Req #65079 [Asn->Csd]: mb_ereg_replace's e modifier should be deprecated

Edit report at https://bugs.php.net/bug.php?id=65079&edit=1 ID: 65079 Updated by: cmb@php.net Reported by: masakielastic at gmail dot com Summary: mb_ereg_replace's e modifier should be deprecated -Status: Assigned +Status: Closed Type: Feature/Change Request Package: mbstring related Operating System: Any PHP Version: 5.5.0 Assigned To: cmb Block user comment: N Private report: N New Comment: > The latter is not yet documented, though. Done - closing. Previous Comments: ------------------------------------------------------------------------ [2016-07-28 12:12:45] cmb@php.net mb_ereg_replace_callback() is available as of PHP 5.4.1[1]; the 'e' modifier is deprecated as of PHP 7.1.0[2]. The latter is not yet documented, though. [1] <http://php.net/manual/en/function.mb-ereg-replace-callback.php> [2] <https://wiki.php.net/rfc/deprecate_mb_ereg_replace_eval_option>. ------------------------------------------------------------------------ [2013-06-28 06:01:44] yohgaki@php.net Comment for clarification. Not like preg_replace(), mb_ereg_replace()'s 'e' modifier is specified as separate parameter. preg_replace() allow to set 'e' modifier in regex and this made preg_replace() much more dangerous than mb_ereg_replace(). However, callback is much more secure. Therefore, implementation of mb_ereg_replace_callback() is highly encouraged. ------------------------------------------------------------------------ [2013-06-21 00:23:30] masakielastic at gmail dot com Description: ------------ mb_ereg_replace's e modifier should be deprecated for prevent PHP's code execution and the explanation for using mb_ereg_replace_callback (since PHP 5.4.1) should be added in the manual. PHP: code execution via mb_ereg_replace http://vigilance.fr/vulnerability/PHP-code-execution-via-mb-ereg-replace-8711 The reason why preg_replace's e modifier was deprecated in PHP 5.5 can be applied to mb_ereg_replace's e modifier. http://www.php.net/manual/en/function.preg-replace.php https://wiki.php.net/rfc/remove_preg_replace_eval_modifier There is an example of implementation of mb_ereg_replace_callback as a user function. http://d.hatena.ne.jp/hnw/20110206 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=65079&edit=1