Problem with fapi regex validation with special characters

It raises a security issue.

Problem is not the Variable "$value" before the check which is unchecked/insecure data anyways. Imho there should also be no problem with preg_match.

Problem is that the result after the check is considered a checked/trusted value. Which cannot be the case if checkPlain fails. You ought to call it at least somewhere before using the input.

In other words either check_plain does something incorrectly(e.g. replacing some '&xxx' where it shouldn't) or the input is indeed to be considered a security risk.

Edit/clarification: Not "$value" itself but "$_POST['value']" is the problem. We need to check the sanitized $_POST['value'] for this is(or ought to be) the real used value . Besides the security problem with the input it might even render the whole check useless in some cases if check_plain is skipped. Because we check something completely different than (ought to be) used/accepted as input(input that has undergone check_plain replacement).

USER Input  ---- AJAX ----> Verify Input
  ^                                |  
  |                                |
  |      +    <------- AJAX -------+
  +---  ok?
 NO     |
        |Yes
        |
     Submit ------ Serverside -> Verify Input
                                      |
                                      | OK? <---BOOOM here

see also this comment in the referenced child

I suggest we use this patch, in fapi_validation there is no check_plain for this rule so we are good to use it even in client side.

function fapi_validation_rule_regexp($value, $params) {
  return (bool) preg_match($params[0], (string) $value);
}