4 ms·
I wonder what kind of security vulnerabilities could be looming in validators not expecting non-ascii 0-9 digits and using this regex?
by 0x0 13y ago
I wonder what kind of security vulnerabilities could be looming in validators not expecting non-ascii 0-9 digits and using this regex?
- hdragomir 13y agoThat's exactly what I was thinking!
- duaneb 13y agoI'm betting quite a few. People should use library number parsers, even if they reject all non-[0-9].
- deleted 13y ago[deleted]
- trebor 13y agoAs of PHP 5.3, PHP-powered software is safe. Using is_numeric('١٣٦٨') // -> false preg_match('/\d/', '١٣٦٨') // -> no match / false filter_var('١٣٦٨', FILTER_VALIDATE_INT) // -> false Which I'm thankful for. I should hope that most people understand base-10 and ascii numbers. I don't want to have to worry about properly validating/handling unicode characters with number parsing.
- 0x0 13y agoIn PHP 5.4.15, I get: var_dump(preg_match('/\d/u', '١٣٦٨')) -> 1 var_dump(preg_match('/\d/', '١٣٦٨')) -> 0