pcre: shouldn't pass BAD_ESCAPE_IS_LITERAL by default

7 years ago by Sjon Hortensius — view source — reply

unread

Hi internals,

PHP enables bad_escape_is_literal by default when using pcre methods - this
results in invalid escape-patterns (such as \i) being interpreted as a
literal i. This option is documented in pcre as "a dangerous option. Use
with care" - and the pcre author raised concern about PHP enabling this by
default (see https://bugs.exim.org/show_bug.cgi?id=2362 ).

I agree and I'd like to propose to disable this in the next major version.
The existing modifier to disable this (X - PCRE_EXTRA) can be removed as
well. Would this require an RFC ?

Cheers,
Sjon

7 years ago by Nikita Popov — view source — reply

unread

Hi internals,

PHP enables bad_escape_is_literal by default when using pcre methods - this
results in invalid escape-patterns (such as \i) being interpreted as a
literal i. This option is documented in pcre as "a dangerous option. Use
with care" - and the pcre author raised concern about PHP enabling this by
default (see https://bugs.exim.org/show_bug.cgi?id=2362 ).

I agree and I'd like to propose to disable this in the next major version.
The existing modifier to disable this (X - PCRE_EXTRA) can be removed as
well. Would this require an RFC ?

This change sounds reasonable and I don't think it needs an RFC if there
are no disagreements on list.

Nikita