Re: [Rdfapi-php-interest] SparqlEngine / regex passes?

[Christian W. <cw...@cw...>]

S=F6ren,


> Good job in detecting the security hole! But I guess it would be more
> constructive to post a patch to close the hole instead of an exploit ;-=
)
The current implementation makes it IMO not possible to close the hole
fully.

It works the following way:
sparql filter string -> some preg replaces -> eval
Since there is no state machine/parser in the background which only
accepts valid code and drops invalid - all code is used, just some cases
like str() or dateTime() are re-formatted - it is not possible to fix
it. A total new approach and code would be needed.

--=20
Regards/Mit freundlichen Gr=FC=DFen
Christian Weiske