Corveda / PHPSandbox

A PHP-based sandboxing library with a full suite of configuration and validation options.
https://phpsandbox.org
Other
220 stars 46 forks source link

Wrong results when an element in an array, has a function name #24

Open mustafaeida opened 3 years ago

mustafaeida commented 3 years ago

For example :

$sandbox = new PHPSandbox; function test ($values) { return $values; } $sandbox->whitelistFunc(['test','dd']); $sandbox->allow_casting = true;

$result = $sandbox->execute(function(){ return test(['required','date', 'copy']); });

print_r( $result , );

peter279k commented 3 years ago

Could you reproduce the issue or the captured picture?

And I can be easy to know where bugs are.

chrisschaetzlein commented 3 years ago

Same problem here. array_key_exists($str, $array) where $str is a PHPSandbox\SandboxedString (e.g. "date") produces an error: array_key_exists(): The first argument should be either a string or an integer

mustafaeida commented 3 years ago
Screen Shot 2021-01-20 at 8 18 03 AM Screen Shot 2021-01-20 at 8 17 42 AM
mustafaeida commented 3 years ago

I tried to solve this problem through Modify a file this path vendor/corveda/php-sandbox/src/functions.php

line 17 return is_callable($strval) ? new SandboxedString($strval, $sandbox) : $value; to : return is_callable($strval) ? $strval : $value;

line 32 return new SandboxedString($value, $sandbox); to : return $value;

But I am not sure of the feasibility of this solution