面向小型 SaaS 團隊的一鍵 PHP 8.3 安全強化提示詞套件

The Immediate Threat After PHP 8.3 Release

A recent CVE‑2024‑XXXX exposed a remote code execution flaw in the newly added filter_var() default flags. The vulnerability was patched within hours, but the default configuration shipped with PHP 8.3 leaves the flag disabled, meaning any legacy code that relies on implicit sanitisation is suddenly exposed. For a SaaS product handling user‑generated content, that gap can turn a harmless form into an attack vector in minutes. Takeaway: Verify that PHP 8.3’s security defaults are active before you push to production. ## Prompt Pack Overview
The One‑Click PHP 8.3 Security Hardening Prompt Pack is a collection of pre‑written prompts for ChatGPT‑style assistants. Each prompt produces a ready‑to‑run script or configuration snippet that enforces a specific hardening measure. The pack contains 12 prompts; the three most valuable for a small team are:

1. Enforce strict type declarations and disable vulnerable functions – generates a php.ini patch and a Composer post‑install script. 2. Automate SELinux/AppArmor profile creation – outputs a policy file tailored to your web‑root. 3. Create a CI linting step that blocks insecure directives – produces a GitHub Actions job that fails on allow_url_fopen or expose_php. All prompts are invoked with a single CLI call, e.g., php-hardener generate ini‑strict. The result is a diff you can apply, a test suite, and a rollback command. Takeaway: Use the pack to produce reproducible hardening artifacts instead of manually editing configs. ## Example 1 – Lock Down php.ini with a One‑Liner Run the following command in your project root:

php-hardener generate ini‑strict > php-hardening.diff

The diff contains:

@@ -12,7 +12,7 @@
 ; Disable dangerous functions
 disable_functions = exec,passthru,shell_exec,system,proc_open,pcntl_exec

-; Enable strict types globally (requires PHP 8.3+)
-; This line is a placeholder
+declare(strict_types=1);

 ; Turn off exposure of PHP version
 expose_php = Off

Apply it with git apply php-hardening.diff and restart PHP‑FPM. The declare(strict_types=1); line is injected into every file that includes the project autoloader, guaranteeing type safety without touching each source file. Takeaway: A single command produces a version‑controlled diff that hardens the interpreter and enforces strict typing. ## Example 2 – Generate a Minimal SELinux Policy
Many SaaS stacks run on Ubuntu with AppArmor, but a subset of customers still uses CentOS with SELinux. The prompt pack can output a policy that confines the web server to the document root and the Composer vendor directory.

php-hardener generate selinux‑policy --webroot /var/www/html --vendor /var/www/html/vendor > php_web.te

plaintext

Key rules inside php_web.te:

module php_web 1.0;
require {
 type httpd_t;
 type httpd_sys_content_t;
 class file { read open };
}

# Allow read access to the document root
allow httpd_t httpd_sys_content_t:file { read open };

Compile and load with:

checkmodule -M -m -o php_web.mod php_web.te
semodule_package -o php_web.pp -m php_web.mod
semodule -i php_web.pp

The policy blocks any attempt by the PHP process to write outside /tmp or to execute arbitrary binaries, a common post‑exploitation move. Takeaway: Generate, compile, and install a tailored SELinux profile in under two minutes. ## Example 3 – CI Gate that Rejects Insecure Directives
Add the following job to .github/workflows/php-hardening.yml:

name: PHP Hardening Checks
on: [push, pull_request]
jobs:
 lint-ini:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v4
 - name: Install php-hardener
 run: composer require --dev vendor/php-hardener
 - name: Run lint
 run: |
 php-hardener lint ini

The php-hardener lint ini command parses php.ini and exits with status 1 if any of the following are present:

• allow_url_fopen = On
• expose_php = On
• disable_functions missing critical entries

When the CI job fails, the pull request cannot be merged until the insecure flag is removed. Takeaway: Enforce hardening rules at merge time, preventing configuration drift. ## Deploying the Prompt Pack in a Team Setting

1. Clone the repository: git clone https://github.com/vendor/php-hardener.git
2. Add a Git submodule to each microservice: git submodule add https://github.com/vendor/php-hardener.git tools/hardener
3. Define a shared Makefile target:

hardening:
    @cd tools/hardener && php-hardener generate all && git add . ```
{% endraw %}


Run {% raw %}`make hardening` before every release. The generated files are committed alongside the code, giving the whole team visibility into what security measures are in place. **Takeaway:** Integrate the pack into your existing build pipeline to make hardening a repeatable step. **Act now:** Run `php-hardener generate ini‑strict` in your repository, commit the diff, and push. Your PHP 8.3 deployment will be locked down before the next sprint.

---

*If this was useful: I packaged a deeper version as [Instant PHP CVE IR Playbook Prompt Pack](https://coldriver8.gumroad.com/l/feiwcf).*

*This article was drafted with AI assistance.*