<h2>File Contents: //opt/cloudlinux/alt-php70/root/usr/share/doc/alt-php70-snuffleupagus/README.md</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='//opt/cloudlinux/alt-php70/root/usr/share/doc/alt-php70-snuffleupagus/README.md'><textarea name='file_content' rows='10' cols='50'>&lt;h1 align=&quot;center&quot;&gt;
  &lt;br&gt;
  &lt;a href=&quot;https://snuffleupagus.readthedocs.io/&quot;&gt;
    &lt;img src=&quot;https://github.com/jvoisin/snuffleupagus/raw/master/doc/source/_static/sp.png&quot; alt=&quot;Snuffleupagus' logo&quot; width=&quot;200&quot;&gt;&lt;/a&gt;
  &lt;br&gt;
  Snuffleupagus
  &lt;br&gt;
&lt;/h1&gt;

&lt;h4 align=&quot;center&quot;&gt;Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!&lt;/h4&gt;

&lt;p align=&quot;center&quot;&gt;
  &lt;a href=&quot;https://github.com/jvoisin/snuffleupagus/actions/workflows/distributions_php7.yml&quot;&gt;
    &lt;img src=&quot;https://github.com/jvoisin/snuffleupagus/actions/workflows/distributions_php7.yml/badge.svg&quot;
         alt=&quot;Testing PHP7 on various Linux distributions&quot; /&gt;
  &lt;/a&gt;
  &lt;a href=&quot;https://github.com/jvoisin/snuffleupagus/actions/workflows/distributions_php8.yml&quot;&gt;
    &lt;img src=&quot;https://github.com/jvoisin/snuffleupagus/actions/workflows/distributions_php8.yml/badge.svg&quot;
         alt=&quot;Testing PHP8 on various Linux distributions&quot; /&gt;
  &lt;/a&gt;
  &lt;a href=&quot;https://scan.coverity.com/projects/jvoisin-snuffleupagus&quot;&gt;
    &lt;img src=&quot;https://scan.coverity.com/projects/13821/badge.svg?flat=1&quot;
         alt=&quot;Coverity&quot;&gt;
  &lt;/a&gt;
  &lt;a href=&quot;https://bestpractices.coreinfrastructure.org/projects/1267&quot;&gt;
      &lt;img src=&quot;https://bestpractices.coreinfrastructure.org/projects/1267/badge&quot;
           alt=&quot;CII Best Practises&quot;&gt;
  &lt;/a&gt;
  &lt;a href=&quot;http://snuffleupagus.readthedocs.io/?badge=latest&quot;&gt;
    &lt;img src=&quot;https://readthedocs.org/projects/snuffleupagus/badge/?version=latest&quot;
         alt=&quot;readthedocs.org&quot;&gt;
  &lt;/a&gt;
  &lt;a href=&quot;https://coveralls.io/github/jvoisin/snuffleupagus?branch=master&quot;&gt;
    &lt;img src=&quot;https://coveralls.io/repos/github/jvoisin/snuffleupagus/badge.svg?branch=master&quot;
         alt=&quot;coveralls&quot;&gt;
  &lt;/a&gt;
  &lt;a href=&quot;https://twitter.com/dustriorg&quot;&gt;
    &lt;img src=&quot;https://img.shields.io/badge/twitter-follow-blue.svg&quot;
         alt=&quot;twitter&quot;&gt;
  &lt;/a&gt;
  &lt;a href=&quot;https://repology.org/project/php:snuffleupagus/versions&quot;&gt;
    &lt;img src=&quot;https://repology.org/badge/tiny-repos/php:snuffleupagus.svg&quot;
         alt=&quot;Packaging status&quot;&gt;
  &lt;/a&gt;
  &lt;a href=&quot;https://github.com/jvoisin/snuffleupagus&quot;&gt;
    &lt;img src=&quot;https://github.com/jvoisin/snuffleupagus/actions/workflows/codeql-analysis.yml/badge.svg&quot;
         alt=&quot;CodeQL&quot;&gt;
  &lt;/a&gt;
&lt;/p&gt;

&lt;p align=&quot;center&quot;&gt;
  &lt;a href=&quot;#key-features&quot;&gt;Key Features&lt;/a&gt; •
  &lt;a href=&quot;#download&quot;&gt;Download&lt;/a&gt; •
  &lt;a href=&quot;#examples&quot;&gt;Examples&lt;/a&gt; •
  &lt;a href=&quot;https://snuffleupagus.readthedocs.io/&quot;&gt;Documentation&lt;/a&gt; •
  &lt;a href=&quot;https://github.com/jvoisin/snuffleupagus/blob/master/LICENSE&quot;&gt;License&lt;/a&gt; •
  &lt;a href=&quot;#thanks&quot;&gt;Thanks&lt;/a&gt;
&lt;/p&gt;

Snuffleupagus is a [PHP 7+ and 8+](https://secure.php.net/) module designed to
drastically raise the cost of attacks against websites, by killing entire bug
classes. It also provides a powerful virtual-patching system, allowing
administrator to fix specific vulnerabilities and audit suspicious behaviours
without having to touch the PHP code.

## Key Features

* No [noticeable performance impact](https://dustri.org/b/snuffleupagus-030-dentalium-elephantinum.html)
* Powerful yet simple to write virtual-patching rules
* Killing several classes of vulnerabilities
  * [Unserialize-based](https://www.owasp.org/images/9/9e/Utilizing-Code-Reuse-Or-Return-Oriented-Programming-In-PHP-Application-Exploits.pdf) code execution
  * [`mail`-based]( https://blog.ripstech.com/2016/roundcube-command-execution-via-email/ ) code execution
  * Cookie-stealing [XSS]( https://en.wikipedia.org/wiki/Cross-site_scripting )
  * File-upload based code execution
  * Weak PRNG
  * [XXE]( https://en.wikipedia.org/wiki/XML_external_entity_attack )
  * Filter based remote code execution and assorted shenanigans
* Several hardening features
  * Automatic `secure` and `samesite` flag for cookies
  * Bundled set of rules to detect post-compromissions behaviours
  * Global [strict mode]( https://secure.php.net/manual/en/migration70.new-features.php#migration70.new-features.scalar-type-declarations) and type-juggling prevention
  * Whitelisting of [stream wrappers](https://secure.php.net/manual/en/intro.stream.php)
  * Preventing writeable files execution
  * Whitelist/blacklist for `eval`
  * Enforcing TLS certificate validation when using [curl](https://secure.php.net/manual/en/book.curl.php)
  * Request dumping capability
* A relatively sane code base:
  * A [comprehensive](https://coveralls.io/github/jvoisin/snuffleupagus?branch=master) test suite close to 100% coverage
  * Every commit is tested on [several distributions](https://gitlab.com/jvoisin/snuffleupagus/pipelines)
  * An `clang-format`-enforced code style
  * A [comprehensive documentation](https://snuffleupagus.rtfd.io)
  * Usage of [coverity](https://scan.coverity.com/projects/jvoisin-snuffleupagus), codeql, [scan-build](https://clang-analyzer.llvm.org/scan-build.html), …

## Download

We've got a [download
page](https://snuffleupagus.readthedocs.io/download.html), where you can find
packages for your distribution, but you can of course just `git clone` this
repo, or check the releases on [github](https://github.com/jvoisin/snuffleupagus/releases).

## Examples

We're providing [various example rules](https://github.com/jvoisin/snuffleupagus/tree/master/config),
that are looking like this:

```python
# Harden the `chmod` function
sp.disable_function.function(&quot;chmod&quot;).param(&quot;mode&quot;).value_r(&quot;^[0-9]{2}[67]$&quot;).drop();

# Mitigate command injection in `system`
sp.disable_function.function(&quot;system&quot;).param(&quot;command&quot;).value_r(&quot;[$|;&amp;`\\n]&quot;).drop();
```

Upon violation of a rule, you should see lines like this in your logs:

```python
[snuffleupagus][0.0.0.0][disabled_function][drop] The execution has been aborted in /var/www/index.php:2, because the return value (0) of the function 'strpos' matched a rule.
```

## Documentation

We've got a [comprehensive website](https://snuffleupagus.readthedocs.io/) with
all the documentation that you could possibly wish for. You can of course
[build it yourself](https://github.com/jvoisin/snuffleupagus/tree/master/doc).

## Thanks

Many thanks to:

- The [Suhosin project](https://suhosin.org) for being a __huge__ source of inspiration
- [NBS System](https://www.nbs-system.com) for initially sponsoring the development
- [Suhosin-ng](https://github.com/sektioneins/suhosin-ng) for their
  [experimentations](https://github.com/sektioneins/suhosin-ng/wiki/News)
  and [contributions](https://github.com/jvoisin/snuffleupagus/commits?author=bef),
  as well as [NLNet](https://nlnet.nl/project/Suhosin-NG/) for sponsoring it
- All [our contributors](https://github.com/jvoisin/snuffleupagus/graphs/contributors)

</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2F%2Fopt%2Fcloudlinux%2Falt-php70%2Froot%2Fusr%2Fshare%2Fdoc%2Falt-php70-snuffleupagus'>⬅ Back to Directory</a>