escapeshellcmd - PHP code example

The php Function Escapeshellcmd

php function escapeshellcmd

PHP is a loosely-typed language that does not enforce variable type checking. As such, it is possible for malicious attackers to gain access to sensitive system functions and calls in scripts. Various tools exist to detect and test PHP applications for vulnerabilities, including scanning HAR files, API schemas, or incremental scanning. However, intelligent attackers will always find ways to bypass these sanitizations. Using a whitelist of acceptable commands/arguments is an effective approach to limit the risk of such attacks.

The php function escapeshellcmd() adds single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument. This function should be used to ensure that user input that might be passed to exec(), system() or the backtick operator is properly escaped before this data is executed on a remote host. The function also escapes other characters that could be used to trick shell commands into executing arbitrary code such as the following:

There are a few other useful functions that should be included in any PHP program such as strlen(str): returns the length of a given string, substr(str, start[, len(str)]): return a substring from a starting character up to the end of a string, strtoupper(str), strtolower(str) and trim(str): trim whitespaces from the beginning and the end of a given string. All of these functions should be used to sanitize any data that may be supplied by users.

escapeshellcmd example

$style->writeln('start');
        $style->write('foo');
        $style->writeln(' and bar');
        $givenAnswer = $style->ask('Dummy question?');
        $style->write('foo2'.\PHP_EOL);
        $output->write('bar2');
        $output->clear();

        rewind($output->getStream());
        $this->assertEquals($answer, $givenAnswer);
        $this->assertEquals(escapeshellcmd(
            'start'.\PHP_EOL. // write start             'foo'.\PHP_EOL. // write foo             "\x1b[1A\x1b[0Jfoo and bar".\PHP_EOL. // complete line             \PHP_EOL." \033[32mDummy question?\033[39m:".\PHP_EOL.' > '.\PHP_EOL.\PHP_EOL. // question             'foo2'.\PHP_EOL. // write foo2             'bar2'.\PHP_EOL. // write bar             "\033[9A\033[0J"), // clear 9 lines (8 output lines and one from the answer input return)             escapeshellcmd(stream_get_contents($output->getStream()))
        );
    }
}

        $secondSection->writeln('Four');
        $expected .= "\x1b[3A\x1b[0J";
        $expected .= 'Two'.\PHP_EOL.'Three'.\PHP_EOL.'Four'.\PHP_EOL;

        // cause overflow of first section (redraw whole section, without first line)         $firstSection->writeln('Four'.\PHP_EOL.'Five'.\PHP_EOL.'Six');
        $expected .= "\x1b[6A\x1b[0J";
        $expected .= 'Four'.\PHP_EOL.'Five'.\PHP_EOL.'Six'.\PHP_EOL;
        $expected .= 'Two'.\PHP_EOL.'Three'.\PHP_EOL.'Four'.\PHP_EOL;

        rewind($this->stream);
        $this->assertEquals(escapeshellcmd($expected), escapeshellcmd(stream_get_contents($this->stream)));
    }

    public function testMaxHeightWithoutNewLine()
    {
        $expected = '';
        $sections = [];
        $output = new ConsoleSectionOutput($this->stream, $sections, OutputInterface::VERBOSITY_NORMAL, true, new OutputFormatter());
        $output->setMaxHeight(3);

        // fill the section         $output->writeln(['One', 'Two']);

  protected static function _isShellSafe($string) {
    if (escapeshellcmd($string) !== $string || !in_array(escapeshellarg($string), ["'$string'", "\"$string\""])) {
      return FALSE;
    }
    if (preg_match('/[^a-zA-Z0-9@_\-.]/', $string) !== 0) {
      return FALSE;
    }
    return TRUE;
  }

}

$sendmailFmt = '%s -oi -f%s -t';
            }
        } else {
            //allow sendmail to choose a default envelope sender. It may             //seem preferable to force it to use the From header as with             //SMTP, but that introduces new problems (see             //<https://github.com/PHPMailer/PHPMailer/issues/2298>), and             //it has historically worked this way.             $sendmailFmt = '%s -oi -t';
        }

        $sendmail = sprintf($sendmailFmt, escapeshellcmd($this->Sendmail), $this->Sender);
        $this->edebug('Sendmail path: ' . $this->Sendmail);
        $this->edebug('Sendmail command: ' . $sendmail);
        $this->edebug('Envelope sender: ' . $this->Sender);
        $this->edebug("Headers: {$header}");

        if ($this->SingleTo) {
            foreach ($this->SingleToArray as $toAddr) {
                $mail = @popen($sendmail, 'w');
                if (!$mail) {
                    throw new Exception($this->lang('execute') . $this->Sendmail, self::STOP_CRITICAL);
                }