Security implications of e modifier in preg_replace()

I don't think there's a security issue here, at least in Pathologic's case.

The worry is that the e flag in the preg_replace() RegEx that Pathologic uses to replace href values will allow Mallory to enter code that matches the RegEx pattern, but when executed, does something malicious -- an eval injection, similar to an SQL injection.

However, since the values are offset by double quotes in the eval'd string, the malicious matching pattern would have to have a double quote character in it to close the quoting and start doing something malicious; a pattern like:

"; db_query("TRUNCATE TABLE {node}"); "

However, this cannot happen because the RegEx that Pathologic uses to find the values will not allow a double quote character in a matched value. So I don't think there's anything to worry about in this case…

For added safety, maybe I ought to make it so semicolon (;) characters can't be in a matched value either -- is that a valid character in URIs in the first place? Double-check.

The relevant code (in the D6 version of the module) is:

			$text = preg_replace('|href="([^/][^#:"]+)#?([^:"]*)"|e',
				"'href=\"' . url(\"$1\", array(
					'external' => FALSE,
					'fragment' => \"$2\",
					'absolute' => TRUE,
					)) . '\"'",
				$text);