Remove any usage of eval(). That is not considered secure approach by any standards for validating an array.

Comments

ram4nd created an issue. See original summary.

alpha2zee’s picture

alpha2zee commented
Assigned: Unassigned » alpha2zee

Hi. Thanks for the suggestion. In the module's code, 'eval' is not used to validate input as array. Rather, the input itself is made into an array with 'eval'.

eval('$config = array(' . $settings['htmLawed']['config'] . ');');

Currently, I cannot think of an alternative to this. Let me know if you can.

Yes, it is possible that the form-field value ($settings['htmLawed']['config']) can be misused to pass evil PHP commands, but there is no reason why the site admin (who sets the htmLawed filter and gets to use the form-field) will do so.

alpha2zee’s picture

alpha2zee commented
Status: Active » Closed (won't fix)
ram4nd’s picture

ram4nd commented
Status: Closed (won't fix) » Active

Why close the issue? We both agree that it isn't a good solution. From the top of my head you could use another format for the configuration. Maybe json, I am sure there are external modules that enable you to edit json. Also there is yaml. Plenty of options to get rid of eval where it's not essential.

alpha2zee’s picture

alpha2zee commented
Status: Active » Closed (won't fix)

Sorry, I don't think use of 'eval' is an issue. Note that 'eval' gets called only during htmLawed module configuration, which is done by site administrator, who already has enough privileges to do bad things if they want to.

I am closing this issue. I hope you respect my decision as module developer. If you come up with alternate code, please post in a new issue. I will be happy and thankful to consider using it.