fix: adjust Snuffleupagus rules for Nextcloud 35

Dockerfile

@@ -1,17 +1,17 @@
 # -------------- Build-time variables --------------
-ARG NEXTCLOUD_VERSION=34.0.4
+ARG NEXTCLOUD_VERSION=35.0.0
 ARG PHP_VERSION=8.5
 ARG NGINX_VERSION=1.30
 
-ARG ALPINE_VERSION=3.23
+ARG ALPINE_VERSION=3.24
 ARG HARDENED_MALLOC_VERSION=14
-ARG SNUFFLEUPAGUS_VERSION=0.13.0
+ARG SNUFFLEUPAGUS_VERSION=0.14.0
 
 ARG UID=1000
 ARG GID=1000
 
-# nextcloud-34.0.4.tar.bz2
-ARG SHA256_SUM="00f226e6364f96e0918ab06157158f66601b8cedc25af777f5ee5a3056f42b83"
+# nextcloud-35.0.0.tar.bz2
+ARG SHA256_SUM="d8c165e764a7a4de82eb3dec510d66e19f2d82218572604af9c15d99a98a29a0"
 
 # Nextcloud Security <security@nextcloud.com> (D75899B9A724937A)
 ARG GPG_FINGERPRINT="2880 6A87 8AE4 23A2 8372  792E D758 99B9 A724 937A"

rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules

@@ -37,11 +37,12 @@ sp.sloppy_comparison.enable();
 # https://snuffleupagus.readthedocs.io/features.html#protection-against-cross-site-request-forgery
 sp.cookie.name("PHPSESSID").samesite("lax");
 
-# Nextcloud whitelist (tested with Nextcloud 34.0.0)
+# Nextcloud whitelist (tested with Nextcloud 35.0.0)
 sp.disable_function.function("function_exists").param("function").value("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
 sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/private/legacy/OC_Helper.php").allow();
 sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/public/Util.php").allow();
 sp.disable_function.function("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
+sp.disable_function.function("ini_set").param("option").value_r("display_errors").filename("/nextcloud/lib/OC.php").allow();
 sp.disable_function.function("ini_set").param("option").value_r("display_errors").filename("/nextcloud/lib/base.php").allow();
 sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow();
 sp.disable_function.function("ini_get").param("option").value_r("suhosin").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow();
@@ -51,6 +52,7 @@ sp.disable_function.function("ini_get").param("option").value("allow_url_fopen")
 sp.disable_function.function("exec").param("command").value("apachectl -M | grep mpm").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow();
 
 # Nextcloud inherently enables XXE-Protection since 27.0.1, therefore, drop setting a new external entity loader
+sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/OC.php").allow();
 sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/base.php").allow();
 sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/apps2/user_saml/lib/Helper/TXmlHelper.php").allow();
 sp.disable_function.function("libxml_set_external_entity_loader").drop();