<?php
/**
 * Database content injection detector.
 *
 * @package LocalGuardScanner
 */

namespace LocalGuardScanner\Detection\Database;

use LocalGuardScanner\Domain\Detection\Detector;
use LocalGuardScanner\Domain\Detection\Evidence;
use LocalGuardScanner\Domain\Detection\ScannableObject;

/**
 * Detects executable or concealed redirect patterns in content.
 */
final class ContentInjectionDetector implements Detector {
	/** @return string */
	public function id() {
		return 'database.content_injection';
	}

	/** @inheritDoc */
	public function inspect( ScannableObject $scanned_object ) {
		if ( 'db_content' !== $scanned_object->type() ) {
			return array();
		}
		$data     = $scanned_object->attributes();
		$content  = isset( $data['content'] ) && is_string( $data['content'] ) ? $data['content'] : '';
		$evidence = array();
		if ( false !== stripos( $content, '<?php' ) ) {
			$evidence[] = new Evidence( 'database.php_in_content', 52, 86, 'php_code_in_wordpress_content', 'php-tag' );
		}
		if ( preg_match( '/<script[^>]*>[^<]*(?:location\s*=|location\.href|fromCharCode|\beval\s*\()/is', $content ) ) {
			$evidence[] = new Evidence( 'database.script_redirect', 50, 80, 'scripted_redirect_in_content', 'script-redirect' );
		}
		if ( preg_match( '/<iframe[^>]+(?:display\s*:\s*none|width\s*=\s*["\']?0|height\s*=\s*["\']?0)/is', $content ) ) {
			$evidence[] = new Evidence( 'database.hidden_iframe', 44, 76, 'hidden_iframe_in_content', 'hidden-iframe' );
		}
		return $evidence;
	}
}
