Skip to content

Commit

Permalink
remove EVAL bandaid in MAKE_REGEX for now
Browse files Browse the repository at this point in the history
Escaping characters obscures the actual injection attack vulnerability,
and breaks other things.  (A better solution will be to not use interpolation.)
  • Loading branch information
TimToady committed Apr 22, 2015
1 parent 049fe61 commit 7bef4a3
Showing 1 changed file with 2 additions and 10 deletions.
12 changes: 2 additions & 10 deletions src/core/Cursor.pm
Expand Up @@ -298,16 +298,8 @@ sub MAKE_REGEX($arg, :$i) {
$arg.regex
}
else {
my Mu $chars := nqp::split('', $arg);
my $k := 0;
my $iter := nqp::iterator($chars);
while $iter {
my $ord := nqp::ord( nqp::shift($iter) );
nqp::bindpos($chars, $k, "\\c[$ord]") if $ord <= 32;
$k := $k + 1;
}
my $arg2 := nqp::join('', $chars);
my $rx := $i ?? EVAL("anon regex \{ :i ^$arg2\}") !! EVAL("anon regex \{ ^$arg2\}");
# XXX the following misuses ^ to turn off scanning
my $rx := $i ?? EVAL("anon regex \{ :i ^ $arg\}") !! EVAL("anon regex \{ ^ $arg\}");
$arg does CachedCompiledRegex($rx);
$rx
}
Expand Down

0 comments on commit 7bef4a3

Please sign in to comment.