Re: pcre: shouldn't pass BAD_ESCAPE_IS_LITERAL by default
| From: | Nikita Popov | Date: | Fri, 08 Feb 2019 11:01:39 +0000 |
| Subject: | Re: pcre: shouldn't pass BAD_ESCAPE_IS_LITERAL by default | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-104306@lists.php.net to get a copy of this message | ||
On Fri, Feb 8, 2019 at 11:57 AM Sjon Hortensius <sjon@hortensius.net> wrote:
> Hi internals,
>
> PHP enables bad_escape_is_literal by default when using pcre methods - this
> results in invalid escape-patterns (such as \i) being interpreted as a
> literal
i. This option is documented in pcre as "a
> dangerous option. Use
> with care" - and the pcre author raised concern about PHP enabling this by
> default (see https://bugs.exim.org/show_bug.cgi?id=2362 ).
>
> I agree and I'd like to propose to disable this in the next major version.
> The existing modifier to disable this (X - PCRE_EXTRA) can be removed as
> well. Would this require an RFC ?
>
This change sounds reasonable and I don't think it needs an RFC if there
are no disagreements on list.
Nikita