Fix ReDoS-bug in string_helper.php
Fix for ReDoS (Regular Expression Denial of Service) / Code Injection
Risk
diff --git a/system/helpers/string_helper.php b/system/helpers/string_helper.php
index 5860e15..28e6ab1 100644
--- a/system/helpers/string_helper.php
+++ b/system/helpers/string_helper.php
@@ -253,7 +253,7 @@
*/
function increment_string($str, $separator = '_', $first = 1)
{
- preg_match('/(.+)'.$separator.'([0-9]+)$/', $str, $match);
+ preg_match('/(.+)' . preg_quote($separator) . '([0-9]+)$/', $str, $match);
return isset($match[2]) ? $match[1].$separator.($match[2] + 1) : $str.$separator.$first;
}
}