summaryrefslogtreecommitdiff
path: root/src (follow)
AgeCommit message (Collapse)Author
2018-07-18Bump the changelogv0.3.0kka
2018-07-18Remove an useless check in session handlingkka
2018-07-16Yet an other clang-format passjvoisin
2018-07-13Yet an other pass of clang-formatjvoisin
2018-07-13Fix an invalid readxXx-caillou-xXx
2018-07-13Skip VLD for php7.3, as VLD is not compatible yet.xXx-caillou-xXx
2018-07-13Reduce call to get_complete_function_pathxXx-caillou-xXx
2018-07-13Fix various possible integer overflowsxXx-caillou-xXx
2018-07-13Fix hooking on `print`xXx-caillou-xXx
2018-07-13Allow rules matching on echo and printxXx-caillou-xXx
2018-07-13Massively optimize how rules are handledxXx-caillou-xXx
This commit does a lot of things: - Use hashtables instead of lists to store the rules - Rules that can be applied at launch time won't be tried at runtime - Improve feedback when writing nonsensical rules - Make intensive use of `zend_string` instead of `char*`
2018-07-10Fix #183 (#185)Remi Collet
* relax test to pass with 7.3 * skip test with 7.3 as samesite is broken + add TODO
2018-07-09Trying to fix sloppy comparison (#186)jvoisin
* Trying to fix sloppy comparison https://github.com/nbs-system/snuffleupagus/issues/10 by modifying php's opcode
2018-06-28Better handling of filters for builtinskkadosh
2018-05-29Support session encryptionkkadosh
Implement session encryption.
2018-05-16Don't run some tests on `-dev` php versionsjvoisin
2018-05-16Improve the testsuite's robustness against php7.2jvoisin
2018-05-15Refactor the encryption process to extract encrypt/decrypt functions (#176)kkadosh
Refactor the encryption process to extract encrypt/decrypt functions
2018-05-03Uniformise some logssimon MAGNIN-FEYSOT
This commit will make certain logs easier to parse.
2018-03-19The filename filter is now matching on callsite instead of implemsite (#167)kkadosh
* Add match on the file where the function is called * Add the test * Constify some params * Fix potentiel null deref * Return more before if execute_data is NULL
2018-03-19Add a failing test for callback function as parameterkkadosh
2018-03-19Increase random number max for testkka
2018-03-15Change a test to expected failedkkadosh
Apparently, we're not supporting hooking on `ret` for user-defined functions.
2018-03-14Bump a bit the coveragejvoisin
2018-03-12Bump the changelogv0.2.2jvoisin
2018-03-09Add an unit test for an edge-casejvoisin
2018-03-08Make travis happy.jvoisin
2018-03-08Minor code simplificationjvoisin
2018-03-08Remove some duplicate codejvoisin
2018-03-08Marginally improve the performances when dealing with evaljvoisin
2018-03-06Bump a bit the coveragejvoisin
2018-03-06Fix a variadic-functions-related crashjvoisin
Currently, we're not supporting virtual-patching on variadic functions. The commit makes it clear, and fix the related crash. This should close #157
2018-03-05Improve performances by a significant factorjvoisin
Only check if a function should be disabled when we're after a `*CALL` opcode, end not on every single opcode. Based on @blotus ideas ♥
2018-03-05Improve a bit the performances (+10%)jvoisin
2018-03-02Add .dump() for eval whitelist/blacklist + simulation mode for whitelistkkadosh
2018-03-02Implement dump() for execution of writable PHP fileskkadosh
2018-03-02Fix a warning due to an unexported symboljvoisin
2018-03-02Add some rules for Typo3, courtesy of @kjojojvoisin
2018-02-27Implements .dump() for unserialize and fix some related testskkadosh
2018-02-27Improve the Readme filejvoisin
2018-02-22php-nightly is now allowed to failjvoisin
PHP is breaking too many things on nightly, we'll only support releases from now on. This should also make our vld-based file-upload checker more resilient: no more random warnings on stderr.
2018-02-22Refactor a bit our rulesjvoisin
2018-02-12Provide a script for upload validationjvoisin
The Python script is using vld (https://derickrethans.nl/projects.html#vld) to check for malicious opcodes.
2018-02-09Add a broken test :'(jvoisin
2018-02-07Add an example rule from the rips calendar for abantecart's XSSkjojo
2018-02-07Use assertions for things that should never happenjvoisin
2018-02-07Bump the changelogv0.2.1jvoisin
2018-02-06Increase a bit the coveragejvoisin
2018-02-06Add a test to make sure that arrays are correctly handledjvoisin
2018-02-06Make our API consistentjvoisin