snuffleupagus/src/sp_utils.h, branch master Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! http://git.dustri.org/snuffleupagus/atom?h=master 2024-06-06T14:36:40Z Add format attribute to log function and adjust format specifiers 2024-06-06T14:36:40Z Christian Göttsche 2024-06-06T14:36:40Z urn:sha1:849252c6a48b428dde3ad8930b40a2bdf9874cb7 Annotate the common logging function sp_log_msgf() with the format attribute so compilers can check the used format string and passed arguments for discrepancies. Adjust the lineno printing by using %zu and the type size_t consistently. Avoid dropping const qualifier in casts 2024-06-06T14:27:35Z Christian Göttsche 2024-05-29T18:38:23Z urn:sha1:f40955e03cd361966f927acfaa477cfceb8930e5 Adjusts casts to void dropping const qualifiers. This helps to avoid mistakes, e.g. modifying string literals. Also use size_t for length, similar to the upstream php interfaces. Even more const! 2022-07-13T19:25:04Z jvoisin 2022-07-13T19:25:04Z urn:sha1:ed87e551efd0160f1944a5e97158ab258db65eaf introduced sp_regexp / store original regex 2022-02-05T11:22:13Z Ben Fuhrmannek 2022-02-05T11:22:13Z urn:sha1:323f818a6ce33d021bc0a6d34064598917e68c91 fix: include class name in eval whitelist matching 2021-12-14T13:29:43Z Ben Fuhrmannek 2021-12-14T13:29:43Z urn:sha1:4a45ba42b609d48c8297456d67cc8d955073b567 added @log logging feature to config parser 2021-11-30T12:06:53Z Ben Fuhrmannek 2021-11-30T12:06:53Z urn:sha1:aa099cd7a4aa5e3296d39158184e301af9ef2f78 config is stack allocated now + some code improvements (see details) 2021-09-23T10:23:40Z Ben Fuhrmannek 2021-09-23T10:23:40Z urn:sha1:54c352c1b5aa08b187dd1e52e544709cad2b0fee * for easier memory manegement, the entire sp_config struct was merged into snuffleupagus_globals and allocated on stack where possible * SNUFFLEUPAGUS_G() can be written as SPG(), which is faster to type and easier to read * execution_depth is re-initialized to 0 for each request * function calls with inline string and length parameters consistently use ZEND_STRL instead of sizeof()-1 * execution is actually hooked if recursion protection is enabled * some line breaks were removed to make the code more readable fincy new scanner/parser for config rules + fixed a few bugs along the way + fixed related unittests 2021-08-16T13:47:01Z Ben Fuhrmannek 2021-08-16T13:47:01Z urn:sha1:5148ded7268b569fd5e720f90b44645c83ac3e9e prevent STDERR debug output based on SP_NODEBUG environment variable 2021-08-07T13:55:48Z Ben Fuhrmannek 2021-08-07T13:55:48Z urn:sha1:e8bb162220ac17cb9b8cc229666356e88f081887 restructured function hooks, implemented unhook 2021-08-06T18:17:38Z Ben Fuhrmannek 2021-08-06T18:17:38Z urn:sha1:260f17f112e2d081783c6dc102f81666ac2435d9