The product uses a regular expression that does not
sufficiently restrict the set of allowed values.
Extended Description
This effectively causes the regexp to accept substrings that match the
pattern, which produces a partial comparison to the target. In some cases,
this can lead to other weaknesses. Common errors include:
not identifying the beginning and end of the target string
using wildcards instead of acceptable character ranges
others
Time of Introduction
Implementation
Applicable Platforms
Languages
Perl
PHP
Demonstrative Examples
Example 1
(Bad Code)
Perl
$phone = GetPhoneNumber();
if ($phone =~ /\d+-\d+/) {
# looks like it only has hyphens and digits
system("lookup-phone $phone");
}
else {
error("malformed number!");
}
An attacker could provide an argument such as: "; ls -l ; echo
123-456" This would pass the check, since "123-456" is sufficient to
match the "\d+-\d+" portion of the regular expression.
insertion of username into regexp results in
partial comparison, causing wrong database entry to be updated when one
username is a substring of another.
Description
