Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a web control panel and I need my allow my users to send commands to their application.

I a similar problem to SQL injection.

$user_input='good command';
shell_exec('tmux send-keys session1:0 "'.$user_input.'" C-m');

This would send the command tmux send-keys session1:0 "good command" C-m , which is fine.

But the user could also type some other.

$user_input='good command" C-m | rm / | tmux send-keys sessionUserMayNotDoAnyThingIn:0 "some command';
shell_exec('tmux send-keys session1:0 "'.$user_input.'" C-m');

This would send the command tmux send-keys session1:0 "good command" C-m | rm / | tmux send-keys sessionUseerMayNotDoAnyThingIn:0 "some command" C-m

(That would send 3 commands)

tmux send-keys session1:0 "good command" C-m
rm /
tmux send-keys sessionUseerMayNotDoAnyThingIn:0 "some command" C-m

So what is the solution for this?

share|improve this question
    
No user input can ever be trusted. –  Evan Darwin Jul 19 at 16:53
    
@EvanDarwin Will something like \n be possible before the "" –  user3524823 Jul 19 at 16:55
    
Of course, in which case it becomes an endless game of you adding regexes and replacements. I would however have you check out docker.io which doesn't run in tmux sessions but they get their own low-memory "VM" per se. –  Evan Darwin Jul 19 at 16:57
    
@EvanDarwin docker would not fit my needs :( But would it be safe if I did like this shell_exec('tmux send-keys session1:0 \n"'.$user_input.'\n" C-m'); –  user3524823 Jul 19 at 17:13

1 Answer 1

up vote 0 down vote accepted

You can use escapeshellcmd() for command escaping (first token) and escapeshellarg() for arguments escaping.

share|improve this answer
    
Just to be sure. Is the fully secure? shell_exec("tmux send-keys -t session:0 ".escapeshellarg($user_input)." C-m"); –  user3524823 Jul 19 at 22:02
    
If you should allow only commands (without arguments) you should use only escapeshellcmd($user_input), but should check if it is an allowed command before. –  dvm Jul 19 at 22:07
    
If you want to allow arguments, you should first separate the command from arguments and tokenize the source string using spaces, pass first token with escapeshellcmd() and escapeshellarg() with each argument, then you will make sure a string "; rm -rf /" will be passed as only one argument instead allowing it run as command. –  dvm Jul 19 at 22:09
    
I'm not a 100% sure what you mean. Isn't shell_exec("tmux send-keys -t session:0 ".escapeshellarg($user_input)." C-m"); good enough? If not can you then do an example how to? –  user3524823 Jul 20 at 10:34
    
You need to allow user to send just commands (e.g. whoami) or commands with arguments (e.g. ls -l /tmp)? –  dvm Jul 21 at 1:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.