search

Corveda / PHPSandbox

A PHP-based sandboxing library with a full suite of configuration and validation options.
https://phpsandbox.org
Other
220 stars 46 forks source link

Strings not escaped correctly in PHPSandbox::prepareVars #5

Closed jecknig closed 8 years ago

jecknig commented 8 years ago

The following code will fail:

$sandbox = new PHPSandbox\PHPSandbox;
$sandbox->defineVar('test', "\\'");
$sandbox->execute("echo $test;")

The problem is caused by line 6487 in src/PHPSandbox.php:

$output[] = '$' . $name . " = '" . addcslashes($value, "'") . "'";

The string \' will be escaped to \\', so the \ will be considered as escaped by PHP but not the '.

Replacing the line by

$output[] = '$' . $name . " = '" . addcslashes($value, "'\\") . "'";

would solve the problem