snuffleupagus - Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!

Age	Commit message (Collapse)	Author
2017-10-13	Add some debug to the harden-rand tests, just in case™	jvoisin

2017-10-13	Fix the size of the output vector in our usage of pcre	jvoisin

2017-10-12	Minor refactoring	jvoisin
	- use the `is_regexp_matching` function when possible - check parameters before passing it to `pcre_exec` - improve error messages wrt. regexp
2017-10-12	Add `curl_multi_exec` to the magic php script	jvoisin

2017-10-12	Add a missing function to the generator script	jvoisin

2017-10-12	Fix minor gcc warnings with experimental options	jvoisin
	`CFLAGS='-Wnull-dereference -Wlogical-op -Wshadow -Wjump-misses-init' make clean coverage`
2017-10-11	Hopefully fix an unreproductible NULL-deref in regexp matching	jvoisin
	Reported by @fr33tux
2017-10-11	Add some more debug to the regexp thingy	jvoisin

2017-10-11	Cheat a bit with the coverage	jvoisin

2017-10-11	Cache checksum calculation for the current file	jvoisin
	Close #34
2017-10-11	s/disable_functions/disable_function/g	jvoisin
	This should close #36 and #30
2017-10-11	Add some info when a regexp fails	jvoisin

2017-10-10	Improve the layout of the related vulns in the documentation	jvoisin

2017-10-10	.allow() is now working for require	jvoisin

2017-10-10	Bump coverage, and fix a segfault on trace matching	jvoisin

2017-10-10	Increase a bit the coverage	jvoisin

2017-10-10	Remove a useless ile for now	jvoisin
	This should close #31
2017-10-10	Make the `simulation` mode logs more obvious	jvoisin

2017-10-10	Add a link to a new article, and fix a warn in the doc	jvoisin

2017-10-10	Fix a few typos in the documentation	jvoisin
	Courtesy of @watw00t
2017-10-09	Better hooking of language constructs (#26)	jvoisin
	* Vastly improve the support of language construct hooking
2017-10-09	Implement matching on the calltrace (#17)	jvoisin
	* Implement matching on the calltrace
2017-10-08	Improve a bit the script to generate rules	jvoisin

2017-10-08	Add some missing stuff in the `thanks` section	jvoisin

2017-10-08	Grammar/Punctuation changes (#29)	Connor Carr

2017-10-05	Fix the engrish of the readme	jvoisin

2017-10-05	Use clang on travis-ci (#23)	jvoisin

2017-10-05	Use PHP's entropy generation primitive, instead of a ghetto one (#24)	jvoisin

2017-10-04	Fix some engrish, courtesy of @integrity_	jvoisin

2017-10-03	Add a test for functions used in UPPERCASE	jvoisin

2017-10-02	Add a favicon!	jvoisin

2017-10-02	Add a bla about compilation requirements (courtesy of @he2ss)	jvoisin

2017-10-02	Merge pull request #19 from nbs-system/9-cookies-encryption-env-var	blotus
	Allow to chose the environment variable to derive the cookie encryption key from.
2017-10-02	Add a bla about HHVM	jvoisin

2017-10-02	Add a warning if the env var is NULL	jvoisin

2017-10-02	Update the documentation accordingly	jvoisin

2017-10-02	First pass for #9	jvoisin

2017-10-01	Fix some typos (courtesy of @sabban) and mention tests in the ↵	jvoisin
	CONTRIBUTING.md file
2017-09-29	Fix two cookie encryption issues found by @cfreal, and a bonus one (#18)	jvoisin
	* Fix a cookie encryption issue found by @cfreal - Use the base64-decoded payload length to allocate memory to decrypt it, instead of allocating the length of the undecoded one. This has no security impact, since the base64-encoded string is at least as large as the decoded one. Since we're using AEAD, there is no way to leak memory, since this would make the decryption fail.
2017-09-28	Mention our beerbounty program	jvoisin

2017-09-28	Improve the documentation wrt. installation	jvoisin
	Thanks to @real for finding this.
2017-09-28	Fix some typos in the documentation spotted by some people on reddit ♥	jvoisin

2017-09-27	Sort the help	jvoisin

2017-09-27	Add some auto-documentation to the makefile	jvoisin

2017-09-26	Update a bit the configuration	jvoisin

2017-09-26	Implement, test and document namespace support	jvoisin

2017-09-26	Simplify and improve the build system	jvoisin
	- CFLAGS are now set in the config.m4 file (and not in the Makefile anymore) - `make release` is added - `make debug` and `make coverage` are now simpler - hardening flags are added
2017-09-26	Fix a broken RsT link	jvoisin

2017-09-26	Add a security contact	jvoisin

2017-09-26	Run the joomla testsuite as a simple benchmark	jvoisin
	The joomla testsuite is now run on travis automatically, with and without snuffleupagus, to give us a rough overview of the performance impact of snuffleupagus on real™ code.