Sec Bug->Req #68599 [Opn]: exec()/passthru() function should use execv, execve

Edit report at https://bugs.php.net/bug.php?id=68599&edit=1 ID: 68599 Updated by: stas@php.net Reported by: yohgaki@php.net Summary: exec()/passthru() function should use execv, execve Status: Open -Type: Security +Type: Feature/Change Request -Package: Unknown/Other Function +Package: Program Execution Operating System: ANY PHP Version: Irrelevant Block user comment: N Private report: Y New Comment: Not sure why is it a security issue? Previous Comments: ------------------------------------------------------------------------ [2014-12-12 23:02:22] yohgaki@php.net Description: ------------ I suppose pcntl module is not available because of signal handling. https://bugs.php.net/bug.php?id=50116 Since exec() is using exec system call, exec() is extremely vulnerable to mistakes. Change string exec ( string $command [, array &$output [, int &$return_var ]] ) void passthru ( string $command [, int &$return_var ] ) to string exec ( string $command [, array &$output [, int &$return_var [, $args [, $env]]]] ) void passthru ( string $command [, int &$return_var [, $args [, $env]]] ) Use evecv if $args is passed, use execve if $env is passed. Any comments? Especially for windows? ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68599&edit=1