enygma / expose

An Intrusion Detection System library loosely based on PHP IDS
MIT License
266 stars 55 forks source link

Added an impact limit to stop processing. #27

Closed manchuck closed 10 years ago

manchuck commented 10 years ago

If an attacker is trying to DoS the site, running though processing would not add any value. This change on the manager allows the user to set a limit to stop further processing if an impact threshold is met. In order to use, just set on the manager like so:

$manager->setImpactLimit(100);
manchuck commented 10 years ago

I had to update the tests to return a filter collection rather than an array. getFilters on the manager states in the comments that it will return a filterCollection. Is that always the case or should I expect that sometimes I will get back an array?

enygma commented 10 years ago

Well, the only place setFilters is called is in the constructor of the Manager and that has a type hint for \Expose\FilterCollection (same as the type hint on setFilters itself) so I'd assume it's an instance of that all the time. It looks like the tests were already set up to use that object type...where did you need to change it?

manchuck commented 10 years ago

Inside testThresholdLowerThenImpact and testThresholdHigherThenImpact. The tests were mocking getFilters to return a array instead of an instance of FilterCollection. That is where the confusion came from

enygma commented 10 years ago

Ah, there it is...that's cool. That's what they should have been anyway.