Just because an article on the internet says it's a good idea, doesn't necessarily mean it is ;)

It should be noted that we did put some restrictions in place with T182468: Restrict pygments with firejail

I boldly renamed this task to summarize the actual problem, instead of having debatable statements such as "dangerous functions".

This is actually a regression when the extension moved from GeSHi (PHP) to Pygments (Python): T85794: Convert SyntaxHighlight_Geshi from Geshi to Pygments (was: Don't register 250+ modules) Since MW is PHP the extension can just use GeSHi as a library without having to fork a separate process via one of the unsafe functions removed in the hardened PHP.

To fix the problem we would have to move to a PHP-based syntax highlighter (or somehow embedded Python which is probably ugly and even more unsafe). We could move back to GeSHi, but I believe the move was done because GeSHi is basically dead with no development so we would have to fork it and maintain such ourselves. As another option, we could move to a different PHP syntax highlighter like: https://github.com/scrivo/highlight.php

I am not sure how this would impact a PHP hardened deployment of MediaWiki, but since WMF now uses Scribunto across the board, another option would be to move to some sort of Lua syntax highlighter like: https://github.com/xolox/lua-lxsh This requires: http://www.inf.puc-rio.br/~roberto/lpeg/ LPeg is pattern-matching library for Lua, based on Parsing Expression Grammars (PEGs) by Roberto Ierusalimschy, one of the same people that created Lua. Adding that to Scribunto would be nice and would allow for a real regular expression pattern matching instead of the more restrictive one included with Lua.