Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:104306
MIME-Version: 1.0
References: <CAK_tfuYzoo7kVtZzis=eJqR4PRpVFeXC01YAGMqQV+2jjwLJ2A@mail.gmail.com>
 <CAK_tfubomBaiPUFKgt7SCWYVp+aLT=XjcL6vinmsYZ0TvCXF7A@mail.gmail.com>
In-Reply-To: <CAK_tfubomBaiPUFKgt7SCWYVp+aLT=XjcL6vinmsYZ0TvCXF7A@mail.gmail.com>
Date: Fri, 8 Feb 2019 12:01:39 +0100
Message-ID: <CAF+90c9k3aCJ+q_Ct4kRKbFnYQj=PyT+CB70EJJoLKbxRndjcA@mail.gmail.com>
To: Sjon Hortensius <sjon@hortensius.net>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000001837ac05815fe3c8"
Subject: Re: [PHP-DEV] pcre: shouldn't pass BAD_ESCAPE_IS_LITERAL by default
From: nikita.ppv@gmail.com (Nikita Popov)

--0000000000001837ac05815fe3c8
Content-Type: text/plain; charset="UTF-8"

On Fri, Feb 8, 2019 at 11:57 AM Sjon Hortensius <sjon@hortensius.net> wrote:

> Hi internals,
>
> PHP enables bad_escape_is_literal by default when using pcre methods - this
> results in invalid escape-patterns (such as \i) being interpreted as a
> literal `i`. This option is documented in pcre as "a dangerous option. Use
> with care" - and the pcre author raised concern about PHP enabling this by
> default (see https://bugs.exim.org/show_bug.cgi?id=2362 ).
>
> I agree and I'd like to propose to disable this in the next major version.
> The existing modifier to disable this (X - PCRE_EXTRA) can be removed as
> well. Would this require an RFC ?
>

This change sounds reasonable and I don't think it needs an RFC if there
are no disagreements on list.

Nikita

--0000000000001837ac05815fe3c8--