MAGETWO-48819: [GitHub #3233] Arbitrary PHP code execution in M2.0.2

- Removed eval statement from phrase parser.

Author: Hayder Sharhan

setup/src/Magento/Setup/Module/I18n/Dictionary/Phrase.php

@@ -275,8 +275,6 @@ private function getCompiledString($string)
             $string = preg_replace('/([^\\\\])' . $encloseQuote . ' ?\. ?' . $encloseQuote . '/', '$1', $string);
             $string = addslashes($string);
         }
-        $evalString = 'return ' . $encloseQuote . $string . $encloseQuote . ';';
-        $result = @eval($evalString);
-        return is_string($result) ? $result :  $string;
+        return $string;
     }
 }