1

As interim solution to an issue in JavaScript, I changed the User module code, to disallow single quotation mark. I changed the following line.

if (preg_match('/[^\x{80}-\x{F7} a-z0-9@_.\'-]/i', $name)) {

After my edit, it becomes as follows.

if (preg_match('/[^\x{80}-\x{F7} a-z0-9@_.-]/i', $name)) {

One of our senior Drupal developers said that this is not an acceptable solution because it could open up the site to serious security risks and it could potentially lead to a security flaw around form injection.

I do not understand why that could happen. Can anyone explain me why?

PS. I understand that this will get overwritten on Drupal update. This was to temporarily prevent serious bug that is blocking the whole page from functioning.

0

So it turns out the regexp is not for avoiding apostrophes but to allow them, you can track down the origin to this issue to 6 years ago: https://drupal.org/node/266488

I've added apostrophe support(+test) and a small change in check_plain() as proposed in http://drupal.org/node/165226 in the new version of the patch.

So it would be not due a security flaw but to have names with apostrophes correctly handled as you can see in the issue above:

One of my friends is fortunate, or unfortunate, enough to have an apostrophe in his last name. Many first and last names have this, for example: O’Reilly.

The crazy thing is: Drupal completely ignores this, and O'Reilly becomes OReily

The reason why this is crashing your site is hard to foresee, I stand that you might be fixing the symptoms here and not the cause by changing the regexp. Check the username databse you've got for strange chars.

If you want to have a way to modify this validation pattern, you can check this module Custom username validation.

  • 1
    single quote is allowed by default in Drupal this change was to disallow it – user32219 Jun 17 '14 at 18:44
  • Oh, you're right, I've tracked down the origin of the code here: drupal.org/node/266488 updating my answer – pcambra Jun 17 '14 at 18:58
  • Im not looking for a solution. I just want to know if excluding this character from allowed can create described security risks – user32219 Jun 17 '14 at 19:01
  • Just updated my answer accordingly. – pcambra Jun 17 '14 at 19:05
  • 1
    The reason why this is crashing the site is very clear. JS developer injected usernames into JS code without escaping special characters. Tnx for your answer. – user32219 Jun 17 '14 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.