From bbdf470f4e2d87d90c9ea11f4ce572e4416ffeab Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Sat, 25 Apr 2020 15:08:40 +0200
Subject: Add yet an other stupid things to the default set of rules

---
 config/default.rules | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'config/default.rules')

diff --git a/config/default.rules b/config/default.rules
index 1446fb8..9dfa68e 100644
--- a/config/default.rules
+++ b/config/default.rules
@@ -45,6 +45,9 @@ sp.disable_function.function("putenv").param("setting").value_r("LD_").drop()
 # This one was burned in Nov 2019 - https://gist.github.com/LoadLow/90b60bd5535d6c3927bb24d5f9955b80
 sp.disable_function.function("putenv").param("setting").value_r("GCONV_").drop()
 
+# Since people are stupid enough to use `extract` on things like $_GET or $_POST, we might as well mitigate this vector
+sp.disable_function.function("extract").param("array").value_r("^_").drop()
+
 # This is also burned:
 # ini_set('open_basedir','..');chdir('..');…;chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/etc/passwd'));
 # Since we have no way of matching on two parameters at the same time, we're
-- 
cgit v1.3