enygma / expose

An Intrusion Detection System library loosely based on PHP IDS
MIT License
266 stars 55 forks source link

Manager::setException() problem #70

Open geralt opened 8 years ago

geralt commented 8 years ago

Hi, working with exceptions I've seen one problem. If I use manager's method setException() and I declare and exception with value = "(.)+" in this way (and and for sure there is more string combinations):

$manager->setException('(.)+');

I exclude all variables to the Expose's analysis. In other words: I could baypass Expose. One posible solution may be adding preg_quote() into the code of isException() function. Replacing:

if($path === $exception || preg_match('/^'.$exception.'$/', $path) !== 0) {

with:

if($path === $exception || preg_match('/^'.preg_quote($exception, '/').'$/', $path) !== 0) {

Regards.