feat(worker): block eval() in PHP code submissionsHEADmain

Add validation to reject PHP code containing eval() before execution.
Update the problem description to inform participants about this restriction.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

1 files changed, 16 insertions, 1 deletions

diff --git a/worker/php/exec.mjs b/worker/php/exec.mjs
index f1cb361..650d4df 100644
--- a/worker/php/exec.mjs
+++ b/worker/php/exec.mjs
@@ -1,7 +1,22 @@
-import { buildResult, createIOCallbacks, preprocessCode } from "./lib.mjs";
+import {
+  buildResult,
+  createIOCallbacks,
+  preprocessCode,
+  validateCode,
+} from "./lib.mjs";
 import PHPWasm from "./php-wasm.js";
 
 process.once("message", async ({ code: originalCode, input }) => {
+  const validationError = validateCode(originalCode);
+  if (validationError) {
+    process.send({
+      status: "runtime_error",
+      stdout: "",
+      stderr: validationError,
+    });
+    return;
+  }
+
   const code = preprocessCode(originalCode);
   const io = createIOCallbacks(input);