From 07776fe1d54555ae028bb70b7ffb9f3645ca063f Mon Sep 17 00:00:00 2001
From: Michael Hawkins <michaelh@moodle.com>
Date: Fri, 2 Aug 2024 17:34:39 +0800
Subject: [PATCH] MDL-82576 qtype_calculated: Improve formula regexes

---
 question/type/calculated/questiontype.php | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/question/type/calculated/questiontype.php b/question/type/calculated/questiontype.php
index 7bd48f61120..bda3599b031 100644
--- a/question/type/calculated/questiontype.php
+++ b/question/type/calculated/questiontype.php
@@ -39,9 +39,9 @@ require_once($CFG->dirroot . '/question/type/numerical/question.php');
  */
 class qtype_calculated extends question_type {
     /**
-     * @var string a placeholder is a letter, followed by almost any characters. (This should probably be restricted more.)
+     * @var string a placeholder is a letter, followed by zero or more alphanum chars (as well as space, - and _ for readability).
      */
-    const PLACEHOLDER_REGEX_PART = '[[:alpha:]][^>} <`{"\']*';
+    const PLACEHOLDER_REGEX_PART = '[[:alpha:]][[:alpha:][:digit:]\-_\s]*';
 
     /**
      * @var string REGEXP for a placeholder, wrapped in its {...} delimiters, with capturing brackets around the name.
@@ -1952,15 +1952,18 @@ function qtype_calculated_find_formula_errors($formula) {
     // Validates the formula submitted from the question edit page.
     // Returns false if everything is alright
     // otherwise it constructs an error message.
-    // Strip away dataset names. Use 1.0 to catch illegal concatenation like {a}{b}.
+    // Strip away dataset names. Use 1.0 to remove valid names, so illegal names can be identified later.
     $formula = preg_replace(qtype_calculated::PLACEHODLER_REGEX, '1.0', $formula);
 
     // Strip away empty space and lowercase it.
     $formula = strtolower(str_replace(' ', '', $formula));
 
-    $safeoperatorchar = '-+/*%>:^\~<?=&|!'; /* */
+    // Only mathematical operators are supported. Bitwise operators are not safe.
+    // Note: In this context, ^ is a bitwise operator (exponents are represented by **).
+    $safeoperatorchar = '-+/*%>:\~<?=!';
     $operatorornumber = "[{$safeoperatorchar}.0-9eE]";
 
+    // Validate mathematical functions in formula.
     while (preg_match("~(^|[{$safeoperatorchar},(])([a-z0-9_]*)" .
             "\\(({$operatorornumber}+(,{$operatorornumber}+((,{$operatorornumber}+)+)?)?)?\\)~",
             $formula, $regs)) {