note 89405 added to function.escapeshellcmd

Using escapeshellcmd() is not trivial. I'll point out a few security risks in examples given in the documentation and the comments: #1 <?php $e = escapeshellcmd($userinput); // here we don't care if $e has spaces system("echo $e"); ?> Here you can still pass parameters to echo. E.g. a $userinput of '-n blah' will not output what you expected. This might not be a big deal with echo, but it definitely is with other programs. #2 <?php $f = escapeshellcmd($filename); // and here we do, so we use quotes system("touch \"/tmp/$f\"; ls -l \"/tmp/$f\""); ?> Note that paired quotes are not escaped by escapeshellcmd(). So given a $filename like '" ".htaccess' will create more than one file, in any directory you want. With '" -R "/' you might even start a full recursive directory listing. #3 (from davidwhthomas) <?php $result = exec(escapeshellcmd("tar -xvvf /path/to/$uploadedfile -C /path/to/extract/to/")); ?> side note: Hopefully the extract path is not in the web server root. Otherwise you have to be very carefull with the server configuration (e.g. no execution of any scripts like .php files, no interpretation of .htaccess files) With this little exec it might be possible to put any file anywhere on the filesystem by adding the '-P' parameter. (restricted by user rights of course). A attack might work as follows: Upload two files 'up.tar' and 'up.tar -P' simultaneously where up.tar contains the file and path with a leading slash. Quoting does not necessarily fix the problem. See #2. So whats the point in having escapeshellcmd(), when there is a escapeshellarg() function? Is there any legitimate use case for it? ---- Server IP: 69.147.83.197 Probable Submitter: 91.112.6.115 ---- Manual Page -- http://www.php.net/manual/en/function.escapeshellcmd.php Edit -- https://master.php.net/note/edit/89405 Del: integrated -- https://master.php.net/note/delete/89405/integrated Del: useless -- https://master.php.net/note/delete/89405/useless Del: bad code -- https://master.php.net/note/delete/89405/bad+code Del: spam -- https://master.php.net/note/delete/89405/spam Del: non-english -- https://master.php.net/note/delete/89405/non-english Del: in docs -- https://master.php.net/note/delete/89405/in+docs Del: other reasons-- https://master.php.net/note/delete/89405 Reject -- https://master.php.net/note/reject/89405 Search -- https://master.php.net/manage/user-notes.php