Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:33128
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain coresecurity.com designates 200.123.107.164 as permitted sender)
Message-ID: <473B070F.4090209@coresecurity.com>
Date: Wed, 14 Nov 2007 11:32:47 -0300
Organization: Core Security Technologies
MIME-Version: 1.0
To: PHP Internals <internals@lists.php.net>, 
 grasp-discussion@coresecurity.com,  grasp-users@coresecurity.com
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: CORE GRASP Release update
From: egutesman@coresecurity.com (Ezequiel Gutesman)

Hi all,

We have just released an update for CORE GRASP (version 3).  In this
version, we enhanced mark propagation by implementing marks inside pcre
module and provided a first step into cross-site scripting prevention,
which will be the focus of our next release. We also fixed some bugs. We
appreciate the contributions that were made so far.

CHANGELOG
---------
    * Secmark propagation for all regular expressions in pcre module,
including new regression tests.
    * New 'S' placeholder for zend_parse_parameters(), which includes
the strings' secmark as a result. This may be useful for module
developers wishing to propagate secmarks through their code.
    * Secmark propagation for htmlentities() & htmlspecialchars(). This
is a requirement for XSS prevention.
    * Bugfix in two mysql regression tests, which involved hardcoded
paths to the logfile.
    * Bugfix in smart_str_appendl, involving FULL+FULL or NONE+NONE
appends being allocated as mixed.

All documents have been updated and can be downloaded from:
http://grasp.coresecurity.com/index.php?m=doc

CORE GRASP distributions can be downloaded from:
http://grasp.coresecurity.com/index.php?m=dld

Again, we invite you to contribute with proposals, discussions and comments.

Feel free to write in this mailing list and share your thoughts.


Regards,

The CORE GRASP team.
http://grasp.coresecurity.com