Per http://drupal.org/node/750148 it would be useful to add a check for the user of the /e flag in preg_replace() since this can readily lead to arbitrary code execution vulnerabilities and should be flagged as insecure.

The solution is to use preg_replace_callback() instead.

Comments

john morahan’s picture

john morahan commented

Here's the rule I've been using (sorry I thought I had posted this already)...

   array(
      '#type' => 'regex',
      '#source' => 'allphp', // allow us to look inside the regex string
      '#value' => '\bpreg_replace\s*\(\s*(\'(.)([^\'\\\\]|\\\\.)*\\2([^\'\\\\]|\\\\.)*|"(.)([^"\\\\]|\\\\.)*\\5([^"\\\\]|\\\\.)*)e',
      '#warning' => "Use preg_replace_callback() instead of the 'e' modifier to preg_replace()",
      '#severity' => 'critical',
    ),
stella’s picture

stella commented
Status: Active » Fixed

Committed to 6.x-2.x and 7.x branches, along with tests.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.