Is regular expression matching desirable to the maintainer or is it missing for some reason.
VBO Search & Replace looks like a very nice setup, adding regex as an "advanced" option would be very simple.
The only reason I see not to is it's VERY dangerous, a regex is not nearly as predictable and it's effects can be different on each node depending on content. If you get it really wrong using a <span.*</span> instead of a <span.*?</span> you could delete most of all your posts.

I've added it and used it. I could post a patch, but only if it's welcome.
And having used it on my own site I think a "test run" option would be really useful and I want to add that first.

CommentFileSizeAuthor
#13 2679733-13.patch3.75 KBtenken
#8 2679733-8.patch2.36 KBymeiner

Comments

haleagar created an issue. See original summary.

haleagar’s picture

Category: Bug report » Feature request
npacker’s picture

Please post the patch, I'd like to at least see it.

With Backup and Migrate I don't think the risk is that large. I can see only exposing regex matching as an advanced option helping.

AnticoVeneziano’s picture

it would be very useful!
perfect for hunting down the typos in long texts,
especially when written by inexperienced users
please...

ElemAm024’s picture

I second this - please post the patch! The ability to do a regex search would be SO useful

tenken’s picture

I'd be happy to use the patch. I would like to do a regex search, and then a string replace with a token value. Your patch would be 1/2 the work needed.

knipnehpets’s picture

I'd love the patch. Could you send it to me? Rgds,
Ditto #7, if this had Regex *and* Tokens, it would be a killer module

As it is, very useful, because it lets me alter fields in commerce product types (other ones are typically restricted to nodes).

ymeiner’s picture

StatusFileSize
new2.36 KB

I gave it a shot,

please look at my diff.

The extra option allows to use regex and cancels whatever is in the prefix, suffix, exact match and case sensitive since we can put it all in the regexp.

* There is an extra fix there for a mistake in a var ($settings vs $options)

damienmckenna’s picture

Status: Active » Needs review
tenken’s picture

Patch in #8 works for me on a test website. We may end up using it in production as well as I've reviewed the patch and see no issues at this time.

npacker’s picture

This will need some additional work before release as preg_replace presents an arbitrary PHP execution attack surface via the "e" flag.

npacker’s picture

Status: Needs review » Needs work
tenken’s picture

StatusFileSize
new3.75 KB

Here is a reroll of the patch against current -dev.

Originally I found this StackOverflow approach to striping the e modifier, which this patch is inspired from.
https://stackoverflow.com/q/7243073

Since php does not provide a way to disable the e modifier at runtime, the simplest solution I have opted to implement was to scan for the modifier and if found deny any vbo processing to occur until the enduser provides a regex that does not make use of the e modifier. For added UX I have amended the description of the advanced form item to note that "e" modifier is not permitted.

Although, this issue appears to only exist in PHP < 7.0, I have additionally I've added a check for the php version in the code.
http://php.net/manual/en/reference.pcre.pattern.modifiers.php

tenken’s picture

Status: Needs work » Needs review

I believe the supplied patch now meets the needs of assuring additional security for the e modifier. Additional feedback from the community, bot(s), or the maintainer is appreciated.

npacker’s picture

This looks like a sound solution to me.

  • npacker committed acf367b on 7.x-1.x
    Issue #2679733 by ymeiner, tenken, npacker: regular expression matching
    
npacker’s picture

Status: Needs review » Fixed

Committed to the dev branch. I added in a permission to control access to the regular expression option as there is a lot of potential to nuke a site with this capability. Thanks to all that contributed.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.