From 51dc3b5747501d8123132d08862a60d08c340ab3 Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Fri, 7 Mar 2025 10:51:48 +0200 Subject: [PATCH] Refine regex patterns to improve injection protection. Simplified the regex patterns for detecting and preventing `sleep` and `benchmark` injections. This improves the accuracy and maintainability of the security checks in the member directory code. --- includes/core/class-member-directory.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/includes/core/class-member-directory.php b/includes/core/class-member-directory.php index 198ae7dc..0135a85f 100644 --- a/includes/core/class-member-directory.php +++ b/includes/core/class-member-directory.php @@ -1710,8 +1710,8 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) { $regexp_map = array( '/select(.*?)from/im', '/select(.*?)sleep/im', - "/sleep\(\s*[\"'`]?\s*\d+\s*[\"'`]?\s*\)/im", // avoid any sleep injections - "/benchmark\(\s*[\"'`]?\s*\d+\s*[\"'`]?\s*,.*\)/im", // avoid any benchmark injections + "/sleep\([^)]+\)/im", // avoid any sleep injections + "/benchmark\([^)]+\)/im", // avoid any benchmark injections '/select(.*?)database/im', '/select(.*?)where/im', '/update(.*?)set/im',