oss-security - Re: Re: CVE Request

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 15 Dec 2008 11:32:00 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: jlieskov@...hat.com
Cc: oss-security@...ts.openwall.com,  Raphael Geissert <atomo64+debian@...il.com>
Subject: Re:  Re: CVE Request - roundcubemail

* Jan Lieskovsky:

>> I think this is a documented feature of preg_replace with the "e"
>> flag, comparable to what happens when you use string concatenation to
>> create SQL statements.
>
> Yes, according to:
> http://bugs.php.net/bug.php?id=35960
>
> the behavior of 'e' modifier in the preg_replace function is
> expected and well documented feature:
>
> http://php.net/manual/en/reference.pcre.pattern.modifiers.php

Nowhere in the documentation it says that "" quotes are unsafe when
combined with a sufficiently general capture pattern.

Do you happen to know if it's safe in all cases to use '' quotes
around the capture reference?  For instance, how does PHP deal with
MBCS in the replacement string?

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.