Edit report at https://bugs.php.net/bug.php?id=68599&edit=1
ID: 68599
Updated by: yohgaki@php.net
Reported by: yohgaki@php.net
Summary: exec()/passthru() function should use execv, execve
Status: Assigned
Type: Feature/Change Request
Package: Program Execution
Operating System: ANY
PHP Version: Irrelevant
Assigned To: yohgaki
Block user comment: N
Private report: N
New Comment:
@pajoye
The issue is escapeshellarg() has issues like non-ascii chars and there are too many shells. We
don't really know how to escape perfectly for all shells.
Instead of trying to escape right, we may just provide execv/execve.
I'll check proc_open() code and write patch. If it has issues on windows, please fix them :)
Previous Comments:
------------------------------------------------------------------------
[2015-01-23 05:17:17] pajoye@php.net
I am not totally sure what this request tries to change or what you ask for windows.
The changes I see here are already supported with proc_open and the likes.
On windows it does not matter much as CreateProcess is used for all these functions and has the env
parameter.
------------------------------------------------------------------------
[2015-01-23 05:12:03] pajoye@php.net
Not a security issue,remove private flag
------------------------------------------------------------------------
[2015-01-22 22:03:46] yohgaki@php.net
Stas, it's not direct security issue since user may execute commands safely with exec.
However, writing secure command with arguments is not trivial work as it seems. execv, execve is
much easier/safer than exec. It would be only master improvement. (It's security improvement,
IMHO)
If no one objects, I'll write patch. Things that I'm not sure is why pcntl is enabled only
in CLI. It's because signal handling I suppose. Is there any other reasons?
------------------------------------------------------------------------
[2014-12-30 08:29:52] stas@php.net
Not sure why is it a security issue?
------------------------------------------------------------------------
[2014-12-12 23:02:22] yohgaki@php.net
Description:
------------
I suppose pcntl module is not available because of signal handling.
https://bugs.php.net/bug.php?id=50116
Since exec() is using exec system call, exec() is extremely vulnerable to mistakes.
Change
string exec ( string $command [, array &$output [, int &$return_var ]] )
void passthru ( string $command [, int &$return_var ] )
to
string exec ( string $command [, array &$output [, int &$return_var [, $args [, $env]]]] )
void passthru ( string $command [, int &$return_var [, $args [, $env]]] )
Use evecv if $args is passed, use execve if $env is passed.
Any comments? Especially for windows?
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=68599&edit=1