Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:37
📄 CONTRIBUTING.md ## Contributing First off, thank you for considering contributing to snuffleupagus. ### 1. Where do I go from here? If you've noticed a bug or have a question, look at the [faq](https://snuffleupagus.readthedocs.io/faq.html) and [search the issue tracker](https://github.com/jvoisin/snuffleupagus/issues) to see if someone else has already created a ticket. If not, go ahead and [make one](https://github.com/jvoisin/snuffleupagus/issues/new)! ### 2. Fork & create a branch If this is something you think you can fix, then [fork snuffleupagus](https://help.github.com/articles/fork-a-repo) and create a branch with a descriptive name. A good branch name would be (where issue #325 is the ticket you're working on): ```sh git checkout -b 325-kill-sql-injections ``` ### 3. Get the test suite running Just type `make coverage` or `make debug`, the testsuite should be run automatically. Please add tests if you're fixing a bug or adding a new feature: we do have a [high coverage](https://coveralls.io/github/jvoisin/snuffleupagus?branch=master) (functions, lines and branches), and intend to keep it that way. #### 3.3 Debugging failures in the test suite If your changes have introduced run-time failures in the test-suite, you can easily troubleshoot them by inspecting the files that [php has generated](https://qa.php.net/write-test.php#analyzing-failing-tests) for this purpose. A nice trick is to edit the `.sh` file to prepend `gdb --args` to it before launching it, in order to run the failing test inside GDB. ### 4. Did you find a bug? * Ensure the bug was not already reported by [searching all issues](https://github.com/jvoisin/snuffleupagus/issues?q=). * If you're unable to find an open issue addressing the problem, [open a new one](https://github.com/jvoisin/snuffleupagus/issues/new). Be sure to include a title and clear description, as much relevant information as possible, and a code sample or an executable test case demonstrating the expected behavior that is not occurring. ### 5. Get the style right Your patch should follow the same conventions & pass the same code quality checks as the rest of the project. We're using [clang-format](http://clang.llvm.org/docs/ClangFormat.html) to ensure a consistent code-style. Please run it with `clang-format --style="{BasedOnStyle: google, SortIncludes: false}"` before committing, or even better, use a [pre-commit hook](https://github.com/andrewseidl/githook-clang-format). ### 6. Make a Pull Request At this point, you should switch back to your master branch and make sure it's up to date with our upstream master branch: ```sh git remote add upstream git@github.com:jvoisin/snuffleupagus.git git checkout master git pull upstream master ``` Then update your feature branch from your local copy of master, and push it! ```sh git checkout 325-kill-sql-injections git rebase master git push --set-upstream origin 325-kill-sql-injections ``` Finally, go to GitHub and [make a Pull Request](https://help.github.com/articles/creating-a-pull-request) :D Travis CI will [run our test suite](https://travis-ci.org/jvoisin/snuffleupagus) against all supported PHP versions. We care about quality, so your PR won't be merged until all tests pass. It's unlikely, but it's possible that your changes pass tests in one PHP version but fail in another. In that case, you'll have to setup your development environment to use the problematic PHP version, and investigate what's going on! ### 7. Keeping your Pull Request updated If a maintainer asks you to "rebase" your PR, they're saying that a lot of code has changed, and that you need to update your branch so it's easier to merge. To learn more about rebasing in Git, there are a lot of [good](http://git-scm.com/book/en/Git-Branching-Rebasing) [resources](https://help.github.com/articles/interactive-rebase) but here's the suggested workflow: ```sh git checkout 325-kill-sql-injections git pull --rebase upstream master git push --force-with-lease 325-kill-sql-injections ``` ### 8. Merging a PR (maintainers only) A PR can only be merged into master by a maintainer if: 1. It is passing CI. 2. It has been approved by at least one maintainer. If it was a maintainer who opened the PR, only one extra approval is needed. 3. It has no requested changes. 4. It is up to date with current master. Any maintainer is allowed to merge a PR if all of these conditions are met. ### 9. Shipping a release (maintainers only) Maintainers need to do the following to push out a release: 1. Make sure that all pending and mergeable pull requests are in 2. Close the corresponding [milestone](https://github.com/jvoisin/snuffleupagus/milestones) 2. Run `valgrind` (by adding a `-m` after the `-q` in the Makefile) and check that everything is ok. Don't mind the python-related issues. 2. Run `cd src; phpize; ./configure --enable-snuffleupagus --enable-debug; scan-build make` and fix the possible issues. 3. Update the `src/php_snuffleupagus.h` according to [semantic versioning](https://semver.org/) 4. Update the changelog page in the documentation 5. Update the Debian changelog in `./debian/changelog` with `cd debian; dch` 6. Commit the result 7. Clean up the folder `make clean; git clean -xdf` 8. Create a tag for the release: ```sh git tag -s v$MAJOR.$MINOR.$PATCH -m "v$MAJOR.$MINOR.$PATCH" git push --tags git push origin master ``` 9. Wait for the CI on the new tag branch to finish 10. Create the [release on github](https://github.com/jvoisin/snuffleupagus/releases) 11. Add the freshly built Debian packages from the CI to the release 12. Do the secret release dance	5.54 KB	2024-09-06 12:34
📄 README.md <h1 align="center"> <br> <a href="https://snuffleupagus.readthedocs.io/"> <img src="https://github.com/jvoisin/snuffleupagus/raw/master/doc/source/_static/sp.png" alt="Snuffleupagus' logo" width="200"></a> <br> Snuffleupagus <br> </h1> <h4 align="center">Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!</h4> <p align="center"> <a href="https://github.com/jvoisin/snuffleupagus/actions/workflows/distributions_php7.yml"> <img src="https://github.com/jvoisin/snuffleupagus/actions/workflows/distributions_php7.yml/badge.svg" alt="Testing PHP7 on various Linux distributions" /> </a> <a href="https://github.com/jvoisin/snuffleupagus/actions/workflows/distributions_php8.yml"> <img src="https://github.com/jvoisin/snuffleupagus/actions/workflows/distributions_php8.yml/badge.svg" alt="Testing PHP8 on various Linux distributions" /> </a> <a href="https://scan.coverity.com/projects/jvoisin-snuffleupagus"> <img src="https://scan.coverity.com/projects/13821/badge.svg?flat=1" alt="Coverity"> </a> <a href="https://bestpractices.coreinfrastructure.org/projects/1267"> <img src="https://bestpractices.coreinfrastructure.org/projects/1267/badge" alt="CII Best Practises"> </a> <a href="http://snuffleupagus.readthedocs.io/?badge=latest"> <img src="https://readthedocs.org/projects/snuffleupagus/badge/?version=latest" alt="readthedocs.org"> </a> <a href="https://coveralls.io/github/jvoisin/snuffleupagus?branch=master"> <img src="https://coveralls.io/repos/github/jvoisin/snuffleupagus/badge.svg?branch=master" alt="coveralls"> </a> <a href="https://twitter.com/dustriorg"> <img src="https://img.shields.io/badge/twitter-follow-blue.svg" alt="twitter"> </a> <a href="https://repology.org/project/php:snuffleupagus/versions"> <img src="https://repology.org/badge/tiny-repos/php:snuffleupagus.svg" alt="Packaging status"> </a> <a href="https://github.com/jvoisin/snuffleupagus"> <img src="https://github.com/jvoisin/snuffleupagus/actions/workflows/codeql-analysis.yml/badge.svg" alt="CodeQL"> </a> </p> <p align="center"> <a href="#key-features">Key Features</a> • <a href="#download">Download</a> • <a href="#examples">Examples</a> • <a href="https://snuffleupagus.readthedocs.io/">Documentation</a> • <a href="https://github.com/jvoisin/snuffleupagus/blob/master/LICENSE">License</a> • <a href="#thanks">Thanks</a> </p> Snuffleupagus is a [PHP 7+ and 8+](https://secure.php.net/) module designed to drastically raise the cost of attacks against websites, by killing entire bug classes. It also provides a powerful virtual-patching system, allowing administrator to fix specific vulnerabilities and audit suspicious behaviours without having to touch the PHP code. ## Key Features * No [noticeable performance impact](https://dustri.org/b/snuffleupagus-030-dentalium-elephantinum.html) * Powerful yet simple to write virtual-patching rules * Killing several classes of vulnerabilities * [Unserialize-based](https://www.owasp.org/images/9/9e/Utilizing-Code-Reuse-Or-Return-Oriented-Programming-In-PHP-Application-Exploits.pdf) code execution * [`mail`-based]( https://blog.ripstech.com/2016/roundcube-command-execution-via-email/ ) code execution * Cookie-stealing [XSS]( https://en.wikipedia.org/wiki/Cross-site_scripting ) * File-upload based code execution * Weak PRNG * [XXE]( https://en.wikipedia.org/wiki/XML_external_entity_attack ) * Filter based remote code execution and assorted shenanigans * Several hardening features * Automatic `secure` and `samesite` flag for cookies * Bundled set of rules to detect post-compromissions behaviours * Global [strict mode]( https://secure.php.net/manual/en/migration70.new-features.php#migration70.new-features.scalar-type-declarations) and type-juggling prevention * Whitelisting of [stream wrappers](https://secure.php.net/manual/en/intro.stream.php) * Preventing writeable files execution * Whitelist/blacklist for `eval` * Enforcing TLS certificate validation when using [curl](https://secure.php.net/manual/en/book.curl.php) * Request dumping capability * A relatively sane code base: * A [comprehensive](https://coveralls.io/github/jvoisin/snuffleupagus?branch=master) test suite close to 100% coverage * Every commit is tested on [several distributions](https://gitlab.com/jvoisin/snuffleupagus/pipelines) * An `clang-format`-enforced code style * A [comprehensive documentation](https://snuffleupagus.rtfd.io) * Usage of [coverity](https://scan.coverity.com/projects/jvoisin-snuffleupagus), codeql, [scan-build](https://clang-analyzer.llvm.org/scan-build.html), … ## Download We've got a [download page](https://snuffleupagus.readthedocs.io/download.html), where you can find packages for your distribution, but you can of course just `git clone` this repo, or check the releases on [github](https://github.com/jvoisin/snuffleupagus/releases). ## Examples We're providing [various example rules](https://github.com/jvoisin/snuffleupagus/tree/master/config), that are looking like this: ```python # Harden the `chmod` function sp.disable_function.function("chmod").param("mode").value_r("^[0-9]{2}[67]$").drop(); # Mitigate command injection in `system` sp.disable_function.function("system").param("command").value_r("[$\|;&`\\n]").drop(); ``` Upon violation of a rule, you should see lines like this in your logs: ```python [snuffleupagus][0.0.0.0][disabled_function][drop] The execution has been aborted in /var/www/index.php:2, because the return value (0) of the function 'strpos' matched a rule. ``` ## Documentation We've got a [comprehensive website](https://snuffleupagus.readthedocs.io/) with all the documentation that you could possibly wish for. You can of course [build it yourself](https://github.com/jvoisin/snuffleupagus/tree/master/doc). ## Thanks Many thanks to: - The [Suhosin project](https://suhosin.org) for being a __huge__ source of inspiration - [NBS System](https://www.nbs-system.com) for initially sponsoring the development - [Suhosin-ng](https://github.com/sektioneins/suhosin-ng) for their [experimentations](https://github.com/sektioneins/suhosin-ng/wiki/News) and [contributions](https://github.com/jvoisin/snuffleupagus/commits?author=bef), as well as [NLNet](https://nlnet.nl/project/Suhosin-NG/) for sponsoring it - All [our contributors](https://github.com/jvoisin/snuffleupagus/graphs/contributors)	6.43 KB	2024-09-06 12:34

Terminal