I have a basic security question about Magento 2.1
Do any of the modules in a default installation allow the execution of arbitrary PHP code directly from a database field? I'm assuming not, but I need to check.
Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It only takes a minute to sign up.
Sign up to join this communityI have a basic security question about Magento 2.1
Do any of the modules in a default installation allow the execution of arbitrary PHP code directly from a database field? I'm assuming not, but I need to check.
No. This would be a major security flaw that I cannot imagine would make it through code review at Magento.
To confirm, search for usages of the eval
PHP function in the code base: no results.
eval === evil
. But beware of 3rd party extensions: there are some extensions out there that indeed store PHP code in the database and use eval()
to run it. Always code review 3rd party extensions!
– Giel Berkers
Jan 11 '17 at 7:21
Setup
inside each module. I would say no, but you can check it yourself. – Marius♦ Jan 10 '17 at 17:58