diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/source/config.rst | 55 |
1 files changed, 33 insertions, 22 deletions
diff --git a/doc/source/config.rst b/doc/source/config.rst index 84e3fa9..9e9fb83 100644 --- a/doc/source/config.rst +++ b/doc/source/config.rst | |||
| @@ -1,16 +1,6 @@ | |||
| 1 | Configuration | 1 | Configuration |
| 2 | ============= | 2 | ============= |
| 3 | 3 | ||
| 4 | Options are chainable by using dots (``.``) and string parameters | ||
| 5 | **must** be quoted, while booleans and integers aren't. | ||
| 6 | |||
| 7 | Comments are prefixed either with ``#``, or ``;``. | ||
| 8 | |||
| 9 | Some rules apply in a specific ``function`` (context) on a specific ``variable`` | ||
| 10 | (data), like ``disable_function``. Others can only be enabled/disabled, like | ||
| 11 | ``harden_random``. | ||
| 12 | |||
| 13 | |||
| 14 | .. warning:: | 4 | .. warning:: |
| 15 | 5 | ||
| 16 | If you configure Snuffleupagus incorrectly, your website *might* not work | 6 | If you configure Snuffleupagus incorrectly, your website *might* not work |
| @@ -21,17 +11,6 @@ Some rules apply in a specific ``function`` (context) on a specific ``variable`` | |||
| 21 | read the present documentation about how to configure them, | 11 | read the present documentation about how to configure them, |
| 22 | evaluate your threat model and write your configuration file accordingly. | 12 | evaluate your threat model and write your configuration file accordingly. |
| 23 | 13 | ||
| 24 | Most of the features can be used in ``simulation`` mode by appending the | ||
| 25 | ``.simulation()`` option to them (eg. ``sp.readonly_exec.simulation().enable();``) to see | ||
| 26 | whether or not they could break your website. The simulation mode won't block the request, | ||
| 27 | but will write a warning in the log. | ||
| 28 | |||
| 29 | The rules are evaluated in the order that they are written, the **first** one | ||
| 30 | to match will terminate the evaluation (except for rules in simulation mode). | ||
| 31 | |||
| 32 | Configuration file format | ||
| 33 | ------------------------- | ||
| 34 | |||
| 35 | Since PHP *ini-like* configuration model isn't flexible enough, | 14 | Since PHP *ini-like* configuration model isn't flexible enough, |
| 36 | Snuffleupagus is using its own format in the file specified by | 15 | Snuffleupagus is using its own format in the file specified by |
| 37 | the directive ``sp.configuration_file`` **in** your ``php.ini`` file, | 16 | the directive ``sp.configuration_file`` **in** your ``php.ini`` file, |
| @@ -61,6 +40,38 @@ your logs of course. We do **not** recommend to use it of course, but sometimes | |||
| 61 | it might be useful to be able to "debug in production" without breaking your | 40 | it might be useful to be able to "debug in production" without breaking your |
| 62 | website. | 41 | website. |
| 63 | 42 | ||
| 43 | Configuration file format | ||
| 44 | ------------------------- | ||
| 45 | |||
| 46 | Options are chainable by using dots (``.``). | ||
| 47 | |||
| 48 | Some options have a string parameter, that **must** be quoted with double quotes, e.g. ``"string"``. | ||
| 49 | |||
| 50 | Comments are prefixed either with ``#``, or ``;``. | ||
| 51 | |||
| 52 | Some rules apply in a specific ``function`` (context) on a specific ``variable`` | ||
| 53 | (data), like ``disable_function``. Others can only be enabled/disabled, like | ||
| 54 | ``harden_random``. | ||
| 55 | |||
| 56 | Most of the features can be used in ``simulation`` mode by appending the | ||
| 57 | ``.simulation()`` or ``.sim()`` option to them (eg. ``sp.readonly_exec.simulation().enable();``) to see | ||
| 58 | whether or not they could break your website. The simulation mode won't block the request, | ||
| 59 | but will write a warning in the log. | ||
| 60 | |||
| 61 | The rules are evaluated in the order that they are written, the **first** one | ||
| 62 | to match will terminate the evaluation (except for rules in simulation mode). | ||
| 63 | |||
| 64 | Rules can be split into lines and contain whitespace for easier readability and maintenance: (This feature is available since version 0.8.0.) | ||
| 65 | |||
| 66 | :: | ||
| 67 | |||
| 68 | sp.disable_function.function("mail") | ||
| 69 | .param("to").value_r("\\n") | ||
| 70 | .alias("newline in mail() To:") | ||
| 71 | .drop(); | ||
| 72 | |||
| 73 | The terminating ``;`` is optional for now, but it should be used for future compatibility. | ||
| 74 | |||
| 64 | Miscellaneous | 75 | Miscellaneous |
| 65 | ------------- | 76 | ------------- |
| 66 | 77 | ||
| @@ -380,7 +391,7 @@ It's currently not possible to: | |||
| 380 | `for now <https://github.com/jvoisin/snuffleupagus/issues/190>`__). | 391 | `for now <https://github.com/jvoisin/snuffleupagus/issues/190>`__). |
| 381 | This is why hooked ``print`` will be displayed as ``echo`` in the logs. | 392 | This is why hooked ``print`` will be displayed as ``echo`` in the logs. |
| 382 | - Hook `strlen`, since in latest PHP versions, this function is usually | 393 | - Hook `strlen`, since in latest PHP versions, this function is usually |
| 383 | optimized away by the compiled. | 394 | optimized away by the compiler. |
| 384 | 395 | ||
| 385 | 396 | ||
| 386 | Examples | 397 | Examples |
