DeepSource
Dashboard Resources Pricing Discover Directory Log in

Run your first analysis.

Find thousands of code security and quality issues in your codebase, before they end up in production.

Start now
PHP

PHP

Made by DeepSource
Use Analyzer

Audit required: Function may be vulnerable to arbitrary commands execution PHP-A1009

Security
Critical
 a03 cwe-20 cwe-78 sans top 25 owasp top 10

Using exec, passthru, shell_exec or, system functions to execute command can make the application vulnerable to arbitrary commands execution, if the user-supplied data is escaped or sanitized properly before passing them.

Though functions like escapeshellarg and escapeshellcmd exists which can be used to escape the command and shell argument. But the lack of cross-operating system compatibility of these functions relying on it is discouraged.

It is recommended to use a secure library like Symfony's Process Component to execute a command in a sub-process, which takes care of the escaping arguments irrespective of operating system to prevent security issues.

Bad practice

$output = null;
$resultCode = null;
$command = "ls -lsa {$_POST['path']}";

exec($command, $output, $resultCode);

Recommended

use Symfony\Component\Process\Exception\ProcessFailedException;
use Symfony\Component\Process\Process;

$process = new Process(['ls', '-lsa', $_POST['path']]);
$process->run();

if ($process->isSuccessful()) {
    echo $process->getOutput();
}

References