summaryrefslogtreecommitdiff
path: root/src/sp_config_keywords.c (follow)
AgeCommit message (Collapse)Author
2026-02-22Constify function pointer tablesChristian Göttsche
2026-02-22Use correct parser for session ID lengthsChristian Göttsche
Can causes issues on uncommon architectures, like s390x.
2025-10-24feat(log): add the possibility to log to a filelog2filejvoisin
2025-10-02Rename a handful of global constantsjvoisin
2025-05-13Remove the useless show_old_php_warning featurejvoisin
People are usually well-aware of the outdatedness of the PHP version they're running, which is likely why they're running Snuffleupagus in the first place. This feature shouldn't have been enabled by default, and I fail to see any case where anyone would want to enable it. Moreover, it doesn't take LTS versions from vendors/distributions into account, thus breaking on RHEL/Debian (old)stable.
2024-06-18Fix an UBSAN warningjvoisin
No need to use an ulong, an uint is more than enough for our usecases. This fixes the following warning: ``` src/sp_config.c:207:20: runtime error: store to misaligned address 0x796d1f9a78d4 for type 'u_long', which requires 8 byte alignment 0x796d1f9a78d4: note: pointer points here 00 00 00 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ #0 0x796d1f92251a in parse_ulong src/sp_config.c:207 #1 0x796d1f9239a9 in sp_process_rule src/sp_config.c:76 #2 0x796d1f92404f in sp_process_config_root src/sp_config.c:31 #3 0x796d1f96770d in sp_config_scan src/sp_config_scanner.c:1482 #4 0x796d1f922cd3 in sp_parse_config src/sp_config.c:62 #5 0x796d1f91e6cf in OnUpdateConfiguration src/snuffleupagus.c:522 #6 0x598aae727646 in zend_register_ini_entries_ex (/usr/bin/php8.2+0x36d646) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #7 0x796d1f91cae1 in zm_startup_snuffleupagus src/snuffleupagus.c:121 #8 0x598aae6b70df in zend_startup_module_ex (/usr/bin/php8.2+0x2fd0df) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #9 0x598aae6b717f (/usr/bin/php8.2+0x2fd17f) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #10 0x598aae6c566a in zend_hash_apply (/usr/bin/php8.2+0x30b66a) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #11 0x598aae64c0b5 in php_module_startup (/usr/bin/php8.2+0x2920b5) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #12 0x598aae4e2265 (/usr/bin/php8.2+0x128265) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #13 0x796d21b4dc89 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #14 0x796d21b4dd44 in __libc_start_main_impl ../csu/libc-start.c:360 #15 0x598aae4e3550 in _start (/usr/bin/php8.2+0x129550) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/sp_config.c:207:20 in ```
2024-06-09Add option to specify the allowed "php" wrapper typesChristian Göttsche
In addition of the current possibility to filter wrappers by their protocol name, also add the option to filter the "php" wrapper by the requested kind. Especially the 'filter' backend can be disabled that way.
2024-06-06Reorder calloc(3) argumentsChristian Göttsche
Please GCC: In file included from /usr/include/php/20220829/Zend/zend.h:30, from /usr/include/php/20220829/main/php.h:31, from /usr/include/php/20220829/main/SAPI.h:20, from src/php_snuffleupagus.h:37, from src/sp_ifilter.c:1: src/sp_pcre_compat.h: In function 'sp_regexp_compile': src/sp_pcre_compat.h:38:36: warning: '__zend_calloc' sizes specified with 'sizeof' in the earlier argument and not in the later argument [-Wcalloc-transposed-args] 38 | sp_regexp *ret = pecalloc(sizeof(sp_regexp), 1, 1); | ^~~~~~~~~ /usr/include/php/20220829/Zend/zend_alloc.h:199:72: note: in definition of macro 'pecalloc' 199 | #define pecalloc(nmemb, size, persistent) ((persistent)?__zend_calloc((nmemb), (size)):ecalloc((nmemb), (size))) | ^~~~~ src/sp_pcre_compat.h:38:36: note: earlier argument should specify number of elements, later size of each element 38 | sp_regexp *ret = pecalloc(sizeof(sp_regexp), 1, 1); | ^~~~~~~~~ /usr/include/php/20220829/Zend/zend_alloc.h:199:72: note: in definition of macro 'pecalloc' 199 | #define pecalloc(nmemb, size, persistent) ((persistent)?__zend_calloc((nmemb), (size)):ecalloc((nmemb), (size))) | ^~~~~
2023-12-07make 'phar' filenames work in sp.disabled_functions, fixes #472brown-midas
2023-01-31Add sp.log_max_lenjvoisin
2022-12-08Add unserialize_noclassjvoisin
2022-07-20Merge branch 'master' into pr1BeF
2022-07-20fixed cookie config parsing with same cookie name (update instead of ignore)Ben Fuhrmannek
2022-07-20fixed mem leak while parsing cookie configBen Fuhrmannek
2022-07-18Remove a superfluous conditionjvoisin
2022-07-18added config error for ini rules with identical keyBen Fuhrmannek
2022-07-12extended checks for readonly_exec, enabled by defaultBen Fuhrmannek
introduced config options: readonly_exec.extended_checks() or xchecks() readonly_exec.no_extended_checks() or noxchecks()
2022-04-19extended checks for readonly_exec, enabled by defaultBen Fuhrmannek
introduced config options: readonly_exec.extended_checks() or xchecks() readonly_exec.no_extended_checks() or noxchecks()
2022-03-20Fix compilation on PHP<7.2jvoisin
2022-03-20Merge remote-tracking branch 'sektioneins/master'jvoisin
2022-03-20stricter config checksBen Fuhrmannek
2022-01-12make session support a runtime check instead of compile timeBen Fuhrmannek
2021-12-20removed upload script x-bit check at load time, thus allowing root-user to ↵Ben Fuhrmannek
execute test cases
2021-11-19added old php version checkBen Fuhrmannek
2021-11-11detect dummy or short encryption keyBen Fuhrmannek
2021-09-23config is stack allocated now + some code improvements (see details)Ben Fuhrmannek
* for easier memory manegement, the entire sp_config struct was merged into snuffleupagus_globals and allocated on stack where possible * SNUFFLEUPAGUS_G() can be written as SPG(), which is faster to type and easier to read * execution_depth is re-initialized to 0 for each request * function calls with inline string and length parameters consistently use ZEND_STRL instead of sizeof()-1 * execution is actually hooked if recursion protection is enabled * some line breaks were removed to make the code more readable
2021-09-16ported sid min/max restriction from suhosinBen Fuhrmannek
2021-09-16ported server.strip and server.encode features from suhosinBen Fuhrmannek
2021-09-15implemented execution depth limitBen Fuhrmannek
2021-09-02fixed compiler warnings + test casesBen Fuhrmannek
2021-08-17removed unused variablesBen Fuhrmannek
2021-08-16fincy new scanner/parser for config rules + fixed a few bugs along the way + ↵Ben Fuhrmannek
fixed related unittests
2021-08-10prevent option to be enabled and then disabledBen Fuhrmannek
2021-08-08fixed enable/disable logicBen Fuhrmannek
2021-08-07more ini protection featuresBen Fuhrmannek
2021-08-06implemented ini settings protectionBen Fuhrmannek
2021-08-03fixed mem leak in parse_disabled_functionsBen Fuhrmannek
2020-11-12Invalid configurations with mutually exclusive keywords now abortsjvoisin
2020-11-12Harmonize a bit the configuration parsing and fix a typojvoisin
2020-06-15Merge remote-tracking branch 'upstream/master'Ben Fuhrmannek
2020-06-15stricter config checksBen Fuhrmannek
2020-03-04%s/nbs-system/jvoisinjvoisin
Since I'm the only one to maintain Snuffleupagus, let's adjust the links and contact addresses of my fork, to point to well… my fork.
2019-08-31Support direct syslog loggingThibault "bui" Koechlin
Add the possibility to log directly into the syslog, instead of using php's log system.
2019-06-20Fix snufflepagus_globals linking issues and one mac compatibility issuebef
2019-06-19fix snufflepagus_globals linking issues and one mac compatibility issueBen Fuhrmannek
2019-02-23Try to unify the includesjvoisin
2019-02-23Add php8 to travis and fix php7.4jvoisin
- Use clang-format on the code - Improve portability wrt. php8 - Fix php7.4 compatibility. See https://dustri.org/b/fixing-snuffleupagus-sloppy-comparison-on-array_keys-for-php74.html for a detailed writeup
2019-01-12Fix missing symbol when there is no session supportjvoisin
It's possible to build PHP with sessions as a module, or even without sessions at all. This commit make it possible to use Snuffleupagus on those platforms.
2018-10-06Bump a bit the coveragejvoisin
* `setcookie` doesn't always return `true` anymore * clang-format * Cookies with invalid decryption are dropped, but the request isn't anymore * faulty unserialize are now dumpable
2018-08-30Minor code cleanupxXx-caillou-xXx