stefanesser/suhosin — pull request #31 by sjorek (2013-09-09 23:06:25+00:00)
Title: Feature: log and optionally terminate function_exists()-calls on non-whitelisted or blacklisted function

Today, nope yesterday :smirk:, I learned in https://github.com/stefanesser/suhosin/issues/18 the following: calls to `function_exists()` silently return `FALSE`, if the function to test for has been blacklisted or not whitelisted in one of the these configurations:

- suhosin.executor.func.blacklist
- suhosin.executor.func.whitelist
- suhosin.executor.eval.blacklist
- suhosin.executor.eval.whitelist

The related discussion shows (to my mind), that the current solution leads to misinterpretations depending on the implementation and/or hosting environment. From a security point of view is the silent return a perfect solution, but during development or initial deployment of applications this might be annoying. Therefore I implemented a new error level/class S_EXISTENCE and used it to log and if one wishes also to terminate direct and indirect function_exists()-calls on blacklisted or non-whitelisted functions-names.

* * *

A (hopefully) complete list of changes and additions:

1. [registered new constant `S_EXISTENCE`](https://github.com/sjorek/suhosin/compare/feature-fn-exists-log-and-terminate?expand=1#L3R277) as a new log level; as it has never been part of the suhosin-patch [it will always get registered](https://github.com/sjorek/suhosin/compare/feature-fn-exists-log-and-terminate?expand=1#L4R1049), regardless of PHP being patched or not
- Reason: I wanted to distinguish disabled function-execution from checking existence of disabled functions
- If suhosin-extension is loaded into an already suhosin-patched PHP Interpreter the S_EXISTENCE-Level is not part of S_ALL
- If suhosin-extension is loaded into vanilla PHP Interpreter the S_EXISTENCE-Level should be part of S_ALL
- *Maybe not such a good idea (untested, and is this even possible) ?*
2. Implemented two new flags:
- `suhosin.executor.func.exists_forbidden = Off`
- If enabled script-execution terminates if function_exists() has been called for a blacklisted or non-whitelisted
- `suhosin.executor.eval.exists_forbidden = Off`
- If enabled script-execution terminates if function_exists() has been called for a blacklisted or non-whitelisted function from within an `eval()`-statement.
- As both are disabled by default, there is no difference to the former implemenentation.
3. Updated all related suhosin.ini-descriptions accordingly
4. Implemented unit-tests to check eval's und func's whitelist and blacklist, with the their exists_forbidden-flag enabled and disabled

* * *

build and install, as well as `make test` have been successfully run on:

- FreeBSD 9.1
- Ports PHP 5.3.27, PHP 5.4.19 and PHP 5.5.3 using these patches:
https://github.com/NewEraCracker/suhosin-patches/tree/master/patches
- OS X 10.8
- Apple's PHP 5.3.15
- MacPorts PHP 5.3.27, PHP 5.4.19 and PHP 5.5.3 using these patches:
https://github.com/NewEraCracker/suhosin-patches/tree/master/patches

@narfbg : this pull-request enhances https://github.com/stefanesser/suhosin/issues/18 … at least I hope so.

I hope i didn't miss something and more important, I hope you like this solution …

Gut's Nächtle,
Stephan