1 system.mail.inc | protected static DefaultMailSystem::_isShellSafe($string) |
Disallows potentially unsafe shell characters.
Functionally similar to PHPMailer::isShellSafe() which resulted from CVE-2016-10045. Note that escapeshellarg and escapeshellcmd are inadequate for this purpose.
@todo Rename to ::isShellSafe() and/or discuss whether this is the correct location for this helper.
Parameters
string $string: The string to be validated.
Return value
bool: True if the string is shell-safe.
See also
https://github.com/PHPMailer/PHPMailer/issues/924
https://github.com/PHPMailer/PHPMailer/blob/v5.2.21/class.phpmailer.php#...
File
- core/
modules/ system/ system.mail.inc, line 124 - Backdrop core implementations of MailSystemInterface.
Class
- DefaultMailSystem
- The default Backdrop mail backend using PHP's mail function.
Code
protected static function _isShellSafe($string) {
if (escapeshellcmd($string) !== $string || !in_array(escapeshellarg($string), array("'$string'", "\"$string\""))) {
return FALSE;
}
if (preg_match('/[^a-zA-Z0-9@_\-.]/', $string) !== 0) {
return FALSE;
}
return TRUE;
}