1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-09-22 18:28:47 +02:00
phorge-phorge/src/applications/macro/controller
epriestley 969d0c3e8d Use "\z" instead of "$" to anchor validating regular expressions
Summary:
Via HackerOne. In regular expressions, "$" matches "end of input, or before terminating newline". This means that the expression `/^A$/` matches two strings: `"A"`, and `"A\n"`.

When we care about this, use `\z` instead, which matches "end of input" only.

This allowed registration of `"username\n"` and similar.

Test Plan:
  - Grepped codebase for all calls to `preg_match()` / `preg_match_all()`.
  - Fixed the ones where this seemed like it could have an impact.
  - Added and executed unit tests.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: aran, epriestley

Differential Revision: https://secure.phabricator.com/D8516
2014-03-13 12:42:41 -07:00
..
PhabricatorMacroAudioController.php Simplify PHUIObjectBoxViews handling of Save and Error states 2014-01-10 09:17:37 -08:00
PhabricatorMacroCommentController.php Use setContentSourceFromRequest() in more places 2013-05-24 10:48:34 -07:00
PhabricatorMacroController.php Modernize policies in Paste and Macro 2013-10-16 10:35:52 -07:00
PhabricatorMacroDisableController.php Fix incorrect check for CAN_EDIT in macro enable/disable controller 2013-11-09 16:34:26 -08:00
PhabricatorMacroEditController.php Use "\z" instead of "$" to anchor validating regular expressions 2014-03-13 12:42:41 -07:00
PhabricatorMacroListController.php Update pinboard view styles, move to PHUI 2013-08-07 10:58:09 -07:00
PhabricatorMacroMemeController.php Make most file reads policy-aware 2013-09-30 09:38:13 -07:00
PhabricatorMacroMemeDialogController.php Turn the macro selector into a tokenizer 2013-11-25 19:22:06 -08:00
PhabricatorMacroViewController.php Move PhabricatorTagView to PHUITagView 2014-01-14 14:09:52 -08:00