Monkey Patch as hardening procedure

Some times our php code acts as framework to serve small applications like a CMS or an administrative appliance launches mini applications to do maintain tasks.

If our application is wide open for developers community nothings guarantee the security and your product image can be get a fast burndown for your customers.

Monkey Patch is a simple solution for this ¿why not? Wikipedia explains the moneky patch so:

A monkey patch is a way to extend or modify the run-time code of dynamic languages without altering the original source code. This process has also been described as "duck punching".[1]
src: http://en.wikipedia.org/wiki/Monkey_patch

And this is a interesting way to hardening your external or plugin scripts:

Using namespaces to capture the basic functions:

# apt-get install build-essential php5-dev and pecl apd (advanced php debugger) [...]

A starter "jailed" (more precisely overdrived) environment of application in your framework:

<?php namespace jail { require_once("security.php"); require_once("myPlugin.php"); } ?>

"myPlugin" file acting as a unsecure code:
<?php $contents = file_get_contents($_GET['file']); if ( FALSE == $contents ) { echo "err reading file"; } else { echo $contents; } ?>

And finally the little security layer:
<?php function secure_file_get_contents($filename) { error_log("@Filter here the string \$filename"); return unsecure_file_get_contents($filename); } if ( !function_exists('rename_function') || !function_exists('override_function') ) { error_log("WARNING: apd pecl module don't seems be installed, unable to monitor functions"); return; } rename_function('file_get_contents', 'unsecure_file_get_contents'); override_function('file_get_contents', '$filename', 'return secure_file_get_content($filename);'); ?>

---

Posted at BinaryCell