Vladimir Bryzgalov
375 lines
15 KiB
PHP
375 lines
15 KiB
PHP
<?php
|
||
declare(strict_types=1);
|
||
|
||
namespace Cf7stg;
|
||
|
||
final class Classifier
|
||
{
|
||
public const DEFAULT_WEIGHTS = [
|
||
'phone_ru' => 3,
|
||
'cyrillic_name' => 1,
|
||
'ru_email_domain' => 1,
|
||
'meaningful_text' => 1,
|
||
'url_present' => -3,
|
||
'keyword_hit' => -2,
|
||
'keyword_cap' => -6,
|
||
'latin_only' => -1,
|
||
'honeypot' => -5,
|
||
];
|
||
|
||
public const DEFAULT_THRESHOLDS = [
|
||
'client' => 3,
|
||
'spam' => -2,
|
||
'drop' => -5,
|
||
];
|
||
|
||
public const DEFAULT_HARD_DROP_RULES = [
|
||
'short_latin_name' => true,
|
||
'placeholder_fields' => true,
|
||
];
|
||
|
||
public const DEFAULT_KEYWORDS = [
|
||
// SEO / продвижение
|
||
'seo', 'сео', 'продвижение сайта', 'backlinks', 'обратные ссылки', 'позиции в поиске',
|
||
// Finance / earning
|
||
'bitcoin', 'биткоин', 'crypto', 'криптовалют', 'forex', 'форекс', 'trading', 'трейдинг',
|
||
'loan', 'займ', 'микрозайм', 'инвестиции', 'заработок онлайн', 'удалённая работа без',
|
||
'mlm', 'сетевой маркетинг',
|
||
// Casino
|
||
'casino', 'казино', 'ставки', 'betting', 'букмекер',
|
||
// Diet / supplements
|
||
'бад', 'биодобав', 'супер фуд', 'super food', 'детокс', 'похудение', 'похудет',
|
||
'диетическ', 'жиросжиг',
|
||
// Pharma
|
||
'viagra', 'виагра', 'cialis', 'сиалис', 'pharmacy', 'фарма', 'дженерик',
|
||
// Adult
|
||
'porn', 'xxx', 'adult', 'porno', 'порно', 'эскорт', 'проститу',
|
||
'секс-знакомств', 'интим-услуг',
|
||
];
|
||
|
||
public const RU_EMAIL_DOMAINS = [
|
||
'yandex.ru', 'ya.ru', 'mail.ru', 'list.ru', 'inbox.ru', 'bk.ru',
|
||
'rambler.ru', 'gmail.com',
|
||
];
|
||
|
||
/**
|
||
* Explicit service field keys excluded from placeholder count.
|
||
* Note: keys starting with `_wpcf7` are also skipped via prefix match
|
||
* (see count_placeholder_fields), so this list does not need to enumerate
|
||
* every `_wpcf7_*` variant — only non-prefixed service keys.
|
||
*/
|
||
private const SERVICE_FIELD_KEYS = [
|
||
'acceptance-data',
|
||
'_wpcf7', '_wpcf7_version', '_wpcf7_locale', '_wpcf7_unit_tag',
|
||
'_wpcf7_container_post', '_wpcf7_posted_data_hash',
|
||
'g-recaptcha-response',
|
||
];
|
||
|
||
/**
|
||
* @param array<string,mixed> $fields CF7 posted_data (field => value or array of values)
|
||
* @param array{reason?:string} $meta Context: reason = Akismet / Honeypot / CF7 rules / Неизвестно
|
||
* @return array{score:int,label:string,reasons:array<int,array{sign:string,weight:int,text:string}>}
|
||
*/
|
||
public static function classify(array $fields, array $meta = []): array
|
||
{
|
||
$weights = apply_filters('cf7stg_classifier_weights', self::DEFAULT_WEIGHTS);
|
||
$keywords = apply_filters('cf7stg_classifier_keywords', self::DEFAULT_KEYWORDS);
|
||
$thresholds = apply_filters('cf7stg_classifier_thresholds', self::DEFAULT_THRESHOLDS);
|
||
|
||
$text_all = self::concat_fields($fields);
|
||
$name = self::pick_field($fields, ['your-name', 'name', 'имя', 'fio']);
|
||
if ($name === '') $name = FieldDetector::find_name($fields);
|
||
$email = self::pick_field($fields, ['your-email', 'email', 'e-mail', 'mail']);
|
||
if ($email === '') $email = FieldDetector::find_email($fields);
|
||
$message = self::pick_field($fields, ['your-message', 'message', 'comment', 'сообщение', 'вопрос']);
|
||
|
||
$score = 0;
|
||
$reasons = [];
|
||
|
||
// +3 RU phone
|
||
if (PhoneParser::parse($text_all) !== null) {
|
||
$parsed = PhoneParser::parse($text_all);
|
||
if ($parsed !== null && $parsed['is_russian']) {
|
||
$score += (int)$weights['phone_ru'];
|
||
$reasons[] = ['sign' => '+', 'weight' => (int)$weights['phone_ru'], 'text' => 'телефон RU'];
|
||
}
|
||
}
|
||
|
||
// +1 cyrillic name (no digits, no URL, some cyrillic)
|
||
if ($name !== '' && self::is_cyrillic_name($name)) {
|
||
$score += (int)$weights['cyrillic_name'];
|
||
$reasons[] = ['sign' => '+', 'weight' => (int)$weights['cyrillic_name'], 'text' => 'кириллическое имя'];
|
||
}
|
||
|
||
// +1 RU email domain
|
||
if ($email !== '' && self::is_ru_email_domain($email)) {
|
||
$score += (int)$weights['ru_email_domain'];
|
||
$reasons[] = ['sign' => '+', 'weight' => (int)$weights['ru_email_domain'], 'text' => 'ру-домен e-mail'];
|
||
}
|
||
|
||
// +1 meaningful text (cyrillic, >10 chars, not just a link)
|
||
if ($message !== '' && self::is_meaningful_text($message)) {
|
||
$score += (int)$weights['meaningful_text'];
|
||
$reasons[] = ['sign' => '+', 'weight' => (int)$weights['meaningful_text'], 'text' => 'осмысленный текст'];
|
||
}
|
||
|
||
// -3 URL anywhere
|
||
if (self::contains_url($text_all)) {
|
||
$score += (int)$weights['url_present'];
|
||
$reasons[] = ['sign' => '-', 'weight' => abs((int)$weights['url_present']), 'text' => 'URL в сообщении'];
|
||
}
|
||
|
||
// -2 per keyword, capped at -6
|
||
$hits = self::keyword_hits($text_all, $keywords);
|
||
if ($hits) {
|
||
$per = (int)$weights['keyword_hit']; // negative
|
||
$cap = (int)$weights['keyword_cap']; // negative
|
||
$applied = max(count($hits) * $per, $cap);
|
||
$score += $applied;
|
||
foreach ($hits as $kw) {
|
||
$reasons[] = ['sign' => '-', 'weight' => abs($per), 'text' => 'ключевое слово: ' . $kw];
|
||
if (count(array_filter($reasons, static fn($r) => strpos($r['text'], 'ключевое слово') === 0)) >= 3) {
|
||
break; // keep reasons list readable
|
||
}
|
||
}
|
||
}
|
||
|
||
// -1 latin-only name or message
|
||
if (($name !== '' && self::is_latin_only($name)) || ($message !== '' && self::is_latin_only($message))) {
|
||
$score += (int)$weights['latin_only'];
|
||
$reasons[] = ['sign' => '-', 'weight' => abs((int)$weights['latin_only']), 'text' => 'только латиница'];
|
||
}
|
||
|
||
// -5 honeypot (weighted sign AND hard override)
|
||
$honeypot_tripped = (($meta['reason'] ?? '') === 'Honeypot');
|
||
if ($honeypot_tripped) {
|
||
$score += (int)$weights['honeypot'];
|
||
$reasons[] = ['sign' => '-', 'weight' => abs((int)$weights['honeypot']), 'text' => 'сработал honeypot'];
|
||
}
|
||
|
||
$label = 'unclear';
|
||
if ($score >= (int)$thresholds['client']) {
|
||
$label = 'client';
|
||
} elseif ($score <= (int)$thresholds['spam']) {
|
||
$label = 'spam';
|
||
}
|
||
// Honeypot is a hard override: a filled honeypot field means a bot,
|
||
// regardless of how "human" the other fields look.
|
||
if ($honeypot_tripped) {
|
||
$label = 'spam';
|
||
}
|
||
|
||
// Drop has highest priority (overrides client/unclear/spam/honeypot)
|
||
$drop_trigger = self::compute_hard_drop_trigger($fields);
|
||
$is_drop_by_score = isset($thresholds['drop']) && $score <= (int)$thresholds['drop'];
|
||
if ($drop_trigger !== null || $is_drop_by_score) {
|
||
$label = 'drop';
|
||
$reason_text = $drop_trigger ?? ('score ≤ ' . (int)$thresholds['drop']);
|
||
$reasons[] = ['sign' => '×', 'weight' => 0, 'text' => $reason_text];
|
||
}
|
||
|
||
return ['score' => $score, 'label' => $label, 'reasons' => $reasons];
|
||
}
|
||
|
||
private static function concat_fields(array $fields): string
|
||
{
|
||
$out = [];
|
||
foreach ($fields as $v) {
|
||
if (is_array($v)) {
|
||
$out[] = implode(' ', array_map('strval', $v));
|
||
} else {
|
||
$out[] = (string)$v;
|
||
}
|
||
}
|
||
return implode("\n", $out);
|
||
}
|
||
|
||
private static function pick_field(array $fields, array $keys): string
|
||
{
|
||
foreach ($keys as $k) {
|
||
if (isset($fields[$k])) {
|
||
$v = $fields[$k];
|
||
if (is_array($v)) $v = implode(' ', $v);
|
||
return trim((string)$v);
|
||
}
|
||
}
|
||
return '';
|
||
}
|
||
|
||
private static function is_cyrillic_name(string $s): bool
|
||
{
|
||
if (preg_match('/[0-9]/u', $s)) return false;
|
||
if (preg_match('#https?://|www\.#i', $s)) return false;
|
||
return (bool)preg_match('/[а-яёА-ЯЁ]/u', $s);
|
||
}
|
||
|
||
private static function is_ru_email_domain(string $email): bool
|
||
{
|
||
if (!preg_match('/@([^@\s]+)$/', trim($email), $m)) return false;
|
||
$domain = strtolower($m[1]);
|
||
return in_array($domain, self::RU_EMAIL_DOMAINS, true);
|
||
}
|
||
|
||
private static function is_meaningful_text(string $s): bool
|
||
{
|
||
if (mb_strlen($s) < 10) return false;
|
||
if (preg_match('/^\s*https?:\/\/\S+\s*$/i', $s)) return false;
|
||
return (bool)preg_match('/[а-яёА-ЯЁ]{3,}/u', $s);
|
||
}
|
||
|
||
private static function contains_url(string $s): bool
|
||
{
|
||
return (bool)preg_match('#(https?://|www\.)\S+#i', $s);
|
||
}
|
||
|
||
private static function is_latin_only(string $s): bool
|
||
{
|
||
$s = trim($s);
|
||
if ($s === '') return false;
|
||
if (!preg_match('/[A-Za-z]/', $s)) return false;
|
||
return !preg_match('/[а-яёА-ЯЁ]/u', $s);
|
||
}
|
||
|
||
private static function keyword_hits(string $text, array $keywords): array
|
||
{
|
||
$hits = [];
|
||
$text_lower = mb_strtolower($text);
|
||
foreach ($keywords as $kw) {
|
||
$needle = mb_strtolower($kw);
|
||
if ($needle === '') continue;
|
||
if (mb_strpos($text_lower, $needle) !== false) {
|
||
$hits[] = $kw;
|
||
}
|
||
}
|
||
return $hits;
|
||
}
|
||
|
||
/**
|
||
* Checks whether any field value contains a syntactically valid email address.
|
||
*
|
||
* Used by drop-logic to spare submissions that include any plausible contact email
|
||
* (any TLD, including gmail.com and custom domains — not limited to RU domains).
|
||
*
|
||
* Handles flat string values and one level of array nesting (matches CF7 posted_data
|
||
* shape). Deeper nesting is intentionally NOT supported.
|
||
*
|
||
* @param array<string,string|string[]> $fields CF7 posted_data
|
||
* @return bool True if any value contains a syntactically valid email
|
||
*/
|
||
public static function has_valid_email_anywhere(array $fields): bool
|
||
{
|
||
foreach ($fields as $v) {
|
||
$values = is_array($v) ? $v : [$v];
|
||
foreach ($values as $val) {
|
||
$val = trim((string)$val);
|
||
if ($val === '') continue;
|
||
if (preg_match_all('/[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}/', $val, $matches)) {
|
||
foreach ($matches[0] as $candidate) {
|
||
if (is_email($candidate)) return true;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
return false;
|
||
}
|
||
|
||
/**
|
||
* Checks whether the form's name field contains 1-3 ASCII alphanumeric characters
|
||
* (typical bot pattern: "OB", "MU", "A1B"). Used by drop hard-rule.
|
||
*
|
||
* Looks first at canonical CF7 keys (your-name, name, имя, fio), then falls back to
|
||
* the value-based heuristic in FieldDetector::find_name(). Returns false if no name
|
||
* field is present (i.e. forms without a name field are immune to this rule).
|
||
*
|
||
* Cyrillic look-alikes (e.g. 'ОВ') are rejected because the regex is byte-range.
|
||
*
|
||
* @param array<string,string|string[]> $fields CF7 posted_data
|
||
* @return bool True if a name field exists and is 1-3 ASCII alphanumeric chars
|
||
*/
|
||
public static function has_short_latin_name(array $fields): bool
|
||
{
|
||
$name = self::pick_field($fields, ['your-name', 'name', 'имя', 'fio']);
|
||
if ($name === '') $name = FieldDetector::find_name($fields);
|
||
$name = trim($name);
|
||
if ($name === '') return false;
|
||
return (bool)preg_match('/^[A-Za-z0-9]{1,3}$/', $name);
|
||
}
|
||
|
||
/**
|
||
* Counts non-empty fields whose value is exactly 1-2 ASCII alphanumeric chars
|
||
* (the typical "AB", "70" placeholder pattern bots fill custom-keyed fields with).
|
||
*
|
||
* Skips service keys (acceptance-data, _wpcf7*, g-recaptcha-response) and any key
|
||
* starting with `_wpcf7`. Array values are joined without separators before length
|
||
* check (so `['A','B']` collapses to "AB" — still counted).
|
||
*
|
||
* @param array<string,string|string[]|null> $fields CF7 posted_data
|
||
* @return int Number of fields matching the placeholder pattern
|
||
*/
|
||
public static function count_placeholder_fields(array $fields): int
|
||
{
|
||
$count = 0;
|
||
foreach ($fields as $k => $v) {
|
||
if (is_string($k)) {
|
||
if (in_array($k, self::SERVICE_FIELD_KEYS, true)) continue;
|
||
if (strpos($k, '_wpcf7') === 0) continue;
|
||
}
|
||
if (is_array($v)) $v = implode('', array_map('strval', $v));
|
||
$v = trim((string)$v);
|
||
if ($v === '') continue;
|
||
if (!preg_match('/^[A-Za-z0-9]{1,2}$/', $v)) continue;
|
||
$count++;
|
||
}
|
||
return $count;
|
||
}
|
||
|
||
/**
|
||
* Returns the hard-rule trigger description, or null if no rule fires.
|
||
* Centralises positive-signal checks + trigger detection so callers don't
|
||
* recompute. Used by evaluate_hard_drop() and classify()'s reason builder.
|
||
*
|
||
* @param array<string,string|string[]> $fields CF7 posted_data
|
||
* @return string|null e.g. "hard-rule: короткое латинское имя + ≥3 поля-плейсхолдера"
|
||
*/
|
||
private static function compute_hard_drop_trigger(array $fields): ?string
|
||
{
|
||
$rules = apply_filters('cf7stg_hard_drop_rules', self::DEFAULT_HARD_DROP_RULES);
|
||
|
||
// Positive-signal short-circuits
|
||
$name = self::pick_field($fields, ['your-name', 'name', 'имя', 'fio']);
|
||
if ($name === '') $name = FieldDetector::find_name($fields);
|
||
if ($name !== '' && self::is_cyrillic_name($name)) return null;
|
||
|
||
$message = self::pick_field($fields, ['your-message', 'message', 'comment', 'сообщение', 'вопрос']);
|
||
if ($message !== '' && self::is_meaningful_text($message)) return null;
|
||
|
||
if (self::has_valid_email_anywhere($fields)) return null;
|
||
|
||
// Triggers
|
||
$hits = [];
|
||
if (!empty($rules['short_latin_name']) && self::has_short_latin_name($fields)) {
|
||
$hits[] = 'короткое латинское имя';
|
||
}
|
||
if (!empty($rules['placeholder_fields']) && self::count_placeholder_fields($fields) >= 3) {
|
||
$hits[] = '≥3 поля-плейсхолдера';
|
||
}
|
||
if (empty($hits)) return null;
|
||
return 'hard-rule: ' . implode(' + ', $hits);
|
||
}
|
||
|
||
/**
|
||
* Hard-rule decision: returns true if the submission has zero positive signals
|
||
* (no cyrillic name, no meaningful text, no valid email anywhere) AND at least
|
||
* one trigger fires (short latin name OR ≥3 placeholder fields).
|
||
*
|
||
* Triggers can be disabled individually via filter `cf7stg_hard_drop_rules`.
|
||
*
|
||
* @param array<string,string|string[]> $fields CF7 posted_data
|
||
* @return bool True if the submission should be silently dropped by hard-rule.
|
||
*/
|
||
public static function evaluate_hard_drop(array $fields): bool
|
||
{
|
||
return self::compute_hard_drop_trigger($fields) !== null;
|
||
}
|
||
}
|