unicodeslugs regex flagged by scanner – worth a look?

Hi,

Our Admin Tools "PHP File Scanner" flagged a file with a threat score of 52, and I wanted to pass this along in case it's useful.

File: components/com_comprofiler/plugin/user/plug_cbcore/library/Field/PredefinedField.php

The flagged part is the $aliasReg regex used for the unicodeslugs setting (the big Unicode character-class pattern with the comment mentioning regexpu/ES2015).

I'm not a PHP developer myself, so I can't really judge whether this needs fixing, but I ran it by an AI assistant out of curiosity and it gave the following take:

- It doesn't look like a security vulnerability (no code execution / injection / ReDoS risk)
- However, it pointed out that the \uXXXX escapes and surrogate-pair notation in the pattern look like they're straight from a JavaScript regex (regexpu output for ES5), and aren't valid PCRE syntax in PHP
- It suggested this might mean the Unicode slug validation doesn't actually behave as intended, especially on newer PHP versions (possibly PHP 8+)

Just to be clear, this is only an AI's read of the code – I haven't verified any of it myself or tested actual behavior on my site.
Could someone from the team take a look and confirm whether this is something worth fixing, or if I'm off base?

Thanks!

That specific REGEXP is passed to and used by JavaScript and not by PHP. The REGEXP for the PHP side of things is PHP PCRE compatible. So just a false positive since that tool doesn't know what REGEXP is being passed to JavaScript.

More specifically that REGEXP is ran through our getRuleHtmlAttributes function, which builds client side validation rules. That REGEXP itself is passed to a "pattern" client side validation rule, which is handled by JavaScript.

Thanks a lot for the quick and clear explanation!
Good to know it was just the scanner not being able to tell that the pattern was meant for JavaScript rather than PHP. That puts my mind at ease.

Appreciate you taking the time to look into it and clarify.