note 102603 added to function.class-alias

paul [dot] kotets [at] gmail [dot] com:

I've got a nice code injection attack for your "replacement" function for class_alias:

<?php
if (!function_exists('class_alias')) {
    function class_alias($original, $alias) {
        eval('abstract class ' . $alias . ' extends ' . $original . ' {}');
    }
}

$alias = 'some_class extends existingClass {function _print(){ print 1;}}; some_class::_print(); class my_class';
class_alias( 'existingClass', $alias ); 

// prints "1" - and thats safe!!! imagine what could be done if exploited.
?>
----
Server IP: 69.147.83.197
Probable Submitter: 58.167.252.166
----
Manual Page -- http://www.php.net/manual/en/function.class-alias.php
Edit        -- https://master.php.net/note/edit/102603
Del: integrated  -- https://master.php.net/note/delete/102603/integrated
Del: useless     -- https://master.php.net/note/delete/102603/useless
Del: bad code    -- https://master.php.net/note/delete/102603/bad+code
Del: spam        -- https://master.php.net/note/delete/102603/spam
Del: non-english -- https://master.php.net/note/delete/102603/non-english
Del: in docs     -- https://master.php.net/note/delete/102603/in+docs
Del: other reasons-- https://master.php.net/note/delete/102603
Reject      -- https://master.php.net/note/reject/102603
Search      -- https://master.php.net/manage/user-notes.php