0

I have to execute my .o or .out binary file pre-compiled with gcc, it should be intended to let the user execute the small program so an action is made that connects with the app installed on the user's phone.

But i want to prevent other code not related to this concept from being executed at the same time. What i have is one constant that contains the specified command that must be executed.

<?php
     DEFINE('program', './main.out');
     exec(program);

Or working with a variable that acts as a pointer: exec($executable); ( However i think this is less secure ).


Another way: In a class, declaring a private constant prep that has the line that must be executed in the next procedure, a function, which then executes the escaped specific line. To give an example

    private const prep = "./main.out";

    function executeProgram()
    {
        $e = exec(escapeshellcmd(self::prep));

        exit();
    }
  1. Is there a way to make this function(exec) fully private from being accessed by others?
  2. How to sanitize it? using escapeshellcmd() would be ok.
  3. Is it safe to use pointers for or in this function? let's say $executable
  4. Is there any other risk that i must think about, then i'm thinking about the program itself?
  • If you're hardcoding the entire string, then you don't need to worry about attacks from not escaping it, since your own code isn't going to attack itself. If you're not hardcoding the entire string, then where is it coming from? – Joseph Sible Aug 21 at 19:03
1

For sanitization, You can refer here https://stackoverflow.com/questions/42657352/how-can-i-stop-command-injection-when-using-shell-exec-in-php7

TL;DR:

Use escapeshellcmd for escaping full command to be executed, or escapeshellarg to escape arguments only for given command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.