Re: safe_shell_exec extension for consideration

On 23 May 2010 22:42, Dave McMurtrie <dave64@andrew.cmu.edu> wrote: > Hi, > > We're working to deploy an application using PHP and we'd ultimately like to > be able to fork/exec a child process without ever involving a shell for the > purpose of limiting our exposure to potential shell vulnerabilities. > > I noticed that shell_exec(), popen() and proc_open() all involve a shell, so > I wrote a quick extension that will do essentially what shell_exec() and > popen() do, but doesn't involve ever forking/execing a shell. > > I don't know if others might find this useful or not, so I'm sending this > note for consideration to have it added as an extension.  If there's a > better way to do what we're interested in, please let me know.  If any code > changes are required to allow this to be contributed, please let me know. >  If this is something you're simply not interested it, also let me know. > > At the very least, I suspect my tokenizer would require some additional > functionality, though it does what we currently need. > > You can download a tar/gz copy of the extension at: > > http://www.andrew.cmu.edu/user/dave64/safe_shell_exec.tar.gz > > Thank you, > > Dave > > -- > PECL development discussion Mailing List (http://pecl.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > http://docs.php.net/manual/en/function.proc-open.php has a bypass_shell option. -- ----- Richard Quadling "Standing on the shoulders of some very clever giants!" EE : http://www.experts-exchange.com/M_248814.html EE4Free : http://www.experts-exchange.com/becomeAnExpert.jsp Zend Certified Engineer : http://zend.com/zce.php?c=ZEND002498&r=213474731 ZOPA : http://uk.zopa.com/member/RQuadling