Skip to content

Commit db02ca7

Browse files
authored
Restrict regex delimiters allowed (#598)
Fixes #597
1 parent d0393f0 commit db02ca7

File tree

2 files changed

+25
-2
lines changed

2 files changed

+25
-2
lines changed

src/RegexChecker.php

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,7 @@ public function isRegexLike(string $value): bool
4343

4444
$firstCharacter = $value[0];
4545

46-
if ('\\' === $firstCharacter) {
47-
// This is not ideal as not true.
46+
if (!self::isValidDelimiter($firstCharacter)) {
4847
return false;
4948
}
5049

@@ -76,6 +75,13 @@ public function validateRegex(string $regex): ?string
7675
);
7776
}
7877

78+
private static function isValidDelimiter(string $delimiter): bool
79+
{
80+
// This is not ideal as not true but is good enough for our case.
81+
// See https://github.com/humbug/php-scoper/issues/597
82+
return '\\' !== $delimiter && native_preg_match('/^\p{L}$/u', $delimiter) === 0;
83+
}
84+
7985
private static function isValidRegexFlags(string $value): bool
8086
{
8187
if ('' === $value) {

tests/RegexCheckerTest.php

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,11 +69,18 @@ public static function regexLikeProvider(): iterable
6969
false,
7070
];
7171

72+
// See https://github.com/humbug/php-scoper/issues/597
7273
yield 'fake regex (1)' => [
7374
'\Foo\A',
7475
false,
7576
];
7677

78+
// See https://github.com/humbug/php-scoper/issues/597
79+
yield 'fake regex (2)' => [
80+
'Bar\WB',
81+
false,
82+
];
83+
7784
yield 'minimal fake regex' => [
7885
'////',
7986
false,
@@ -84,6 +91,16 @@ public static function regexLikeProvider(): iterable
8491
true,
8592
];
8693

94+
yield 'regular regex with flags (1)' => [
95+
'~foo~iu',
96+
true,
97+
];
98+
99+
yield 'regular regex with flags (2)' => [
100+
'#foo#iu',
101+
true,
102+
];
103+
87104
yield 'regular regex with invalid flags' => [
88105
'/foo/NOPE',
89106
false,

0 commit comments

Comments
 (0)