Widget Customizer: Eliminate reliance on create_function()

[westonruter]

There are concerns that create_function could be used in a RCE exploit, even though var_export is used to ensure the string supplied to the function body format is a valid PHP string literal.

The code in question is:

/*
 * @todo Replace the next two lines with the following once WordPress supports PHP 5.3.
 *
 * $self = $this; // not needed in PHP 5.4
 *
 * $function = function ( $value ) use ( $self, $setting_id ) {
 *              return $self->manager->widgets->prepreview_added_widget_instance( $value, $setting_id );
 * };
 */
$body     = sprintf( 'global $wp_customize; return $wp_customize->widgets->prepreview_added_widget_instance( $value, %s );', var_export( $setting_id, true ) );
$function = create_function( '$value', $body );

[westonruter]

​https://github.com/x-team/wordpress-develop/commit/75b430546e368745a54dfebe51377c6724dd86ac ​https://github.com/x-team/wordpress-develop/pull/11

[westonruter]

Simplify logic for prepreview_added_widget_instance. (And re-use JS variable instead of running another query.) ​https://github.com/x-team/wordpress-develop/commit/c43440262a5f16dd0518296b57c1c054689013ae

[Denis-de-Bernardy]

Perhaps use some indirection with a class that has a method like:

function __call($name, $args) {
   if (preg_match("/widget_settings_handler_([a-zA-Z0-9_]+)/", $name, $match) {
      return $this->widget_settings_handler($match[1], $args);
   }
   else {
       trigger_error(…);
   }
}

[westonruter]

Replying to Denis-de-Bernardy:

Perhaps use some indirection with a class that has a method like:

function __call($name, $args) {
   if (preg_match("/widget_settings_handler_([a-zA-Z0-9_]+)/", $name, $match) {
      return $this->widget_settings_handler($match[1], $args);
   }
   else {
       trigger_error(…);
   }
}

Did you see my patch​?

[Denis-de-Bernardy]

Oh, right, I had missed the new function. Ya, something like that should work.

[ocean90]

27805-02.patch​ tested with active theme and previewed theme. And single widget. Works.

[nacin]

Thanks for this, Weston. Eliminating create_function() may sound academic but these are prone to mistakes later that introduce the nastiest of vulnerabilities. It's just safer to never use it, the same way we'd never use /e for preg_replace() anymore. Cheers.

[nacin]

In 28143:

Widgets: Remove create_function() from the customizer class.

props westonruter.
fixes #27805.