We have several new majors features, along with the usual bugfixes:
- The previous version suffered
from a memory leak
that wasn't detected earlier, because we're using
php-fpmwhere processes are recycled, instead of
mod_php. This defect is now fixed.
- Thanks to the amazing caillou, we now have literally zero impact on the performances (with the default ruleset) of your php process.
- Encryption is now supported on session cookies, thanks to the stellar work of kkadosh
- It's now possible to forbid most occurrences of type juggling, thanks to caillou.
- Documentation improvement (yes, the documentation is versioned in git.)
.filename()filter is now matching in the file where the function is called, and not in the one where it's declared anymore.
- Two more language constructs, namely
- The logs format has been normalized a bit to be easier to parse.
- Various obscure integer overflow were fixed. We don't think that they are exploitable, but heh, better safe than sorry.
- As usual, code simplification/cleanup.
All those benchmarks were done by caillou's on Joomla's testsuite, on a low-end
laptop. They were done using the default set of rules.
If you're writing stupid things with a lot of regexps involved, you
will of course experience overhead.
Impact of the rules
Previously, the rules where all stored in several linked lists. This is not the case anymore for rules that are matching on literal function name: they are now stored in a hash table, granting us a significant performance boost when processing a lot of rules.
|number of rules||time on
|25||0m 50s||0m 51s|
|50||0m 52s||0m 51s|
|100||0m 57s||0m 51s|
|500||1m 41s||0m 51s|
|1000||2m 55s||0m 53s|
|5000||15m 46s||0m 52s|
CPU and memory impact
Those graphs are showcasing our now-fixed-memory-leak (look at the memory
consumption for the
0.2.2), but more importantly,
that we effectively have no noticeable impact on the CPU and memory
consumption at all!
PHP without Snuffleupagus
Pass the Salt
It was a nice conference, with a large majority of interesting talk containing actionable bits: the theme being security and open-source, everything that was presented was openly available immediately to play with! I warmly recommend watching the other talks while waiting for the 2nd edition.
With the next minor release of PHP (
7.3) that should happen
somewhere before the end of the year, we'll need to make sure that
Snuffleupagus is compatible with it,
especially the samesite feature.
We don't have many big issues
remaining, but we do plan to fix them all anyway :)
If you want to help, we have some low hanging fruits just for you ♥
See you in your PHP stack!