Tso tawm Snuffleupagus 0.5.1, ib qho module rau thaiv qhov tsis zoo hauv PHP daim ntawv thov

Tom qab ib xyoos ntawm kev loj hlob luam tawm qhov project tso tawm Snuffleupagus 0.5.1, uas muab ib qho qauv rau PHP7 tus neeg txhais lus los txhim kho kev ruaj ntseg ntawm ib puag ncig thiab thaiv cov kev ua yuam kev uas ua rau muaj qhov tsis zoo hauv kev siv PHP. Lub module kuj tso cai rau koj los tsim virtual thaj ua rau thaj tshem tawm cov teeb meem tshwj xeeb yam tsis tau hloov pauv qhov chaws ntawm daim ntawv thov tsis zoo, uas yooj yim rau siv hauv huab hwm coj hosting systems uas nws tsis tuaj yeem khaws txhua tus neeg siv cov ntawv thov mus txog hnub. Tus nqi nyiaj siv ua haujlwm ntawm lub module yog kwv yees tsawg kawg nkaus. Lub module yog sau nyob rau hauv C, yog kev cob cog rua nyob rau hauv daim ntawv ntawm ib tug sib koom tsev qiv ntawv ("extension = snuffleupagus.so" nyob rau hauv php.ini) thiab faib los ntawm muaj ntawv tso cai raws li LGPL 3.0.

Snuffleupagus muab cov kev cai tswjfwm uas tso cai rau koj siv cov qauv tsim los txhim kho kev ruaj ntseg, lossis tsim koj tus kheej cov cai los tswj cov ntaub ntawv nkag thiab cov haujlwm tsis ua haujlwm. Piv txwv li, txoj cai “sp.disable_function.function(“system”).param(“command”).value_r(“[$|;&`\\n]”).drop();” tso cai rau koj txwv tsis pub siv cov cim tshwj xeeb hauv qhov system() cov lus sib cav ua haujlwm yam tsis hloov daim ntawv thov. Cov txheej txheem built-in yog muab los thaiv cov chav kawm ntawm qhov tsis zoo xws li teeb meem, ntsig txog nrog cov ntaub ntawv serialization, tsis nyab xeeb siv PHP mail() muaj nuj nqi, xau ntawm ncuav qab zib ntsiab lus thaum lub sij hawm XSS tawm tsam, teeb meem vim loading cov ntaub ntawv nrog executable code (piv txwv li, nyob rau hauv hom phar), tsis zoo random naj npawb tiam thiab hloov tsis raug XML tsim.

PHP kev ruaj ntseg txhim kho hom muab los ntawm Snuffleupagus:

• Yuav ua kom "kev ruaj ntseg" thiab "samesite" (CSRF tiv thaiv) chij rau ncuav qab zib, encryption ncuav qab zib;
• Built-in cov cai los txheeb xyuas cov kab ntawm kev tawm tsam thiab kev cuam tshuam ntawm kev siv;
• Forced thoob ntiaj teb ua kom "nruj" (piv txwv li, thaiv qhov kev sim qhia ib txoj hlua thaum xav tau tus lej suav raws li kev sib cav) thiab tiv thaiv hom manipulation;
• Thaiv los ntawm lub neej ntawd raws tu qauv wrappers (piv txwv li, txwv tsis pub "phar://") nrog lawv cov npe dawb;
• Kev txwv tsis pub ua cov ntaub ntawv uas sau tau;
• Cov npe dub thiab dawb rau kev ntsuam xyuas;
• Yuav tsum tau qhib TLS daim ntawv pov thawj tshawb xyuas thaum siv
  curl;
• Ntxiv HMAC rau serialized khoom los xyuas kom meej tias deserialization retrieves cov ntaub ntawv khaws cia los ntawm thawj daim ntawv thov;
• Thov nkag hom;
• Thaiv kev thauj khoom ntawm cov ntaub ntawv sab nraud hauv libxml ntawm kev sib txuas hauv XML cov ntaub ntawv;
• Muaj peev xwm txuas rau lwm tus neeg tuav haujlwm (upload_validation) los xyuas thiab luam theej duab cov ntaub ntawv upload;

Ntawm cov kev hloov nyob rau hauv qhov kev tso tawm tshiab: Txhim kho kev txhawb nqa rau PHP 7.4 thiab tau siv kev sib raug zoo nrog PHP 8 ceg tam sim no hauv kev txhim kho Ntxiv lub peev xwm los teev cov xwm txheej ntawm syslog (cov lus qhia sp.log_media tau thov kom suav nrog, uas tuaj yeem siv php lossis syslog qhov tseem ceeb). Cov txheej txheem ua ntej tau raug hloov kho kom suav nrog cov kev cai tshiab rau tsis ntev los no tau txheeb xyuas qhov tsis zoo thiab cov tswv yim tawm tsam tawm tsam cov ntawv thov web. Txhim kho kev txhawb nqa rau macOS thiab nthuav dav siv cov kev sib koom ua ke txuas ntxiv raws li GitLab.

Tau qhov twg los: opennet.ru