baidu/openrasp v1.0

Version 1.0

on GitHub

中文说明
国内下载

Breaking changes

General changes

• Add header field in alarm logs, existing duplicated fields are removed
• Configuration file format changed from toml to yaml
• Only add Location header when HTTP response code is set to 302

Management panel

• Configuration item AgentServerURL and PanelServerURL moved to management panel

PHP agent

• Disabled fswatch in binary releases. Recompile with --enable-fswatch to enable it.
• Replaced rapidjson library with nlohmann/json
• Disable security baseline in cli mode

Java agent

• Removed rasp-log4j.xml from startup command-line arguments

New features

General changes

• Add support of JSON parameter to security plugins
• Add support of application hardening, e.g Click jacking, reflected XSS
• Add support of code decompilation

PHP agent

• Add support of PHP 7.3

Java agent

• Add support of SpringBoot (Undertow) server
• Add support of WebLogic application server
• Add support of JBoss application server (6.X - 8.X)
• Add support of JDK 11
• Collect OS environment information
• Add experimental support of ATTACH method, only installation and uninstallation is supported

Management panel

• Multiple UX enhancement

Algorithm improvements

Security baseline

• Detect empty password in Tomcat management panel

SQLi

• Detect SQL exception in applications, e.g syntax error

SSRF

• Add target port information

File Upload

• Add multipart parameter name information

WebShell

• Block LD_PRELOAD based webshell

Deserialization

• Block JNDI based reflected command execution