Remote Code Exectuion via unescaped parameter in generateString function

[d90pwn]

I found an issue that causes Remote Code Execution by improper input validation in a $this->messageCategory variable.

As a result, a remote attacker with an access to https://localhost/gii/ endpoint can execute arbitrary PHP code to template file, and then run it.

To fix issue, we can replace the $str = "Yii::t('" . $this->messageCategory . "', '" . $string . "'" . $ph . ")";
to $str = "Yii::t('" . addslashes($this->messageCategory) . "', '" . $string . "'" . $ph . ")";
in a file:

yii2-gii/src/Generator.php

Line 505 in ee4d072

$str = "Yii::t('" . $this->messageCategory . "', '" . $string . "'" . $ph . ")";

[schmunk42]

Or a better validation here:

yii2-gii/src/generators/model/Generator.php

Line 95 in 6c63058

[['messageCategory'], 'validateMessageCategory', 'skipOnEmpty' => false],

[samdark]

First of all, thanks for reporting it.

1. I don't consider it a huge security issue since Gii should not be enabled on production ever. That's an easy way to disrupt the project by rewriting custom code with generated one.
2. It's good to have it fixed nevertheless.
3. @schmunk42 solution fits it better, I think.