PHP网站安全告警 8.9.5 更新

2025-2-12 更新
1.采用LRU算法匹配,性能提升3-7倍，基准测试机器为阿里云4核心4G的机器 PHP7.4 10个线程。wordpress 项目测试基准为10.68毫秒优化至1.68毫秒。thinkphp5.0.24 项目基准测试7.88毫秒优化至0.84毫秒（指的是模块执行耗时）
2.增加文件包含漏洞拦截
3.修复跨站读取文件判 断逻辑存在的问题


1、性能提升3-7 倍
wordpress 首页基准测试 总共70个hook点。总耗时如下。

时间类型为微秒    1秒=1000毫秒   1毫秒=1000微秒     相当于1秒=1000*1000 微秒

测试如下：总耗时为10869 微秒 = 10.8毫秒

1. time:966
   
2. time:95
   
3. time:135
   
4. time:133
   
5. time:298
   
6. time:191
   
7. time:120
   
8. time:174
   
9. time:113
   
10. time:168
    
11. time:85
    
12. time:90
    
13. time:85
    
14. time:90
    
15. time:102
    
16. time:127
    
17. time:89
    
18. time:141
    
19. time:107
    
20. time:209
    
21. time:219
    
22. time:179
    
23. time:230
    
24. time:182
    
25. time:188
    
26. time:132
    
27. time:136
    
28. time:130
    
29. time:236
    
30. time:219
    
31. time:118
    
32. time:187
    
33. time:125
    
34. time:194
    
35. time:129
    
36. time:96
    
37. time:144
    
38. time:113
    
39. time:106
    
40. time:91
    
41. time:119
    
42. time:116
    
43. time:120
    
44. time:218
    
45. time:128
    
46. time:219
    
47. time:197
    
48. time:156
    
49. time:123
    
50. time:125
    
51. time:146
    
52. time:175
    
53. time:159
    
54. time:156
    
55. time:150
    
56. time:179
    
57. time:176
    
58. time:160
    
59. time:136
    
60. time:127
    
61. time:91
    
62. time:116
    
63. time:85
    
64. time:126
    
65. time:86
    
66. time:85
    
67. time:108
    
68. time:112
    
69. time:142
    
70. time:161

复制代码

通过LRU加速如下  总耗时为 1698 微秒 =1.69毫秒。

1. time:47
   
2. time:18
   
3. time:15
   
4. time:28
   
5. time:27
   
6. time:28
   
7. time:25
   
8. time:27
   
9. time:32
   
10. time:29
    
11. time:19
    
12. time:16
    
13. time:16
    
14. time:15
    
15. time:39
    
16. time:23
    
17. time:21
    
18. time:15
    
19. time:19
    
20. time:20
    
21. time:18
    
22. time:15
    
23. time:13
    
24. time:12
    
25. time:11
    
26. time:10
    
27. time:11
    
28. time:10
    
29. time:34
    
30. time:25
    
31. time:22
    
32. time:24
    
33. time:20
    
34. time:21
    
35. time:32
    
36. time:21
    
37. time:31
    
38. time:22
    
39. time:20
    
40. time:21
    
41. time:31
    
42. time:20
    
43. time:27
    
44. time:29
    
45. time:40
    
46. time:121
    
47. time:31
    
48. time:18
    
49. time:8
    
50. time:9
    
51. time:8
    
52. time:8
    
53. time:6
    
54. time:7
    
55. time:7
    
56. time:8
    
57. time:7
    
58. time:7
    
59. time:6
    
60. time:7
    
61. time:6
    
62. time:7
    
63. time:6
    
64. time:7
    
65. time:7
    
66. time:8
    
67. time:7
    
68. time:7
    
69. time:15
    
70. time:351

复制代码

2.增加文件包含漏洞拦截

测试用例
php_Lzs86.zip (9.9 MB, 下载次数: 36)

2025-2-12 16:13 上传

点击文件名下载附件

这里使用的openrasp 的测试用例

已经兼容PHP8.4