Re: [PECL-DEV] safe_shell_exec extension for consideration

Hi Dave,

In general, I think calling functions or settings "safe"-anything gives
users false fuzzies, and should be avoided.  Wouldn't it make more sense to
simply extend the existing shell_exec() function in PHP's standard extension
to also accept an array parameter?

 - Stig

On Wed, May 26, 2010 at 12:02 AM, Dave McMurtrie <[email protected]>wrote:

> Dave McMurtrie wrote:
>
>> Hi,
>>
>> We're working to deploy an application using PHP and we'd ultimately like
>> to be able to fork/exec a child process without ever involving a shell for
>> the purpose of limiting our exposure to potential shell vulnerabilities.
>>
>> I noticed that shell_exec(), popen() and proc_open() all involve a shell,
>> so I wrote a quick extension that will do essentially what shell_exec() and
>> popen() do, but doesn't involve ever forking/execing a shell.
>>
>> I don't know if others might find this useful or not, so I'm sending this
>> note for consideration to have it added as an extension.  If there's a
>> better way to do what we're interested in, please let me know.  If any code
>> changes are required to allow this to be contributed, please let me know.
>>  If this is something you're simply not interested it, also let me know.
>>
>> At the very least, I suspect my tokenizer would require some additional
>> functionality, though it does what we currently need.
>>
>> You can download a tar/gz copy of the extension at:
>>
>> http://www.andrew.cmu.edu/user/dave64/safe_shell_exec.tar.gz
>>
>
> Replying to myself...  I put a copy of my latest code up here.  After a lot
> of time spent thinking about this, I updated my code to no longer accept a
> command string, but to instead accept an array.  This is more in line with
> what perl does for system() and exec(), and more closely matches what the
> exec() system call is expecting to have passed to it.
>
> My initial effort was intended to be a drop-in replacement for any code
> that was already using PHP's shell_exec(), so I made it simply accept a
> command string which I was tokenizing to create an argument vector that
> could be passed to the exec syscall.  I started to "improve" my tokenizing
> routine to make it deal with escaped double quotes, then I began to consider
> what other things it needed to handle so it would be as compatible as
> possible as a drop-in shell_exec() replacement.  This led me to realize I
> was sliding down a path toward trying to implement my own shell parser which
> would likely end up introducing many of the same vulnerabilities I'd like to
> steer clear of by not adding a shell to the mix when I need to run an
> external program from a PHP script.
>
> To avoid that mess, I have now updated my code to only accept an array as
> described above.
>
> How might I pursue getting this added to the core of PHP?  This seems like
> very basic functionality that others might be interested in, as well.
>
> Thanks,
>
>
> Dave
>
> --
> PECL development discussion Mailing List (http://pecl.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>