summaryrefslogtreecommitdiff
path: root/config/default_php8.rules
diff options
context:
space:
mode:
Diffstat (limited to 'config/default_php8.rules')
-rw-r--r--config/default_php8.rules6
1 files changed, 3 insertions, 3 deletions
diff --git a/config/default_php8.rules b/config/default_php8.rules
index c024176..2dd328d 100644
--- a/config/default_php8.rules
+++ b/config/default_php8.rules
@@ -23,14 +23,14 @@ sp.disable_xxe.enable();
23# Only allow execution of read-only files. This is a low-hanging fruit that you should enable. 23# Only allow execution of read-only files. This is a low-hanging fruit that you should enable.
24# sp.readonly_exec.enable(); 24# sp.readonly_exec.enable();
25 25
26# Php has a lot of wrappers, most of them aren't usually useful, you should 26# PHP has a lot of wrappers, most of them aren't usually useful, you should
27# only enable the ones you're using. 27# only enable the ones you're using.
28# sp.wrappers_whitelist.list("file,php,phar"); 28# sp.wrappers_whitelist.list("file,php,phar");
29 29
30# Prevent sloppy comparisons. 30# Prevent sloppy comparisons.
31# sp.sloppy_comparison.enable(); 31# sp.sloppy_comparison.enable();
32 32
33# use SameSite on session cookie 33# Use SameSite on session cookie
34# https://snuffleupagus.readthedocs.io/features.html#protection-against-cross-site-request-forgery 34# https://snuffleupagus.readthedocs.io/features.html#protection-against-cross-site-request-forgery
35sp.cookie.name("PHPSESSID").samesite("lax"); 35sp.cookie.name("PHPSESSID").samesite("lax");
36 36
@@ -58,7 +58,7 @@ sp.disable_function.function("extract").param("flags").value("0").drop()
58# Moreover, there are non-public bypasses that are also using this vector ;) 58# Moreover, there are non-public bypasses that are also using this vector ;)
59sp.disable_function.function("ini_set").param("option").value_r("open_basedir").drop() 59sp.disable_function.function("ini_set").param("option").value_r("open_basedir").drop()
60 60
61##Prevent various `include`-related vulnerabilities 61# Prevent various `include`-related vulnerabilities
62sp.disable_function.function("require_once").value_r("\.(inc|phtml|php)$").allow(); 62sp.disable_function.function("require_once").value_r("\.(inc|phtml|php)$").allow();
63sp.disable_function.function("include_once").value_r("\.(inc|phtml|php)$").allow(); 63sp.disable_function.function("include_once").value_r("\.(inc|phtml|php)$").allow();
64sp.disable_function.function("require").value_r("\.(inc|phtml|php)$").allow(); 64sp.disable_function.function("require").value_r("\.(inc|phtml|php)$").allow();