search

letsdrink / ouzo

Ouzo Framework - PHP MVC ORM
https://github.com/letsdrink/ouzo
MIT License
70 stars 8 forks source link

Is `Strings` vulnerable to regexp injection by design? #276

Open danon opened 6 years ago

danon commented 6 years ago

This usage emits a warning and reveals underlying implementation:

Strings::sprintAssoc("This is %{what}! %{what}? This is %{+}!", [
    '+' => 'madness',
]);
preg_replace(): Compilation failed: nothing to repeat at offset 3

And also, you can't use unquoted slash /.

Strings::replaceNth($uri, 'http://www', '', 2);
preg_match_all(): Unknown modifier 'w'

Is this by design?