */
	public function id() {
		return 'file.filename';
	}

	/** @inheritDoc */
	public function inspect( ScannableObject $scanned_object ) {
		if ( 'file' !== $scanned_object->type() ) {
			return array();
		}
		$name     = basename( strtolower( $scanned_object->locator() ) );
		$evidence = array();
		if ( preg_match( '/\.(?:jpe?g|png|gif|pdf|ico|txt)\.(?:php\d*|phtml|phar)$/i', $name ) ) {
			$evidence[] = new Evidence( 'file.double_extension', 48, 90, 'executable_double_extension', $name );
		}
		if ( preg_match( '/^(?:wp-config|wp-login|index)[-_][a-z0-9]{5,}\.php$/i', $name ) ) {
			$evidence[] = new Evidence( 'file.core_imitation', 35, 72, 'core_filename_imitation', $name );
		}
		return $evidence;
	}
}
