Hacker News Reader

Comment by MattBearman | Hacker News Reader

The hacker in me couldn't resist, entering the following code:

  echo shell_exec('ls /');

results in:

  bin
  dev
  etc
  home
  lib
  proc
  spoj
  tmp
  usr
  var

I'm sure you've sandboxed it so running rm -rf / wouldn't wipe out your server, but just in case, thought I'd better let you know :)

View on HN

Looks like he's okay:

echo shell_exec('touch /etc/foo');

touch: cannot touch `/etc/foo': Permission denied

hmm I hope you set up quotas:

   shell_exec('cat /dev/zero>byedisk.bin');

and ulimits.... Forky fork fork:

   shell_exec(':(){ :|:& };:');

PHP step one. Add to ini file:

disable_functions=exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source

PHP step zero: don't use it to start with (sorry but I've had to clean up so many messes it's unreal)

Isn't it more like public-facing app step one: Don't run user-supplied code? This in particular hardly seems to be a php issue. Sandboxing isn't trivial in most languages/environments.

Yes you're actually entirely right.

Therefore I proclaim your point as step -1 ! :)

It'd be nice to see solutions like this entirely browser based. LLVM/asm.js?

Following Step 0 would mean no one learns/uses PHP.

Perhaps I'm jumping on the bandwagon here or not[1] but perhaps that's a good thing?

[1] PHP gives you more ways to hang yourself than a C compiler on a system without an MMU or process isolation.

Regardless if its a good thing or not the fact remains since it is popular today it will be used for years to come. Someone will have to know how that one PHP app works that your company made 5 years ago and refuses to update.

echo shell_exec('touch /mc/hammer');

Can't touch this?

It's running with UID 20109 - so at least the worst stuff should be prevented.

Reply on news.ycombinator.com