Re: [PHP4BETA] Dangerous PCRE security error

Samuel Liddicott wrote: > look: GetDebugLine( [' defmenuopt(e, 0, "Check", '] [\2] > [');'] ) > > Thats not valid code, so its invalid. My point was, if some escaping was > possible, it might be made valid by use of AddSlashes... I still don't understand what the above means. > No. Look, this text (mere text) is passed to a pcre for matching: > defmenuopt(e, 0, "Check", '.unlink("/linux/boot").'); > > and then I want to eval some PHP to calculate the replacement. That is what > /e is for. There is NO WAY to stop the matched text become eval'ed in a > context other than paramter to function. Carefully crafted user-supplied > text could be written to cause the php to do things other than what the > designer wanted. The example shows the program matching on a string that > contains an some words including unlink, yet it is impossible to pass this > safely as a parameter to the GetDebugLine() /e function. > > AddSlashes and EscapeShellCmd all admit this need in their various scopes, I > think we need one for PCRE /e You as the scripter should not rely on user data that way. If you have safe_mode enabled then certains things are disallowed when eval() runs. Adding slashes is not a real solution because you wouldn't want to backslash all ' or " and also having it be automated will result in more confusion. -Andrei Linux is like living in a teepee. No Windows, no Gates, Apache in house. - Usenet signature