PHPIDS » Web Application Security 2.0

Just in time before the holidays we are proud to release PHPIDS 0.4.4. After several weeks of testing by the group we populated the new release with small but important features and optimizations. We added support for detection and translation of JavaScript Unicode - undetected vectors like \0061ert(1) Gareth Heyes discovered now belong to the past. Also we optimized the rules to catch the latest concatenation and code injection vectors crafted by thornmaker and tx.

The centrifuge was optimized a little bit more and here and there we heard about vectors that were exclusively detected by this mechanism - so yes, the concept works. Furthermore we discovered several minor bottle necks when dealing with very large incoming strings which of course were removed too for better scalability and performance.

We also increased the code quality - the PHPIDS is now completely coded in PEAR valid PHP constantly monitored by the PEAR package PHP_CodeSniffer. The test coverage is higher than 95% and we also tweaked the generated documentation for better understanding.

We hope as usual that you like the new release as much as we do and wish you a very happy and relaxing holiday. See you next year!