Woles-Framework/app/Core/Middleware/SecurityMiddleware.php

<?php

namespace App\Core\Middleware;

/**
 * Security Middleware
 * Basic security checks
 */
class SecurityMiddleware
{
    public function handle(string $method, string $uri, callable $next): void
    {
        // Check for suspicious patterns
        if ($this->isSuspiciousRequest($uri)) {
            http_response_code(403);
            echo "<h1>403 - Forbidden</h1>";
            echo "<p>Access denied due to security policy.</p>";
            return;
        }

        // Check request size
        if ($this->isRequestTooLarge()) {
            http_response_code(413);
            echo "<h1>413 - Request Too Large</h1>";
            echo "<p>Request size exceeds allowed limit.</p>";
            return;
        }

        // Continue to next middleware
        $next();
    }

    /**
     * Check for suspicious request patterns
     */
    private function isSuspiciousRequest(string $uri): bool
    {
        $suspiciousPatterns = [
            '/\.\./',  // Directory traversal
            '/\.env/',  // Environment file access
            '/\.git/',  // Git directory access
            '/\.htaccess/',  // Apache config access
            '/\.htpasswd/',  // Apache password file
            '/admin\.php/',  // Admin file access
            '/config\.php/',  // Config file access
            '/wp-admin/',  // WordPress admin
            '/wp-login/',  // WordPress login
            '/phpmyadmin/',  // phpMyAdmin
            '/\.sql/',  // SQL file access
            '/\.bak/',  // Backup file access
        ];

        foreach ($suspiciousPatterns as $pattern) {
            if (preg_match($pattern, $uri)) {
                return true;
            }
        }

        return false;
    }

    /**
     * Check if request is too large
     */
    private function isRequestTooLarge(): bool
    {
        $maxSize = 10 * 1024 * 1024; // 10MB
        $contentLength = (int)($_SERVER['CONTENT_LENGTH'] ?? 0);

        return $contentLength > $maxSize;
    }
}