#47796 [Opn]: preg_replace /e modifier allows unexpected code execution

 ID:               47796
 User updated by:  spam04 at pornel dot net
 Reported By:      spam04 at pornel dot net
 Status:           Open
 Bug Type:         PCRE related
 Operating System: *
 PHP Version:      5.2.9
 New Comment:

I forgot to add echo before preg_replace() in reproduce code.


Previous Comments:
------------------------------------------------------------------------

[2009-03-26 22:36:08] spam04 at pornel dot net

Description:
------------
preg_replace does not escape $ character. If double quotes are used in

replacement code, this enables unwanted injection of variables or even

execution of PHP code.

My suggestion is to escape $ character and discourage use of single 
quotes in replacement code (because they're not compatible with the way

$ and " are escaped).


Reproduce code:
---------------
// simple case:
preg_replace('/.*/e','strtoupper("$0")', '$foo');

// code execution:
class test
{
    function pwnd() {echo "pwnd!\n";}
    
    function replace($str)
    {
        preg_replace('/.*/e','strtoupper("$0")', $str);
    }
}

$t = new test();
$t->replace('{$this->pwnd()}');


Expected result:
----------------
$FOO
{$THIS->PWND()}

Actual result:
--------------
PHP Notice:  Undefined variable: foo
pwnd!


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=47796&edit=1