| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2018-03-09 | Add an unit test for an edge-case | jvoisin | |
| 2018-03-06 | Bump a bit the coverage | jvoisin | |
| 2018-03-06 | Fix a variadic-functions-related crash | jvoisin | |
| Currently, we're not supporting virtual-patching on variadic functions. The commit makes it clear, and fix the related crash. This should close #157 | |||
| 2018-03-02 | Add .dump() for eval whitelist/blacklist + simulation mode for whitelist | kkadosh | |
| 2018-03-02 | Implement dump() for execution of writable PHP files | kkadosh | |
| 2018-03-02 | Add some rules for Typo3, courtesy of @kjojo | jvoisin | |
| 2018-02-27 | Implements .dump() for unserialize and fix some related tests | kkadosh | |
| 2018-02-22 | php-nightly is now allowed to fail | jvoisin | |
| PHP is breaking too many things on nightly, we'll only support releases from now on. This should also make our vld-based file-upload checker more resilient: no more random warnings on stderr. | |||
| 2018-02-22 | Refactor a bit our rules | jvoisin | |
| 2018-02-12 | Provide a script for upload validation | jvoisin | |
| The Python script is using vld (https://derickrethans.nl/projects.html#vld) to check for malicious opcodes. | |||
| 2018-02-09 | Add a broken test :'( | jvoisin | |
| 2018-02-07 | Add an example rule from the rips calendar for abantecart's XSS | kjojo | |
| 2018-02-06 | Increase a bit the coverage | jvoisin | |
| 2018-02-06 | Add a test to make sure that arrays are correctly handled | jvoisin | |
| 2018-02-06 | Add a test to check regexps | jvoisin | |
| 2018-02-05 | Massive simplification of functions hooking | jvoisin | |
| 2018-02-05 | Compatibility layer for pcre2 | jvoisin | |
| This should close #129 | |||
| 2018-01-26 | Fix a segfault in `get_local_var` (#138) | Thibault "bui" Koechlin | |
| This commit fixes a segfault where 'get_local_var' would fail if no functions where called yet (`symtable` will be NULL) | |||
| 2018-01-19 | The testsuite is now successfully running under the root user | jvoisin | |
| This closes #131 | |||
| 2018-01-18 | Remove src from patch | Remi Collet | |
| As in pr #126 | |||
| 2018-01-18 | Add globbing support for configuration file path (closes #125) | Sebastien Blot | |
| 2018-01-18 | Improve the way we're dealing with filtering on parameter positions | jvoisin | |
| This should close #127 | |||
| 2018-01-17 | Bump a bit the coverage | jvoisin | |
| 2018-01-17 | remove src from path (#126) | Remi Collet | |
| 2018-01-17 | Bump a bit our coverage | jvoisin | |
| 2018-01-17 | Our configuration files are ending in .rules, not .ini | jvoisin | |
| This commit fixes the documentation, our shipped configuration files, and the related tests. Thanks to @remicollet for the tip | |||
| 2018-01-12 | Add an ugly hack to our parser to make the writing of configuration rules ↵ | jvoisin | |
| more obvious. | |||
| 2018-01-10 | Rework the priority of bl/wl in eval | jvoisin | |
| 2018-01-10 | Eval whitelist | jvoisin | |
| Implement whitelist in eval | |||
| 2018-01-08 | Add a test to see what happens when no configuration file is given | jvoisin | |
| 2018-01-06 | Ignore a test when running the testsuite as root | jvoisin | |
| 2018-01-05 | Fix a bypass in our eval blacklist | jvoisin | |
| 2018-01-04 | Eval blacklist | jvoisin | |
| Add support for eval filtering, only blacklist for now | |||
| 2018-01-04 | Bump a bit the coverage | jvoisin | |
| 2018-01-03 | Handle correctly configuration files with Windows EOL | jvoisin | |
| Thanks to @fr33tux for the bug report ♥ | |||
| 2018-01-02 | Remove some useless code in the testsuite | jvoisin | |
| 2017-12-29 | Fix two broken tests | jvoisin | |
| 2017-12-28 | Add two test to prove that we're not prone to old-school bypasses | jvoisin | |
| 2017-12-28 | Show in the phpinfo() is the config is valid | jvoisin | |
| This should close #39 | |||
| 2017-12-28 | Fix a non-working test | jvoisin | |
| 2017-12-28 | Bump a bit the coverage | jvoisin | |
| 2017-12-28 | Implement regexp support for cookies encryption | Thibault "bui" Koechlin | |
| It's now possible to encrypt cookies matching a specific regexp. This should close #106 | |||
| 2017-12-28 | Add two tests to verify that we can hook indirect calls | jvoisin | |
| This should close #104 | |||
| 2017-12-28 | Implement hooking on user-defined functions return values | jvoisin | |
| This should close #99, thanks to @blotus for the implementation idea! | |||
| 2017-12-27 | Implement simulation mode for cookies (de/en)cryption | jvoisin | |
| This should close #102 This commit can be useful for two use-cases: 1. When deploying Snuffleupagus on big CMS like Magento, and not knowing what cookies are modified via javascript. 2. When deploying Snuffleupagus on big websites: you don't want to disconnect every single user at once. When simulation is enabled, if the decryption fails, a log message is now issued, and the cookie value taken as it (since odds are that it's non-encrypted). | |||
| 2017-12-21 | Add coverage | slefevre | |
| 2017-12-21 | Add test | slefevre | |
| 2017-12-21 | Remove the now useless `validate_str` function | xXx-caillou-xXx | |
| 2017-12-21 | Add test | slefevre | |
| 2017-12-21 | Add some tests (#96) | xXx-caillou-xXx | |
 |
index : snuffleupagus | |
| Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! |
| summaryrefslogtreecommitdiff |