rules:
- id: mb-ereg-replace-eval
  patterns:
  - pattern: mb_ereg_replace($PATTERN, $REPL, $STR, $OPTIONS);
  - pattern-not: mb_ereg_replace($PATTERN, $REPL, $STR, "...");
  message: >-
    Calling mb_ereg_replace with user input in the options can lead to arbitrary
    code execution. The eval modifier (`e`) evaluates the replacement argument
    as code.
  metadata:
    cwe:
    - "CWE-94: Improper Control of Generation of Code ('Code Injection')"
    references:
    - https://www.php.net/manual/en/function.mb-ereg-replace.php
    - https://www.php.net/manual/en/function.mb-regex-set-options.php
    category: security
    technology:
    - php
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages: [php]
  severity: ERROR