I am receiving an alert in JED Checker, the line of code that generates the alert contains str_replace which is used to replace of spaces with hyphens.
Here the code:
$uniqueFilter = array_unique($unique_filter); foreach ($uniqueFilter as $filter) { echo '<a href="#" class="filter-item" data-group=".'.str_replace(' ', '-', $filter).'">'.$filter.'</a>'; } I would like to know if str_replace or preg_replace is a danger and why they have it marked to generate an alert.
This is an unnecessarily strict rule and it has already been removed in code base. The change should be reflected in the next major JED Checker release. See this commit for reference.
strstr() in production code. Why is it blacklisted. Who came up with [\s/\*\w\W\(]? I'd like to hear what their intention was. That subpattern reveals a lack of regex understanding. Keep in mind that:
this script gives out many false-positive files, as it is not "ironed out" yet, so be cautious
https://github.com/btoplak/Joomla-Anti-Malware-Scan-Script--JAMSS-/blob/master/README.md#status says:
BETA - This is a "work in progress" so let me know if you have any problems, found bug, have questions or wish to help in some way.
That said, I must assume that the script doesn't like that you aren't calling htmlspecialchars() on a variable being printed into an html document. Have a read of https://stackoverflow.com/q/4882307/2943403 and https://stackoverflow.com/a/46491/2943403. I don't see any potential vulnerability in executing that very trivial string manipulation with str_replace() -- I think this is a red herring.
If you, yourself, are worried about this being an attack vector, then you should sanitise the string as much as possible. Will it contain only letters? letters and numbers? any allowed symbols? A regex to strip unwelcome characters could be a good idea.
I might code it like this:
foreach (array_unique($unique_filter) as $filter) { printf( '<a href="#" class="filter-item" data-group="%s">%s</a>', htmlspecialchars(str_replace(' ', '-', $filter)), htmlspecialchars($filter) ); } This way you:
$uniqueFilter andhtmlspecialchars, even pasting the full code, but the alert continues. I am converting Joomla tag and category names to classes. I know it is a false alert, what I would like is to know if str_replace is dangerous as described in JAMSS