Add option to specify the allowed "php" wrapper types

In addition of the current possibility to filter wrappers by their
protocol name, also add the option to filter the "php" wrapper by the
requested kind.
Especially the 'filter' backend can be disabled that way.

2 files changed, 26 insertions, 1 deletions

diff --git a/doc/source/config.rst b/doc/source/config.rst
index 9781046..75392d7 100644
--- a/doc/source/config.rst
+++ b/doc/source/config.rst
@@ -395,6 +395,17 @@ to explicitly whitelist some `stream wrappers <https://secure.php.net/manual/en/
   sp.wrappers_whitelist.list("file,php,phar");
 
 
+Allowlist of the php stream-wrapper
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+:ref:`The php-stream-wrapper allowlist <php-stream-wrapper-allowlist-feature>`
+allows to explicitly allow the builtin `php streams <https://www.php.net/manual/en/wrappers.php.php>`__.
+
+::
+
+  sp.wrappers_whitelist.php_list("stdout,stdin,stderr");
+
+
 Eval white and blacklist
 ^^^^^^^^^^^^^^^^^^^^^^^^
 
diff --git a/doc/source/features.rst b/doc/source/features.rst
index d7f6f7f..3855f2a 100644
--- a/doc/source/features.rst
+++ b/doc/source/features.rst
@@ -381,7 +381,7 @@ and using this feature to lock this up.
 Whitelist of stream-wrappers
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-Php comes with a `lot of different <https://secure.php.net/manual/en/wrappers.php>`__
+PHP comes with a `lot of different <https://secure.php.net/manual/en/wrappers.php>`__
 `stream wrapper <https://secure.php.net/manual/en/intro.stream.php>`__, and most of them
 are enabled by default.
 
@@ -397,6 +397,20 @@ Examples of related vulnerabilities
 - `Data exfiltration via stream wrapper <https://www.idontplaydarts.com/2011/02/using-php-filter-for-local-file-inclusion/>`__
 - `Inclusion via zip/phar <https://lightless.me/archives/include-file-from-zip-or-phar.html>`__
 
+.. _php-stream-wrapper-allowlist-feature:
+
+Allowlist of php stream-wrapper
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The builtin `"php" stream wrapper <https://www.php.net/manual/en/wrappers.php.php>`__
+has support for common streams, like ``stdin``, ``stdout`` or ``stderr``, but
+also for the dangerous ``filter`` one.
+
+Examples of related vulnerability
+"""""""""""""""""""""""""""""""""
+
+- `CNEXT exploits <https://github.com/ambionics/cnext-exploits/>`__
+
 .. _eval-feature:
 
 White and blacklist in ``eval``