Re: [PECL-DEV] safe_shell_exec extension for consideration

On 23 May 2010 22:42, Dave McMurtrie <[email protected]> wrote:
> Hi,
>
> We're working to deploy an application using PHP and we'd ultimately like to
> be able to fork/exec a child process without ever involving a shell for the
> purpose of limiting our exposure to potential shell vulnerabilities.
>
> I noticed that shell_exec(), popen() and proc_open() all involve a shell, so
> I wrote a quick extension that will do essentially what shell_exec() and
> popen() do, but doesn't involve ever forking/execing a shell.
>
> I don't know if others might find this useful or not, so I'm sending this
> note for consideration to have it added as an extension.  If there's a
> better way to do what we're interested in, please let me know.  If any code
> changes are required to allow this to be contributed, please let me know.
>  If this is something you're simply not interested it, also let me know.
>
> At the very least, I suspect my tokenizer would require some additional
> functionality, though it does what we currently need.
>
> You can download a tar/gz copy of the extension at:
>
> http://www.andrew.cmu.edu/user/dave64/safe_shell_exec.tar.gz
>
> Thank you,
>
> Dave
>
> --
> PECL development discussion Mailing List (http://pecl.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

http://docs.php.net/manual/en/function.proc-open.php has a bypass_shell option.



-- 
-----
Richard Quadling
"Standing on the shoulders of some very clever giants!"
EE : http://www.experts-exchange.com/M_248814.html
EE4Free : http://www.experts-exchange.com/becomeAnExpert.jsp
Zend Certified Engineer : http://zend.com/zce.php?c=ZEND002498&r=213474731
ZOPA : http://uk.zopa.com/member/RQuadling