Re: safe_shell_exec extension for consideration

Hi Dave, In general, I think calling functions or settings "safe"-anything gives users false fuzzies, and should be avoided. Wouldn't it make more sense to simply extend the existing shell_exec() function in PHP's standard extension to also accept an array parameter? - Stig On Wed, May 26, 2010 at 12:02 AM, Dave McMurtrie <dave64@andrew.cmu.edu>wrote: > Dave McMurtrie wrote: > >> Hi, >> >> We're working to deploy an application using PHP and we'd ultimately like >> to be able to fork/exec a child process without ever involving a shell for >> the purpose of limiting our exposure to potential shell vulnerabilities. >> >> I noticed that shell_exec(), popen() and proc_open() all involve a shell, >> so I wrote a quick extension that will do essentially what shell_exec() and >> popen() do, but doesn't involve ever forking/execing a shell. >> >> I don't know if others might find this useful or not, so I'm sending this >> note for consideration to have it added as an extension. If there's a >> better way to do what we're interested in, please let me know. If any code >> changes are required to allow this to be contributed, please let me know. >> If this is something you're simply not interested it, also let me know. >> >> At the very least, I suspect my tokenizer would require some additional >> functionality, though it does what we currently need. >> >> You can download a tar/gz copy of the extension at: >> >> >> http://www.andrew.cmu.edu/user/dave64/safe_shell_exec.tar.gz >> > > Replying to myself... I put a copy of my latest code up here. After a lot > of time spent thinking about this, I updated my code to no longer accept a > command string, but to instead accept an array. This is more in line with > what perl does for system() and exec(), and more closely matches what the > exec() system call is expecting to have passed to it. > > My initial effort was intended to be a drop-in replacement for any code > that was already using PHP's shell_exec(), so I made it simply accept a > command string which I was tokenizing to create an argument vector that > could be passed to the exec syscall. I started to "improve" my tokenizing > routine to make it deal with escaped double quotes, then I began to consider > what other things it needed to handle so it would be as compatible as > possible as a drop-in shell_exec() replacement. This led me to realize I > was sliding down a path toward trying to implement my own shell parser which > would likely end up introducing many of the same vulnerabilities I'd like to > steer clear of by not adding a shell to the mix when I need to run an > external program from a PHP script. > > To avoid that mess, I have now updated my code to only accept an array as > described above. > > How might I pursue getting this added to the core of PHP? This seems like > very basic functionality that others might be interested in, as well. > > Thanks, > > > Dave > > -- > PECL development discussion Mailing List (http://pecl.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > >