POSIX Regex와 PCRE Regex

PHP 5.3.0부터 POSIX Regex 대신 PCRE Regex가 사용된다. (PHP 6.0부터 완전 제거)

자세한 내용은 아래를 참고하면 된다.

http://php.net/manual/en/reference.pcre.pattern.posix.php

 

As of PHP 5.3.0, the POSIX Regex extension is deprecated. There are a number of differences between POSIX regex and PCRE regex. This page lists the most notable ones that are necessary to know when converting to PCRE.

1. The PCRE functions require that the pattern is enclosed by delimiters.
2. Unlike POSIX, the PCRE extension does not have dedicated functions for case-insensitive matching. Instead, this is supported using the i (PCRE_CASELESS) pattern modifier. Other pattern modifiers are also available for changing the matching strategy.
3. The POSIX functions find the longest of the leftmost match, but PCRE stops on the first valid match. If the string doesn't match at all it makes no difference, but if it matches it may have dramatic effects on both the resulting match and the matching speed. To illustrate this difference, consider the following example from "Mastering Regular Expressions" by Jeffrey Friedl. Using the pattern one(self)?(selfsufficient)? on the string oneselfsufficient with PCRE will result in matching oneself, but using POSIX the result will be the full string oneselfsufficient. Both (sub)strings match the original string, but POSIX requires that the longest be the result.
4. The POSIX definition of a "character class" differs from that of PCRE. Simple bracket expressions to match a set of explicit characters are supported in the form of PCRE character classes but POSIX collating elements, character classes and character equivalents are not supported. Supplying an expression with a character class that both starts and ends with :, . or = characters to PCRE is interpreted as an attempt to use one of these unsupported features and causes a compilation error.

 

 

그러다보니 PHP 5.3.0 이상 버전에서 POSIX Regex 함수들을 우회할 수 있는 방법이 있다.

 

<?php
    $id = $_GET[id];
 
    if(!isset($_GET[id])) {
        exit();
    }
 
    if(eregi("admin", $id)) {
        print('<br>guest');
    } else {
        print("<br>$id");
    }
?>

위와 같이 id 값으로 admin을 출력하고 싶을 경우에 admin을 입력을 하면 eregi() 함수 때문에 guest가 출력이 된다.

이때, %00(NULL)을 입력하고 admin을 입력해주면 eregi() 함수를 우회하여 admin을 출력할 수 있다.

---

PHP 5.2에서 동일한 코드로 실험을 해보면 우회가 되지 않는 것을 확인할 수 있다.

다른 방법으로 PHP 5.3에서 문자 중간에 %00(NULL)을 입력하면 admin이 출력이 되는 것을 확인할 수 있다. 

다시 PHP 5.2에서 입력해보면 admin이 정상적으로 출력이 되지 않는 것을 확인할 수 있다.