https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41932 --- Comment #54 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to David Cook from comment #40)
Upon review... the code is not very easy to read at all and I think it might not validate/sanitize the inputs enough, although I haven't done a practical check yet. We want to be careful when it comes to regex inputs. I wish we hadn't added regex to other parts of Koha because it's a nightmare to secure.
While the code is concise, it's very difficult to read. It's Perlish for sure but it makes code review and maintenance much harder. Might be worth breaking the zeropad function into a few different functions and unit testing them...
Upon review, it seems that $filter isn't sufficiently validated.
That said, it looks like we validate some things here but maybe that's the pairs? Yes, it was too compact. I moved a part to _parse_format and rearranged it. Since format is no regex anymore, it can be validated easier (both filter and
I removed the regex feature. Altough I think that matching only should not be a nightmare.. pairs list). -- You are receiving this mail because: You are watching all bug changes.