diff options
Diffstat (limited to 'config/default_php8.rules')
| -rw-r--r-- | config/default_php8.rules | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/config/default_php8.rules b/config/default_php8.rules index c024176..2dd328d 100644 --- a/config/default_php8.rules +++ b/config/default_php8.rules | |||
| @@ -23,14 +23,14 @@ sp.disable_xxe.enable(); | |||
| 23 | # Only allow execution of read-only files. This is a low-hanging fruit that you should enable. | 23 | # Only allow execution of read-only files. This is a low-hanging fruit that you should enable. |
| 24 | # sp.readonly_exec.enable(); | 24 | # sp.readonly_exec.enable(); |
| 25 | 25 | ||
| 26 | # Php has a lot of wrappers, most of them aren't usually useful, you should | 26 | # PHP has a lot of wrappers, most of them aren't usually useful, you should |
| 27 | # only enable the ones you're using. | 27 | # only enable the ones you're using. |
| 28 | # sp.wrappers_whitelist.list("file,php,phar"); | 28 | # sp.wrappers_whitelist.list("file,php,phar"); |
| 29 | 29 | ||
| 30 | # Prevent sloppy comparisons. | 30 | # Prevent sloppy comparisons. |
| 31 | # sp.sloppy_comparison.enable(); | 31 | # sp.sloppy_comparison.enable(); |
| 32 | 32 | ||
| 33 | # use SameSite on session cookie | 33 | # Use SameSite on session cookie |
| 34 | # https://snuffleupagus.readthedocs.io/features.html#protection-against-cross-site-request-forgery | 34 | # https://snuffleupagus.readthedocs.io/features.html#protection-against-cross-site-request-forgery |
| 35 | sp.cookie.name("PHPSESSID").samesite("lax"); | 35 | sp.cookie.name("PHPSESSID").samesite("lax"); |
| 36 | 36 | ||
| @@ -58,7 +58,7 @@ sp.disable_function.function("extract").param("flags").value("0").drop() | |||
| 58 | # Moreover, there are non-public bypasses that are also using this vector ;) | 58 | # Moreover, there are non-public bypasses that are also using this vector ;) |
| 59 | sp.disable_function.function("ini_set").param("option").value_r("open_basedir").drop() | 59 | sp.disable_function.function("ini_set").param("option").value_r("open_basedir").drop() |
| 60 | 60 | ||
| 61 | ##Prevent various `include`-related vulnerabilities | 61 | # Prevent various `include`-related vulnerabilities |
| 62 | sp.disable_function.function("require_once").value_r("\.(inc|phtml|php)$").allow(); | 62 | sp.disable_function.function("require_once").value_r("\.(inc|phtml|php)$").allow(); |
| 63 | sp.disable_function.function("include_once").value_r("\.(inc|phtml|php)$").allow(); | 63 | sp.disable_function.function("include_once").value_r("\.(inc|phtml|php)$").allow(); |
| 64 | sp.disable_function.function("require").value_r("\.(inc|phtml|php)$").allow(); | 64 | sp.disable_function.function("require").value_r("\.(inc|phtml|php)$").allow(); |
