robrichards/xmlseclibs

Error on regular expression causes preg_replace to fail

Closed this issue · 2 comments

on file https://github.com/robrichards/xmlseclibs/blob/master/src/Utils/XPath.php

this constant

const EXTENDED_ALPHANUMERIC = '\w\d\s-_:\.';

should be changed to this:

const EXTENDED_ALPHANUMERIC = '-\w\d\s_:\.';

as this string is substituted inside a character class on the regexp, and the - character is considered a range operator unless it appears in the first position in the class, causing preg_replace to throw an error and signature validation to fail:

preg_replace(): Compilation failed: invalid range in character class at offset 8

This has already been fixed in the file you link. As you can see the - has been properly escaped there. Were you perhaps using an old version of the library?

Yes, sorry