formula strict syntax

application/Espo/Core/Formula/Parser.php

@@ -66,6 +66,8 @@ class Parser
 
     private $variableNameRegExp = "/^[a-zA-Z0-9_\$]+$/";
 
+    private $functionNameRegExp = "/^[a-zA-Z0-9_\\\\]+$/";
+
     public function parse(string $expression): stdClass
     {
         return $this->split($expression);
@@ -115,6 +117,10 @@ class Parser
 
         $functionName = $this->operatorMap[$operator];
 
+        if ($functionName === '' || !preg_match($this->functionNameRegExp, $functionName)) {
+            throw new SyntaxError("Bad function name `{$functionName}`.");
+        }
+
         return (object) [
             'type' => $functionName,
             'value' => [
@@ -527,6 +533,10 @@ class Parser
                         $argumentSplittedList[] = $this->split($argument);
                     }
 
+                    if ($functionName === '' || !preg_match($this->functionNameRegExp, $functionName)) {
+                        throw new SyntaxError("Bad function name `{$functionName}`.");
+                    }
+
                     return (object) [
                         'type' => $functionName,
                         'value' => $argumentSplittedList,

tests/unit/Espo/Core/Formula/EvaluatorTest.php

@@ -589,4 +589,13 @@ class EvaluatorTest extends \PHPUnit\Framework\TestCase
 
         $this->evaluator->process($expression, null);
     }
+
+    public function testSyntaxError9(): void
+    {
+        $expression = "test.test('test')";
+
+        $this->expectException(SyntaxError::class);
+
+        $this->evaluator->process($expression, null);
+    }
 }