Req #65079 [Opn]: mb_ereg_replace's e modifier should be deprecated
Edit report at https://bugs.php.net/bug.php?id=65079&edit=1
ID: 65079
Updated by: yohgaki@php.net
Reported by: masakielastic at gmail dot com
Summary: mb_ereg_replace's e modifier should be deprecated
Status: Open
Type: Feature/Change Request
Package: mbstring related
Operating System: Any
PHP Version: 5.5.0
Block user comment: N
Private report: N
New Comment:
Comment for clarification.
Not like preg_replace(), mb_ereg_replace()'s 'e' modifier is specified as
separate parameter. preg_replace() allow to set 'e' modifier in regex and this
made preg_replace() much more dangerous than mb_ereg_replace().
However, callback is much more secure. Therefore, implementation of
mb_ereg_replace_callback() is highly encouraged.
Previous Comments:
------------------------------------------------------------------------
[2013-06-21 00:23:30] masakielastic at gmail dot com
Description:
------------
mb_ereg_replace's e modifier should be deprecated for prevent PHP's code
execution and the explanation for using mb_ereg_replace_callback (since PHP
5.4.1) should be added in the manual.
PHP: code execution via mb_ereg_replace
http://vigilance.fr/vulnerability/PHP-code-execution-via-mb-ereg-replace-8711
The reason why preg_replace's e modifier was deprecated in PHP 5.5 can be
applied to mb_ereg_replace's e modifier.
http://www.php.net/manual/en/function.preg-replace.php
https://wiki.php.net/rfc/remove_preg_replace_eval_modifier
There is an example of implementation of mb_ereg_replace_callback as a user
function.
http://d.hatena.ne.jp/hnw/20110206
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=65079&edit=1
Thread (4 messages)