Requesting security review for PHP port of TextCat language detection library. The library is located in wikimedia/textcat repository, https://github.com/wikimedia/wikimedia-textcat
Projected usage is detecting language of queries and potentially other texts. The main class to be uses is TextCat.php, other PHP files are command-line utilities.
This has been reviewed. It looks good, generally, and seems to be quite an elegant solution. Only one minor issue was found:
LOW
LM File Loading May Provide Vector for Malicious Code Execution - LM files are plain PHP. If the package is deployed directly from Github, ensure that any stock LM files are reviewed prior to use to ensure that malicious code has not been inserted.
None
./catus.php
OK
./felis.php
OK
./lm2php.php
OK
./TextCat.php
LOW - LM files loaded via `include()` may allow code execution
Yes, I know the direct file loading is tricky, the reason it is so if because loading PHP file is the fastest way to load data into PHP, there's a lot of data to be loaded and using caching infrastructure of HHVM would be very beneficial. We do not yet have finalized the LM models, that's T123537. Once it is done, we'll ping you again.