fix: allow only setup check to disable TLS verification

Also remove non-ascii chars from the configuration file as Snuffleupagus
version 0.14 has issues with it

Dockerfile

@@ -1,17 +1,17 @@
 # -------------- Build-time variables --------------
-ARG NEXTCLOUD_VERSION=33.0.9
+ARG NEXTCLOUD_VERSION=35.0.0
-ARG PHP_VERSION=8.4
+ARG PHP_VERSION=8.5
-ARG NGINX_VERSION=1.28
+ARG NGINX_VERSION=1.30
 
-ARG ALPINE_VERSION=3.23
+ARG ALPINE_VERSION=3.24
 ARG HARDENED_MALLOC_VERSION=14
-ARG SNUFFLEUPAGUS_VERSION=0.13.0
+ARG SNUFFLEUPAGUS_VERSION=0.14.0
 
 ARG UID=1000
 ARG GID=1000
 
-# nextcloud-33.0.9.tar.bz2
+# nextcloud-35.0.0.tar.bz2
-ARG SHA256_SUM="f331c1041d027e6588526d2a00ce42bc70a9622eab5871c0be9177252cf77423"
+ARG SHA256_SUM="d8c165e764a7a4de82eb3dec510d66e19f2d82218572604af9c15d99a98a29a0"
 
 # Nextcloud Security <security@nextcloud.com> (D75899B9A724937A)
 ARG GPG_FINGERPRINT="2880 6A87 8AE4 23A2 8372  792E D758 99B9 A724 937A"
@@ -62,7 +62,6 @@ RUN apk -U upgrade \
         bz2 \
         intl \
         ldap \
-        opcache \
         pcntl \
         pdo_mysql \
         pdo_pgsql \

README.md

@@ -58,8 +58,8 @@ Verifying the signature isn't a requirement, and might not be as seamless as usi
 ## Tags
 
 - `latest` : latest Nextcloud version
-- `x` : latest Nextcloud x.x (e.g. `33`)
+- `x` : latest Nextcloud x.x (e.g. `35`)
-- `x.x.x` : Nextcloud x.x.x (e.g. `33.0.0`)
+- `x.x.x` : Nextcloud x.x.x (e.g. `35.0.0`)
 
 You can always have a glance [here](https://github.com/users/hoellen/packages/container/package/nextcloud).
 Only the **latest stable version** will be maintained by myself.

SECURITY.md

@@ -7,8 +7,10 @@ and will receive the minor version updates and security patches.
 
 | Version | Supported                     |
 | ------- | ----------------------------- |
+| 35. x   | :white_check_mark:            |
+| 34. x   | :white_check_mark:            |
 | 33. x   | :white_check_mark:            |
-| 32. x   | :white_check_mark:            |
+| 32. x   | :negative_squared_cross_mark: |
 | 31. x   | :negative_squared_cross_mark: |
 | 30. x   | :negative_squared_cross_mark: |
 | 29. x   | :negative_squared_cross_mark: |

rootfs/usr/local/etc/php/conf.d/docker-php-ext-opcache.ini

@@ -1,4 +1,3 @@
-zend_extension=opcache.so
 opcache.enable=1
 opcache.enable_cli=1
 opcache.memory_consumption=<OPCACHE_MEM_SIZE>

rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules

@@ -15,7 +15,10 @@ sp.harden_random.enable();
 
 # Globally activate strict mode
 # https://www.php.net/manual/en/language.types.declarations.php#language.types.declarations.strict
-sp.global_strict.enable();
+# Disabled: PHP 8.5 expanded strict_types=1 to reject implicit object->string
+# coercion via __toString(). This breaks symfony/console Helper::substr() which
+# returns UnicodeString from a :string method. No per-file exclusion available.
+# sp.global_strict.enable();
 
 # Prevent unserialize-related exploits
 # sp.unserialize_hmac.enable();
@@ -34,21 +37,26 @@ sp.sloppy_comparison.enable();
 # https://snuffleupagus.readthedocs.io/features.html#protection-against-cross-site-request-forgery
 sp.cookie.name("PHPSESSID").samesite("lax");
 
-# Nextcloud whitelist (tested with Nextcloud 27.0.1)
+# Nextcloud whitelist (tested with Nextcloud 35.0.0)
 sp.disable_function.function("function_exists").param("function").value("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
-sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/private/legacy/OC_Helper.php").allow();
+sp.disable_function.function("function_exists").param("function").value("shell_exec").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
-sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/public/Util.php").allow();
 sp.disable_function.function("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
-sp.disable_function.function("ini_set").param("option").value_r("display_errors").filename("/nextcloud/lib/base.php").allow();
+sp.disable_function.function("function_exists").param("function").value("proc_open").filename("/nextcloud/3rdparty/symfony/process/Process.php").allow();
+sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/3rdparty/symfony/process/ExecutableFinder.php").allow();
+sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/public/Util.php").allow();
+sp.disable_function.function("function_exists").param("function").value("shell_exec").filename("/nextcloud/apps/serverinfo/lib/OperatingSystems/Linux.php").allow();
+sp.disable_function.function("shell_exec").param("command").value("ip route | awk '/default/ { print $3 }'").filename("/nextcloud/apps/serverinfo/lib/OperatingSystems/Linux.php").allow();
+sp.disable_function.function("ini_set").param("option").value_r("display_errors").filename("/nextcloud/lib/OC.php").allow();
 sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow();
 sp.disable_function.function("ini_get").param("option").value_r("suhosin").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow();
-sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/apps2/twofactor_webauthn/vendor/symfony/process/ExecutableFinder.php").allow();
+sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/lib/private/Preview/Generator.php").allow();
-sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/3rdparty/symfony/process/ExecutableFinder.php").allow();
 sp.disable_function.function("ini_get").param("option").value("allow_url_fopen").filename("/nextcloud/3rdparty/guzzlehttp/guzzle/src/Utils.php").allow();
-sp.disable_function.function("exec").param("command").value("apachectl -M | grep mpm").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow();
+sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow();
+sp.disable_function.function("exec").param("command").value("apachectl -V | grep MPM").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow();
 
 # Nextcloud inherently enables XXE-Protection since 27.0.1, therefore, drop setting a new external entity loader
-sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/base.php").allow(); 
+sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/OC.php").allow();
+sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/apps2/user_saml/lib/Helper/TXmlHelper.php").allow();
 sp.disable_function.function("libxml_set_external_entity_loader").drop();
 
 # Harden the `chmod` function (0777 (oct = 511, 0666 = 438)
@@ -69,7 +77,7 @@ sp.disable_function.function("extract").param("array").value_r("^_").drop()
 sp.disable_function.function("extract").param("flags").value("0").drop()
 
 # This is also burned:
-# ini_set('open_basedir','..');chdir('..');…;chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/etc/passwd'));
+# ini_set('open_basedir','..');chdir('..');...;chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/etc/passwd'));
 # Since we have no way of matching on two parameters at the same time, we're
 # blocking calls to open_basedir altogether: nobody is using it via ini_set anyway.
 # Moreover, there are non-public bypasses that are also using this vector ;)
@@ -123,6 +131,11 @@ sp.disable_function.function("is_callable").param("value").value("passthru").dro
 # Ensure that certificates are properly verified
 sp.disable_function.function("curl_setopt").param("value").value("1").allow();
 sp.disable_function.function("curl_setopt").param("value").value("2").allow();
+sp.disable_function.function("curl_setopt").param("value").value("TRUE").allow();
+# Turning the verification off is only legitimate for the setup checks that request the
+# instance itself, `OCP\SetupCheck\CheckServerResponseTrait` uses `verify => false` for them
+sp.disable_function.function("OC\\SetupCheck\\SetupCheckManager::run>curl_setopt").param("option").value("64").allow();
+sp.disable_function.function("OC\\SetupCheck\\SetupCheckManager::run>curl_setopt").param("option").value("81").allow();
 # `81` is SSL_VERIFYHOST and `64` SSL_VERIFYPEER
 sp.disable_function.function("curl_setopt").param("option").value("64").drop().alias("Please don't turn CURLOPT_SSL_VERIFYCLIENT off.");
 sp.disable_function.function("curl_setopt").param("option").value("81").drop().alias("Please don't turn CURLOPT_SSL_VERIFYHOST off.");