snuffleupagus - Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!

Age	Commit message (Collapse)	Author
2017-10-13	Show some data in the phpinfo();	jvoisin

2017-10-13	Fix some pedantic warnings	jvoisin

2017-10-13	Add some debug to the harden-rand tests, just in case™	jvoisin

2017-10-13	Fix the size of the output vector in our usage of pcre	jvoisin

2017-10-12	Minor refactoring	jvoisin
	- use the `is_regexp_matching` function when possible - check parameters before passing it to `pcre_exec` - improve error messages wrt. regexp
2017-10-12	Fix minor gcc warnings with experimental options	jvoisin
	`CFLAGS='-Wnull-dereference -Wlogical-op -Wshadow -Wjump-misses-init' make clean coverage`
2017-10-11	Hopefully fix an unreproductible NULL-deref in regexp matching	jvoisin
	Reported by @fr33tux
2017-10-11	Add some more debug to the regexp thingy	jvoisin

2017-10-11	Cheat a bit with the coverage	jvoisin

2017-10-11	Cache checksum calculation for the current file	jvoisin
	Close #34
2017-10-11	s/disable_functions/disable_function/g	jvoisin
	This should close #36 and #30
2017-10-11	Add some info when a regexp fails	jvoisin

2017-10-10	.allow() is now working for require	jvoisin

2017-10-10	Bump coverage, and fix a segfault on trace matching	jvoisin

2017-10-10	Increase a bit the coverage	jvoisin

2017-10-10	Remove a useless ile for now	jvoisin
	This should close #31
2017-10-10	Make the `simulation` mode logs more obvious	jvoisin

2017-10-09	Better hooking of language constructs (#26)	jvoisin
	* Vastly improve the support of language construct hooking
2017-10-09	Implement matching on the calltrace (#17)	jvoisin
	* Implement matching on the calltrace
2017-10-05	Use clang on travis-ci (#23)	jvoisin

2017-10-05	Use PHP's entropy generation primitive, instead of a ghetto one (#24)	jvoisin

2017-10-03	Add a test for functions used in UPPERCASE	jvoisin

2017-10-02	Add a warning if the env var is NULL	jvoisin

2017-10-02	First pass for #9	jvoisin

2017-09-29	Fix two cookie encryption issues found by @cfreal, and a bonus one (#18)	jvoisin
	* Fix a cookie encryption issue found by @cfreal - Use the base64-decoded payload length to allocate memory to decrypt it, instead of allocating the length of the undecoded one. This has no security impact, since the base64-encoded string is at least as large as the decoded one. Since we're using AEAD, there is no way to leak memory, since this would make the decryption fail.
2017-09-26	Implement, test and document namespace support	jvoisin

2017-09-26	Simplify and improve the build system	jvoisin
	- CFLAGS are now set in the config.m4 file (and not in the Makefile anymore) - `make release` is added - `make debug` and `make coverage` are now simpler - hardening flags are added
2017-09-26	Merge pull request #8 from nbs-system/fix_local_xxe	blotus
	Fix XXE test when running without XML support
2017-09-25	Bump a bit the coverage	jvoisin

2017-09-25	Fix XXE test when running without XML support	jvoisin
	Apparently, using `echo` instead of `die` works better™
2017-09-25	Improve the travis file	jvoisin
	- if something is failing, display the guilty outputs. - Don't spam php's tracker - Failing tests are now triggering an `exit 1` - Fix a test to make it work on every php version (php changed the error message) - `make -j2` on travis
2017-09-25	Fix minor coverity issues	jvoisin

2017-09-25	Show the line number in case of processing error	jvoisin

2017-09-22	Improve a bit the .travis.yml file	jvoisin

2017-09-21	Add travis	jvoisin

2017-09-20	fix XFAIL test for include/require	Sebastien Blot

2017-09-20	Initial import	Sebastien Blot