TaintedShell

This is a security issue, reported by security analysis: it flags a potential vulnerability.

Emitted when user-controlled input can be passed into an exec call or similar.

Risk

User input that reaches a shell command lets an attacker run commands with the rights of the PHP process.

Example

<?php

$command = $_GET["command"];

runCode($command);

function runCode(string $command) {
    exec($command);
}

Mitigations

  • Avoid the shell: use the PHP function that does the job.
  • Pass each argument through escapeshellarg() (and the command through escapeshellcmd()), or pass the arguments as an array to proc_open().
  • Check input against an allowlist.

Further resources