Rule Definition
Using preg_replace with /e option or raw user input can expose code to remote code execution.
Remediation
Use preg_replace_callback instead.
Violation Code Sample
<?php
echo preg_replace("/.*/ei", 'toreplace', 'input');
?>
Fixed Code Sample
<?php
function replace_callback() {
return 'toreplace';
}
echo preg_replace_callback("/.*/i", replace_callback, 'input');
?>
Reference
http://php.net/manual/en/function.preg-replace.php
https://cwe.mitre.org/data/definitions/624.html
Related Technologies
Technical Criterion
CWE-624 - Executable Regular Expression Error
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.