4 files changed, 32 insertions, 65 deletions

diff --git a/config/default.rules b/config/default.rules
index 88398c1..b52ae4c 100644
--- a/config/default.rules
+++ b/config/default.rules
@@ -1,6 +1,5 @@
 # Harden the `chmod` function
 sp.disable_function.function("chmod").param("mode").value_r("^[0-9]{2}[67]$").drop();
-sp.disable_function.function("chmod").param("mode").value_r("o\\+w$").drop();
 
 # Prevent various `mail`-related vulnerabilities
 sp.disable_function.function("mail").param("additional_parameters").value_r("\\-").drop();
diff --git a/config/examples.rules b/config/examples.rules
deleted file mode 100644
index 664a67a..0000000
--- a/config/examples.rules
+++ /dev/null
@@ -1,41 +0,0 @@
-# Restrict system calls to specific file
-sp.disable_function.function("system").filename("/update.php").allow();
-sp.disable_function.function("system").drop();
-   
-
-# Restrict system calls to specific file with a specific hash
-sp.disable_function.function("system").filename("/update.php").hash("d27c6c5686bc129716b6aac8dfefe2d519a80eb6cc144e97ad42c728d423eed0").allow();
-sp.disable_function.function("system").drop();
-
-
-# AbanteCart 1.2.8 - Multiple SQL Injections <https://blog.ripstech.com/2016/abantecart-multiple-sql-injections>
-sp.disable_function.filename("/core/lib/language_manager.php").function("ALanguageManager>_clone_language_rows").param("from_language").value_r("[^0-9]").drop();
-sp.disable_function.filename("/admin/model/tool/backup.php").function("ModelToolBackup>createBackupTask").param("data[table_list]").value_r("'").drop();
-
-
-# Redaxo 5.2.0: Remote Code Execution via CSRF <https://blog.ripstech.com/2016/redaxo-remote-code-execution-via-csrf>
-# See <http://code.vtiger.com/vtiger/vtigercrm/commit/9b5c5338f80237ae072a06e1ba4a5cfcbfe063b0> for details
-sp.disable_function.filename("/redaxo/src/addons/structure/pages/linkmap.php").function("substr").param("string").value_r("\"").drop();
-
-
-# Guest Post: Vtiger 6.5.0 - SQL Injection <https://blog.ripstech.com/2016/vtiger-sql-injection/>
-sp.disable_function.filename("/modules/Calendar/Activity.php").function("save_module").param("query").value_r("[^0-9;]").drop();
-
-
-# The State of Wordpress Security <https://blog.ripstech.com/2016/the-state-of-wordpress-security>
-# All In One WP Security & Firewall
-sp.disable_function.filename("/admin/wp-security-dashboard-menu.php").function("render_tab3").var("_REQUEST[tab]").value_r("\"").drop();
-
-
-# PHPKit 1.6.6: Code Execution for Privileged Users <https://blog.ripstech.com/2016/phpkit-code-exection-for-privileged-users>
-sp.disable_function.filename("/pkinc/func/default.php").function("move_uploaded_file").param("destination").value_r("\\.ph\\.+$").drop();
-
-
-# Coppermine 1.5.42: Second-Order Command Execution <https://blog.ripstech.com/2016/coppermine-second-order-command-execution>
-sp.disable_function.filename("/include/imageobject_im.class.php").function("exec").var("CONFIG[im_options]").value_r("[^a-z0-9]").drop();
-sp.disable_function.filename("/forgot_passwd.php").function("cpg_db_query").var("CLEAN[id]").value_r("[^a-z0-9]").drop();
-
-
-# CVE-2017-1001000 - https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
-sp.disable_function.filename("/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_GET[id]").value_r("[^0-9]").drop();
-sp.disable_function.filename("/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_POST[id]").value_r("[^0-9]").drop();
diff --git a/config/rips.rules b/config/rips.rules
index 9497528..52e3f27 100644
--- a/config/rips.rules
+++ b/config/rips.rules
@@ -1,4 +1,33 @@
-sp.disable_function.function("define").filename_r("/static_pages/index.php").var("$_SERVER[PHP_SELF]").value_r("\"").drop();
-sp.disable_function.function("ModelToolBackup::createBackupTask").filename_r("/admin/model/tool/backup.php").param("data[table_list]").value_r("'").drop();
-sp.disable_function.function("ALanguageManager::_clone_language_rows").filename_r("/core/lib/language_manager.php").param("from_language").value_r("[^0-9]").drop();
+# AbanteCart 1.2.8 - Multiple SQL Injections <https://blog.ripstech.com/2016/abantecart-multiple-sql-injections>
+sp.disable_function.function("define").filename_r("/static_pages/index\\.php$").var("$_SERVER[PHP_SELF]").value_r("\"").drop();
+sp.disable_function.function("ModelToolBackup::createBackupTask").filename_r("/admin/model/tool/backup\\.php$").param("data[table_list]").value_r("'").drop();
+sp.disable_function.function("ALanguageManager::_clone_language_rows").filename_r("/core/lib/language_manager\\.php$").param("from_language").value_r("[^0-9]").drop();
+
+
+# Redaxo 5.2.0: Remote Code Execution via CSRF <https://blog.ripstech.com/2016/redaxo-remote-code-execution-via-csrf>
+# See <http://code.vtiger.com/vtiger/vtigercrm/commit/9b5c5338f80237ae072a06e1ba4a5cfcbfe063b0> for details
+sp.disable_function.filename("/redaxo/src/addons/structure/pages/linkmap.php").function("substr").param("string").value_r("\"").drop();
+
+
+# Guest Post: Vtiger 6.5.0 - SQL Injection <https://blog.ripstech.com/2016/vtiger-sql-injection/>
+sp.disable_function.filename("/modules/Calendar/Activity.php").function("save_module").param("query").value_r("[^0-9;]").drop();
+
+
+# The State of Wordpress Security <https://blog.ripstech.com/2016/the-state-of-wordpress-security>
+# All In One WP Security & Firewall
+sp.disable_function.filename("/admin/wp-security-dashboard-menu.php").function("render_tab3").var("_REQUEST[tab]").value_r("\"").drop();
+
+
+# PHPKit 1.6.6: Code Execution for Privileged Users <https://blog.ripstech.com/2016/phpkit-code-exection-for-privileged-users>
+sp.disable_function.filename("/pkinc/func/default.php").function("move_uploaded_file").param("destination").value_r("\\.ph\\.+$").drop();
+
+
+# Coppermine 1.5.42: Second-Order Command Execution <https://blog.ripstech.com/2016/coppermine-second-order-command-execution>
+sp.disable_function.filename("/include/imageobject_im.class.php").function("exec").var("CONFIG[im_options]").value_r("[^a-z0-9]").drop();
+sp.disable_function.filename("/forgot_passwd.php").function("cpg_db_query").var("CLEAN[id]").value_r("[^a-z0-9]").drop();
+
+
+# CVE-2017-1001000 - https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
+sp.disable_function.filename("/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_GET[id]").value_r("[^0-9]").drop();
+sp.disable_function.filename("/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_POST[id]").value_r("[^0-9]").drop();
 
diff --git a/src/tests/example_configuration.phpt b/src/tests/example_configuration.phpt
deleted file mode 100644
index 6c2e82d..0000000
--- a/src/tests/example_configuration.phpt
+++ /dev/null
@@ -1,20 +0,0 @@
---TEST--
-Shipped configuration
---SKIPIF--
-<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
---INI--
-sp.configuration_file={PWD}/../../config/examples.rules
---FILE--
-<?php 
-ob_start();
-phpinfo();
-$info = ob_get_clean();
-ob_get_clean();
-if (strstr($info, 'Valid config => yes') !== FALSE) {
-        echo "win";
-} else {
-        echo "lose";
-}
-?>
---EXPECTF--
-win