php5.4没有Suhosin安全吗?-Isphp5.4safewithoutSuhosin?

39  

Suhosin was a PHP hardening patch. It did not patch any explicit security vulnerabilities -- it merely made some vulnerabilities in PHP scripts more difficult to exploit.

Suhosin是一个PHP硬化补丁。它没有修补任何明显的安全漏洞——它只是让PHP脚本中的一些漏洞更难被利用。

Some of the changes which Suhosin made were eventually rolled into PHP. For instance, Suhosin's various layers of protection against null bytes in inputs were made unnecessary by PHP 5.3.4, which made null bytes in filenames always throw an error (rather than silently truncating the filename at the null byte).

Suhosin所做的一些更改最终被整合到PHP中。例如，PHP 5.3.4不需要Suhosin在输入中针对空字节的各种保护层，这使得文件名中的空字节总是抛出一个错误(而不是在空字节中悄悄地截断文件名)。

PHP 5.4 is generally regarded to be reasonably safe without Suhosin involved. Going forward, so long as your application supports it, you will be better off with a newer (5.4+) version of PHP, rather than an older version with the Suhosin patch.

PHP 5.4通常被认为是相当安全的，不涉及Suhosin。接下来，只要您的应用程序支持它，您最好使用更新的(5.4+)PHP版本，而不是使用Suhosin补丁的旧版本。

7  

If you can't disable eval() (a language construct, not a function) or have a blacklist within eval to disable most of the hacker's toolbox within eval, then you are running a load of bandwidth that is irresistable to hackers looking for bandwidth to run their payloads. What to blacklist, ideally, can't always be done because 3rd party module writers or even framework core depends on some of these functions within an eval() context:

如果您不能禁用eval()(语言构造，而不是函数)或在eval中有一个黑名单，以禁用eval中的大部分黑客工具箱，那么您正在运行的带宽对正在寻找带宽以运行其有效负载的黑客来说是不可抗拒的。理想情况下，黑名单不能总是这样做，因为第三方模块编写者甚至框架核心都依赖于eval()上下文中的这些功能:

suhosin.executor.eval.blacklist=include,include_once,require,require_once,curl_init,fpassthru,file,base64_encode,base64_decode,mail,exec,system,proc_open,leak,pfsockopen,shell_exec,ini_restore,symlink,stream_socket_server,proc_nice,popen,proc_get_status,dl,pcntl_exec,pcntl_fork, pcntl_signal, pcntl_waitpid, pcntl_wexitstatus, pcntl_wifexited, pcntl_wifsignaled, pcntl_wifstopped, pcntl_wstopsig, pcntl_wtermsig, socket_accept, socket_bind, socket_connect, socket_create, socket_create_listen, socket_create_pair,link,register_shutdown_function,register_tick_function,create_function,passthru,p_open,proc_close,proc_get_status,proc_terminate, allow_url_fopen,allow_url_include,passthru,popen,stream_select

If you can't filter for these functions then a major component of security is missing.

如果不能对这些函数进行过滤，那么安全性的一个主要组件就会丢失。

Here are some examples of Remote Administration Tools (RATS) that will infect your site, through any vulnerable 3rd party module or site user account.

下面是一些远程管理工具(rat)的例子，它们将通过任何第三方模块或站点用户帐户感染您的站点。

RATs can take many forms, some are easy to grep for:

老鼠可以有很多种形式，有些很容易抓取，因为: