Re: [PECL-DEV] safe_shell_exec extension for consideration

Dave McMurtrie wrote:
> Hi,
> 
> We're working to deploy an application using PHP and we'd ultimately 
> like to be able to fork/exec a child process without ever involving a 
> shell for the purpose of limiting our exposure to potential shell 
> vulnerabilities.
> 
> I noticed that shell_exec(), popen() and proc_open() all involve a 
> shell, so I wrote a quick extension that will do essentially what 
> shell_exec() and popen() do, but doesn't involve ever forking/execing a 
> shell.
> 
> I don't know if others might find this useful or not, so I'm sending 
> this note for consideration to have it added as an extension.  If 
> there's a better way to do what we're interested in, please let me know. 
>  If any code changes are required to allow this to be contributed, 
> please let me know.  If this is something you're simply not interested 
> it, also let me know.
> 
> At the very least, I suspect my tokenizer would require some additional 
> functionality, though it does what we currently need.
> 
> You can download a tar/gz copy of the extension at:
> 
> http://www.andrew.cmu.edu/user/dave64/safe_shell_exec.tar.gz

Replying to myself...  I put a copy of my latest code up here.  After a 
lot of time spent thinking about this, I updated my code to no longer 
accept a command string, but to instead accept an array.  This is more 
in line with what perl does for system() and exec(), and more closely 
matches what the exec() system call is expecting to have passed to it.

My initial effort was intended to be a drop-in replacement for any code 
that was already using PHP's shell_exec(), so I made it simply accept a 
command string which I was tokenizing to create an argument vector that 
could be passed to the exec syscall.  I started to "improve" my 
tokenizing routine to make it deal with escaped double quotes, then I 
began to consider what other things it needed to handle so it would be 
as compatible as possible as a drop-in shell_exec() replacement.  This 
led me to realize I was sliding down a path toward trying to implement 
my own shell parser which would likely end up introducing many of the 
same vulnerabilities I'd like to steer clear of by not adding a shell to 
the mix when I need to run an external program from a PHP script.

To avoid that mess, I have now updated my code to only accept an array 
as described above.

How might I pursue getting this added to the core of PHP?  This seems 
like very basic functionality that others might be interested in, as well.

Thanks,

Dave