ID: 18291
Updated by: php.hc@saustrup.net
Reported By: php.hc@saustrup.net
Status: Open
Bug Type: Program Execution
Operating System: RedHat Linux 7.3
PHP Version: 4.1.2
New Comment:
And just to make it perfectly clear what arguments my binary is
getting:
Arg1: 1
Arg2: 2
Arg3: 3
Arg4: "a
Arg5: b
Arg6: c"
Arg7: 4
Arg8: 5
Arg9: 6
Previous Comments:
------------------------------------------------------------------------
[2002-07-12 08:28:20] php.hc@saustrup.net
As far as I can see, it's not even required by the exec()'ing user to
have a valid shell in /etc/passwd, so I very much expect that the
binary is being exec()'d directly, without the use of a shell.
If you check out the man page for the execve() function, you'll see
that arguments are actually submitted as an array, and not as a whole
string. If they were infact passed through a shell (I believe the
backticks and passthru() does this), escapeshellarg() might have been
the solution - but not in this case. I tried it, but exec() apparently
still splits up the string where it finds whitespaces (escaped or not),
and passes it on to ie. execve().
And just to make it perfectly clear what I want:
Binary: /usr/bin/binary
Arg1: 1
Arg2: 2
Arg3: 3
Arg4: a b c
Arg5: 4
Arg6: 5
Arg7: 6
------------------------------------------------------------------------
[2002-07-12 00:21:28] sniper@php.net
Not any bug. It's up to the external program how
it handles the arguments you pass it..try same on the cmd line and
you'll understand what I mean. To get "'s through, you need to escape
them..
Check this out:
http://www.php.net/manual/en/function.escapeshellarg.php
exec() doesn't split anything, it passes what is given to it
straight to the shell to be executed as is.
------------------------------------------------------------------------
[2002-07-11 22:44:08] php.hc@saustrup.net
This kept me up all night :-) I needed to pass a textstring to an
external program, and did something like this in PHP:
exec('/usr/bin/binary 1 2 3 "a b c" 4 5 6');
It kept screwing up, and after debugging it I realized that the exec()
function actually called /usr/bin/binary with 9 arguments, and not 7 as
I thought it would. Apparently PHP's exec() just splits up the string
where it finds whitespaces and thinks they're different arguments. I'm
not sure about the proper solution, but it would be awesome with a more
"strict" exec()-like function that could work something like this:
newexec('/usr/bin/binary',array('1','2','3','a b
c','4','5','6'));
That way, there would be NO doubt about the arguments :-)
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=18291&edit=1