Bug #61440 [Opn->Csd]: proc_open() and shell escaping

From: Date: Mon, 08 Feb 2021 14:14:54 +0000
Subject: Bug #61440 [Opn->Csd]: proc_open() and shell escaping
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-232010@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=61440&edit=1

 ID:                 61440
 Updated by:         cmb@php.net
 Reported by:        aschulz4587 at gmail dot com
 Summary:            proc_open() and shell escaping
-Status:             Open
+Status:             Closed
 Type:               Bug
-Package:            CGI/CLI related
+Package:            Program Execution
 Operating System:   Vista/Win 7
 PHP Version:        5.4.0
-Assigned To:        
+Assigned To:        cmb
 Block user comment: N
 Private report:     N

 New Comment:

This is fixed as of PHP 8.0.0[1], but that fix cannot be
backported for BC reasons.  If you need to go through the shell,
enclose the commandline in additional double-quotes, prior to PHP
8.0.0:

    '""php" "--version""',

[1] <https://github.com/php/php-src/commit/9ca449e0a803cb9d1d40fd6b83f2da1e6a7b46d9>


Previous Comments:
------------------------------------------------------------------------
[2012-03-19 18:24:34] aschulz4587 at gmail dot com

Note that this works if the bypass_shell flag it set. Also, popen() does not suffer from this
problem.

------------------------------------------------------------------------
[2012-03-19 18:23:01] aschulz4587 at gmail dot com

Description:
------------
proc_open() does not seem to handle shell escaping of the script paths properly.

Test script:
---------------
<?php

$pipes = array();
$process = proc_open(
        '"php" "--version"',
        #'php "--version"',
        array(
                0 => array( 'pipe', 'r' ), // input
                1 => array( 'pipe', 'w' ), // output
                2 => array( 'file', 'NUL', 'a' ) // error
        ),
        $pipes // respective outputs
);
 
fclose( $pipes[0] );
var_dump( stream_get_contents( $pipes[1] ) );
 
fclose( $pipes[1] );
proc_close($process);

Expected result:
----------------
$ php shelltest.php
string(147) "PHP 5.3.4 (cli) (built: Dec 16 2010 00:06:20)
Copyright (c) 1997-2010 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies
"

Actual result:
--------------
$ php shelltest.php
string(0) ""


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=61440&edit=1

Thread (3 messages)

« previous php.bugs (#232010) next »