public function Drupal_Sniffs_Semantics_PregSecuritySniff::processFunctionCall in Coder 7.2
Processes this function call.
Parameters
PHP_CodeSniffer_File $phpcsFile: The file being scanned.
int $stackPtr: The position of the function call in the stack.
int $openBracket: The position of the opening parenthesis in the stack.
int $closeBracket: The position of the closing parenthesis in the stack.
Drupal_Sniffs_Semantics_FunctionCallSniff $sniff: Can be used to retreive the function's arguments with the getArgument() method.
Return value
void
Overrides Drupal_Sniffs_Semantics_FunctionCall::processFunctionCall
File
- coder_sniffer/
Drupal/ Sniffs/ Semantics/ PregSecuritySniff.php, line 61
Class
- Drupal_Sniffs_Semantics_PregSecuritySniff
- Check the usage of the preg functions to ensure the insecure /e flag isn't used: http://drupal.org/node/750148
Code
public function processFunctionCall(PHP_CodeSniffer_File $phpcsFile, $stackPtr, $openBracket, $closeBracket, Drupal_Sniffs_Semantics_FunctionCallSniff $sniff) {
$tokens = $phpcsFile
->getTokens();
$argument = $sniff
->getArgument(1);
if ($argument === false) {
return;
}
if ($tokens[$argument['start']]['code'] !== T_CONSTANT_ENCAPSED_STRING) {
// Not a string literal.
// @TODO: Extend code to recognize patterns in variables.
return;
}
$pattern = $tokens[$argument['start']]['content'];
$quote = substr($pattern, 0, 1);
// Check that the pattern is a string.
if ($quote == '"' || $quote == "'") {
// Get the delimiter - first char after the enclosing quotes.
$delimiter = preg_quote(substr($pattern, 1, 1), '/');
// Check if there is the evil e flag.
if (preg_match('/' . $delimiter . '[\\w]{0,}e[\\w]{0,}$/', substr($pattern, 0, -1))) {
$warn = 'Using the e flag in %s is a possible security risk. For details see http://drupal.org/node/750148';
$phpcsFile
->addError($warn, $argument['start'], 'PregEFlag', array(
$tokens[$stackPtr]['content'],
));
return;
}
}
}