Dangerous Function: Unsafe Regular Expression

Functions that cannot be used safely should never be used.

Certain functions behave dangerously regardless of how they are used. Functions in this category were often implemented without consideration for security.

Example 1: Given the URL http://www.example.com/index.php?param=..., the following snippet of php within index.php will print the value of the URL parameter param (passed in-place of the "...") to the screen if it matches the POSIX regular expression '^[[:alnum:]]*$' representing "zero or more alphanumeric characters":

  <?php
    $pattern = '^[[:alnum:]]*$';
    $string = $_GET['param'];
    if (ereg($pattern, $string)) {
      echo($string);
    }
  ?>

While Example 1 operates as expected with alphanumeric input, because the unsafe ereg() function is used to validate tainted input, it is possible to carry out a cross-site scripting (XSS) attack via null byte injection. By passing a value for param containing a valid alphanumeric string followed by a null byte and then a <script> tag (e.g. "Hello123%00<script>alert("XSS")</script>"), ereg($pattern, $string) will still return true, as the ereg() function ignores everything following a null byte character when reading the input string (left-to-right). In this example, this means that the injected <script> tag following the null byte will be displayed to the user and evaluated.