summaryrefslogtreecommitdiff
path: root/src (follow)
AgeCommit message (Collapse)Author
2019-01-16Fix a compilation warningjvoisin
2019-01-14Reorganize the testsuitejvoisin
Splitting the testsuite in several components makes it easier to manage and comprehend. This was also needed some some tests aren't passing on Alpine Linux, but we still want to run as many of them as we can on this platform.
2019-01-12Fix missing symbol when there is no session supportjvoisin
It's possible to build PHP with sessions as a module, or even without sessions at all. This commit make it possible to use Snuffleupagus on those platforms.
2019-01-12Make compilation stop gracefully in the absence of PCREjvoisin
2019-01-03Add a gitlab-ci file, and a fix test on Fedorajvoisin
2019-01-01Fix a harmless-but-invalid zend_string_releasejvoisin
2018-12-26Document that it's not possible to hook builtins via regexpjvoisin
Also bump a bit the coverage
2018-12-26Add two eval-related testsjvoisin
2018-12-26Fix the build for php7.0jvoisin
We only want to prevent crash/infinite recursion, we don't really care about the error/warning messages.
2018-12-26Fix the build for php7.0 and php7.1jvoisin
2018-12-26Bump a bit the coveragejvoisin
2018-12-26Add a PHP5 guardjvoisin
2018-12-26Remove an unnecessary guard against infinite recursion in session handlingjvoisin
This used to be useful in the times of PHP5.4/Suhosin (https://github.com/sektioneins/suhosin/issues/60), but nowadays, php is handling this case on its own.
2018-12-26Make the testsuite a bit more portablejvoisin
2018-12-21bump the changelogv0.4.1kka
2018-12-15Provide a php script, to get rid of the python one for test suiteRemi Collet
This commit adds a php version of the upload_validation.py script.
2018-12-15Improve simulation mode for session cookies (#259)jvoisin
Since decrypt_zval doesn't provide a way to tell apart failed and successful decryption when used in simulation mode, we'll have to restore the original value if something goes wrong, because crypto_secretbox_open might modify the value.
2018-11-18Minor code clarificationjvoisin
2018-10-25Minor formatting issuejvoisin
2018-10-25Snuffleupagus should now compile on Windowsjvoisin
2018-10-09Bump againjvoisin
2018-10-09Bump coveragejvoisin
2018-10-09Bump the coverage a bitjvoisin
2018-10-09Remove 3 useless linesjvoisin
2018-10-09Don't check the return values of functions that might not return (#255)jvoisin
This is due to our modifications to the logging system
2018-10-09Improve mb_string hooking logicjvoisin
2018-10-08Add a testjvoisin
2018-10-06Add a missing opcode in sp_execute_exjvoisin
2018-10-06Coverage++jvoisin
2018-10-06Bump coverage againjvoisin
2018-10-06Bump coverage againjvoisin
2018-10-06Fix the silly mistake for goodjvoisin
2018-10-06Fix a silly mistakejvoisin
2018-10-06Add a testjvoisin
2018-10-06Bump a bit the coveragejvoisin
* `setcookie` doesn't always return `true` anymore * clang-format * Cookies with invalid decryption are dropped, but the request isn't anymore * faulty unserialize are now dumpable
2018-10-06Remove sp_terminate and bump a bit the coveragejvoisin
2018-10-05Fix segfault array keyskkadosh
Many thanks to @xXx-caillou-xXx for finding the true root cause and fixing the issue ♥
2018-09-10Minor code simplificationjvoisin
2018-09-10Improve a bit the coveragejvoisin
2018-09-10Bump the coveragejvoisin
2018-09-03Add a const attribute, added in 7.3Remi Collet
2018-09-03Fix #241 segfault on 32-bit related to bad protype (#242)Remi Collet
This should close #241
2018-09-01Use php full pathRemi Collet
Use the PHP_BINARY constant instead of "php".
2018-08-31Bump the changelogv0.4.0jvoisin
2018-08-30Minor code cleanupxXx-caillou-xXx
2018-08-30Change how we're handling invalid configurationsxXx-caillou-xXx
Since our configuration format is a bit more complex than php's one, we have a `sp.allow_broken_configuration` parameter (`false` by default), that you can set to `true` if you want PHP to carry on if your Snuffleupagus' configuration contains syntax errors. You'll still get a big scary message in your logs of course. We do **not** recommend to use it of course, but sometimes it might be useful to be able to "debug in production" without breaking your website.
2018-08-30Match on ret improvementsxXx-caillou-xXx
This commit does two things: - Implement matching on calltraces for ret - Implement matching on ret of user functions if the return value is not used.
2018-08-29Change how we're validating certificatesxXx-caillou-xXx
2018-08-29Remove the GLOB_BRACE flagAntoine Tenart
When calling glob() to get the configuration file location, the GLOB_BRACE flag is used. This flag enables the parsing of '{a,b}', so that '/path/{a,b}' represents '/path/a' and '/path/b'. Looking at Snuffleupagus' documentation I saw nowhere this kind of path was supported. Instead the documentation shows that glob() is used for paths with wildcards. The use of GLOB_BRACE is problematic as it is glibc specific and is not supported by some other C libraries, such as Musl. Snuffleupagus cannot be used in Apline for this reason. Since the documentation does not give a valid usage of GLOB_BRACE this patch removes it, which fixes the non-glibc support. Signed-off-by: Antoine Tenart <antoine.tenart@ack.tf>
2018-08-29Verify certs (#223)jvoisin
Ensure that certificates are verified in curl should close #47