Regex injection issue while processing wildcard fixture references

I noticed that referenced fixture name gets injected into regex without any escaping. This results with hard to debug errors during fixtures generation.

Example using quasi namespaces with dots (root_namespace.sub_namespace.sub_sub_namespace):

Example\MyEntity:
    my_entity.first:
        # ...
    my_entity.second:
        # ...

Example\MyEntityFriend:
    my_entity_friend.first:
        my_entity: '@my_entity.first'

Example\MySecondEntity:
    my_second_entity:
        my_entity: '@my_entity.*'

Reference @my_entity.* accepts both MyEntity and MyEntityFriend entities instead of just MyEntity.

Root of the problem is here: https://github.com/nelmio/alice/blob/c019cf4b3c92f987d33ebc5d01b81f51a8973774/src/Definition/Value/FixtureMatchReferenceValue.php#L41

This would fix the problem:

return new self(sprintf('/^%s.*/', preg_quote($reference, '/')));

Is this a feature or a bug?

nelmio / alice

Regex injection issue while processing wildcard fixture references #1078