summaryrefslogtreecommitdiff
path: root/doc/source/features.rst
diff options
context:
space:
mode:
Diffstat (limited to 'doc/source/features.rst')
-rw-r--r--doc/source/features.rst10
1 files changed, 5 insertions, 5 deletions
diff --git a/doc/source/features.rst b/doc/source/features.rst
index bf535e1..fbb2a64 100644
--- a/doc/source/features.rst
+++ b/doc/source/features.rst
@@ -3,7 +3,7 @@ Features
3 3
4Snuffleupagus has a lot of features that can be divided in two main categories: bug-classes 4Snuffleupagus has a lot of features that can be divided in two main categories: bug-classes
5killers and virtual-patching. The first category provides primitives to kill various 5killers and virtual-patching. The first category provides primitives to kill various
6bug families (like arbitrary code execution via ``unserialize`` for example) or rise the 6bug families (like arbitrary code execution via ``unserialize`` for example) or rise the
7cost of exploitation, the second one is a highly configurable system to patch functions in php itself. 7cost of exploitation, the second one is a highly configurable system to patch functions in php itself.
8 8
9Bug classes killed or mitigated 9Bug classes killed or mitigated
@@ -171,7 +171,7 @@ It's worth noting that the PHP documentation contains the following warning:
171 171
172 ``min`` ``max`` range must be within the range ``getrandmax()``. i.e. ``(max - min) <= getrandmax()``. 172 ``min`` ``max`` range must be within the range ``getrandmax()``. i.e. ``(max - min) <= getrandmax()``.
173 Otherwise, ``rand()`` may return poor-quality random numbers. 173 Otherwise, ``rand()`` may return poor-quality random numbers.
174 174
175 --- `The PHP documentation about rand <https://secure.php.net/manual/en/function.rand.php>`_ 175 --- `The PHP documentation about rand <https://secure.php.net/manual/en/function.rand.php>`_
176 176
177This is of course addressed as well by the ``harden_rand`` feature. 177This is of course addressed as well by the ``harden_rand`` feature.
@@ -279,7 +279,7 @@ PHP7 introduced a **strict mode**, in which variables won't be coerced anymore,
279and a `TypeError <https://php.net/manual/en/class.typeerror.php>`_ exception will 279and a `TypeError <https://php.net/manual/en/class.typeerror.php>`_ exception will
280be raised if the types aren't matching. 280be raised if the types aren't matching.
281`Scalar type declarations <https://secure.php.net/manual/en/migration70.new-features.php#migration70.new-features.scalar-type-declarations>`_ 281`Scalar type declarations <https://secure.php.net/manual/en/migration70.new-features.php#migration70.new-features.scalar-type-declarations>`_
282are optional, but you don't have to used them in your code to benefit from them, 282are optional, but you don't have to use them in your code to benefit from them,
283since every internal function from php has them. 283since every internal function from php has them.
284 284
285This option provide a switch to globally activate this strict mode, 285This option provide a switch to globally activate this strict mode,
@@ -307,7 +307,7 @@ and using this feature to lock this up.
307Dumping capabilities 307Dumping capabilities
308^^^^^^^^^^^^^^^^^^^^ 308^^^^^^^^^^^^^^^^^^^^
309It's possible to apply the ``dump()`` filter to any virtual-patching rule, 309It's possible to apply the ``dump()`` filter to any virtual-patching rule,
310to dump the complete web request, along with the filename and the corresponding 310to dump the complete web request, along with the filename and the corresponding
311line number. By using the *right* set of restrictive rules (or by using the 311line number. By using the *right* set of restrictive rules (or by using the
312*overly* restrictives ones in ``simulation`` mode), you might be able 312*overly* restrictives ones in ``simulation`` mode), you might be able
313to gather interesting vulnerabilities used against your website. 313to gather interesting vulnerabilities used against your website.
@@ -332,7 +332,7 @@ or ``is_callable`` with *suspicious* parameters.
332``chmod`` hardening 332``chmod`` hardening
333""""""""""""""""""" 333"""""""""""""""""""
334 334
335Some PHP applications are using broad rights when using the ``chmod`` function, 335Some PHP applications are using broad rights when using the ``chmod`` function,
336like the infamous ``chmod(777)`` command, effectively making the file writable by everyone. 336like the infamous ``chmod(777)`` command, effectively making the file writable by everyone.
337Snuffleupagus is preventing this kind of behaviour by restricting the parameters 337Snuffleupagus is preventing this kind of behaviour by restricting the parameters
338than can be passer to ``chmod``. 338than can be passer to ``chmod``.