PHP - Using Exec to execute Jar file with user defined parameters

Question

I have a working exec in php that executes a Jar file and returns back result:

exec('java -jar Clt.jar ' . $sampleSize . ' ' . $numberOfSamples . ' ' . $randAlgorithm,  $output);

These parameters are checked in Java application in the following way:

int sampleSize = Integer.parseInt(args[0]);
int numberOfSamples = Integer.parseInt(args[1]);
int randGenerator = Integer.parseInt(args[2]);

Now I need to know If I need to check user input, because on PHP page under exec, it says:

When allowing user-supplied data to be passed to this function, use escapeshellarg() or escapeshellcmd() to ensure that users cannot trick the system into executing arbitrary commands.

But in my case, where user input is used only as parameter for application, are there any security risks If I do not check what has user set, apart from that program will not execute if user enters string or floating point number?

rook · Accepted Answer · 2011-03-04 18:19:29Z

2

But in my case, where user input is used only as parameter for application

And this is where you are wrong. exec() is as if you are executing a line on the command-line. What if the users inputs something like: ; rm -rf / && echo. You must escape the input with escapeshellargs(). Or even better use floatval() before passing it to the commandline.

edited Mar 4, 2011 at 18:19

answered Mar 4, 2011 at 17:28

rook

67.1k38 gold badges171 silver badges248 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Marc B Over a year ago

Better yet, use '; rm -rf ...' - just in case the Java fails, the rm will still procede - if you're trashing the server, don't be nice make the attack depend on the success of the program whose args you're injecting.

Jernej Jerin Over a year ago

Added a simple test.txt and tried ;del test.txt at the end of the last parameter, and ; is still considered to be a parameter for java? I am using Win7, maybe there is another command to begin new instruction?

rook Over a year ago

@Jernej Jerin This has nothing to do with java, its the shell that you are using. In this case exec() is using cmd.exe.

Jernej Jerin Over a year ago

Yeah I know that, but I tried in cmd java -jar Clt.jar 1 100 1 && del test.txt and it really deleted test.txt while for some reason executing exec with exactly the same stuff did not want to delete the test.txt?

Brandon Frohbieter · Accepted Answer · 2011-03-04 17:29:19Z

0

Absolutely. There are plenty of shell hacks that will allow the user to escape your command and execute arbitrary commands on your system. Using &&, piping, etc...

answered Mar 4, 2011 at 17:29

Brandon Frohbieter

18.2k4 gold badges42 silver badges62 bronze badges

Comments

Community · Accepted Answer · 2023-11-17 19:42:58Z

0

If you do not check nor escape what you inject into that command-line you're executing, it means anyone can inject anything into it. Which means getting any kind of code executing on your system. And, as you'll probably guess, this can be bad.

You must always properly escape (especially) unsafe data !

When building commands that are to be executed by the system, you should use the [**`escapeshellarg()`**][1] function.

edited Nov 17, 2023 at 19:42

CommunityBot

11 silver badge

answered Mar 4, 2011 at 17:29

Pascal MARTIN

402k82 gold badges665 silver badges666 bronze badges

Collectives™ on Stack Overflow

PHP - Using Exec to execute Jar file with user defined parameters

3 Answers 3

4 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related