snuffleupagus/config/default_php8.rules, branch master Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! http://git.dustri.org/snuffleupagus/atom?h=master 2025-05-25T11:22:06Z Unify/fix the default.rules file across PHP versions, and add some new ones 2025-05-25T11:22:06Z jvoisin 2025-05-25T11:11:38Z urn:sha1:4052c363ec770559aade8bf4ab57e49f2322281d Forbid file:// protocol in Curl 2024-06-09T15:16:29Z bohwaz 2024-03-24T18:04:23Z urn:sha1:95afce1fe46c91025b5c53aa05582e09c6534cd0 Wording updates 2024-06-09T15:16:29Z Christian Göttsche 2024-05-27T20:48:49Z urn:sha1:b41dcf2947bbcfca0152d06684b1caac2586a0b6 Add option to specify the allowed "php" wrapper types 2024-06-09T15:16:16Z Christian Göttsche 2024-05-27T19:33:00Z urn:sha1:c7ce5c3528e8da8762e6e7067001549e109397ba In addition of the current possibility to filter wrappers by their protocol name, also add the option to filter the "php" wrapper by the requested kind. Especially the 'filter' backend can be disabled that way. Fix yet another php surprised-rename of functions parameters 2024-03-24T16:40:27Z jvoisin 2024-03-24T16:40:27Z urn:sha1:6fe3815271a50329a2ba0aa492bb2c9a9820b962 Add some documentation in the default rules. 2023-11-03T15:40:45Z jvoisin 2023-11-03T15:40:45Z urn:sha1:320b3f831f755e6bd4c7ac0334d719bb4b778723 Add another burned vuln to the php8 rules 2023-02-16T10:35:48Z Julien Voisin 2023-02-16T10:35:48Z urn:sha1:53b3f53b0665fa1d98a63e49e82273ec52e5f9f1 Merge remote-tracking branch 'sektioneins/master' 2022-03-20T17:20:45Z jvoisin 2022-03-20T17:20:45Z urn:sha1:81dd7f2ef07af306fe83d7755cbac4529aa9fc8d PHP8 update parameters name in "move_uploaded_file" (#406) 2021-11-26T21:31:53Z pfdutot 2021-11-26T21:31:53Z urn:sha1:eede22217bb766a2982b10ee294f20c3bf4dea3e In the 8.0.8 and 8.1 version of PHP, the parameters name for move_uploaded_file are "from" and "to". This config file fail to apply the relevant rules unless the parameter names are updated using "to" instead of "destination". inverted logic. set xxe_protection.enable() instead of disable_xxe.disable() 2021-11-11T12:15:52Z Ben Fuhrmannek 2021-11-11T12:15:52Z urn:sha1:713cb08b58d4e5dd5e7e80b1f82e27cbe52d4381