Add whitelist support for php's wrappers

2 files changed, 32 insertions, 0 deletions

diff --git a/doc/source/config.rst b/doc/source/config.rst
index 14626ce..e209ecb 100644
--- a/doc/source/config.rst
+++ b/doc/source/config.rst
@@ -191,6 +191,17 @@ disable_xxe
   sp.disable_xxe.enable();
 
 
+Whitelist of stream-wrappers
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+:ref:`Stream-wrapper whitelist <stream-wrapper-whitelist-feature>` allows
+to explicitly whitelist some `stream wrappers <https://secure.php.net/manual/en/intro.stream.php>`__.
+
+::
+
+  sp.wrappers_whitelist.list("file,php,phar");
+
+
 Eval white and blacklist
 ^^^^^^^^^^^^^^^^^^^^^^^^
 
diff --git a/doc/source/features.rst b/doc/source/features.rst
index 60366d4..540e982 100644
--- a/doc/source/features.rst
+++ b/doc/source/features.rst
@@ -344,6 +344,27 @@ Snuffleupagus can prevent the execution of this kind of file. A good practice
 would be to use a different user to run PHP than for administrating the website,
 and using this feature to lock this up.
 
+.. _stream-wrapper-whitelist-feature:
+
+Whitelist of stream-wrappers
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Php comes with a `lot of different <https://secure.php.net/manual/en/wrappers.php>`__
+`stream wrapper <https://secure.php.net/manual/en/intro.stream.php>`__, and most of them
+are enabled by default.
+
+The only way to tighten a bit this exposition surface is to use the
+`allow_url_fopen/allow_url_include <https://secure.php.net/manual/en/features.remote-files.php>`__
+configuration options, but it's `not possible <https://bugs.php.net/bug.php?id=50715>`__
+to deactivate them on an individual basis.
+
+Examples of related vulnerabilities
+"""""""""""""""""""""""""""""""""""
+
+- `RCE via phar:// <https://github.com/orangetw/My-CTF-Web-Challenges#babyh-master-php-2017>`__
+- `Data exfiltration via stream wrapper <https://www.idontplaydarts.com/2011/02/using-php-filter-for-local-file-inclusion/>`__
+- `Inclusion via zip/phar <https://lightless.me/archives/include-file-from-zip-or-phar.html>`__
+
 .. _eval-feature:
 
 White and blacklist in ``eval``