Hi,
Our Admin Tools "PHP File Scanner" flagged a file with a threat score of 52, and I wanted to pass this along in case it's useful.
File: components/com_comprofiler/plugin/user/plug_cbcore/library/Field/PredefinedField.php
The flagged part is the $aliasReg regex used for the unicodeslugs setting (the big Unicode character-class pattern with the comment mentioning regexpu/ES2015).
I'm not a PHP developer myself, so I can't really judge whether this needs fixing, but I ran it by an AI assistant out of curiosity and it gave the following take:
- It doesn't look like a security vulnerability (no code execution / injection / ReDoS risk)
- However, it pointed out that the \uXXXX escapes and surrogate-pair notation in the pattern look like they're straight from a JavaScript regex (regexpu output for ES5), and aren't valid PCRE syntax in PHP
- It suggested this might mean the Unicode slug validation doesn't actually behave as intended, especially on newer PHP versions (possibly PHP 8+)
Just to be clear, this is only an AI's read of the code – I haven't verified any of it myself or tested actual behavior on my site.
Could someone from the team take a look and confirm whether this is something worth fixing, or if I'm off base?
Thanks!
