Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!de-l.enfer-du-nord.net!feeder2.enfer-du-nord.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: Exec Security Date: Mon, 03 Sep 2012 06:55:09 +0200 Lines: 20 Message-ID: References: <70901dbf-84a0-475d-a287-6fe420963592@googlegroups.com> <6eb65973-56a8-45f6-8ed7-9a4cc088f35d@googlegroups.com> <0c1f42c4-672a-48ad-991c-3424e3e0902d@googlegroups.com> <754fd56a-7fdd-4bab-983f-92873ac60111@googlegroups.com> <8d2e25ff-acb0-4224-bb40-8d078409d771@googlegroups.com> <58ce539e-4061-47b7-a024-9ef09811513f@googlegroups.com> <4e02c3d0-efaa-4b1d-a9f3-3f4a92faab6b@googlegroups.com> <1a6f53bc-8f81-42d3-827b-9e5f8f158a79@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net xsY1JLy+WQ10MwUjqLvmTAB88AZAxTk4VX/teSbNtRRQHq4NxlK+3kGF6VnX5dFTJD Cancel-Lock: sha1:Sxp0090ms7v45F+/69eIDHwByq8= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:12.0) Gecko/20120613 Firefox/12.0 SeaMonkey/2.9.1 In-Reply-To: <1a6f53bc-8f81-42d3-827b-9e5f8f158a79@googlegroups.com> Xref: csiph.com comp.lang.php:6938 Ryan wrote: > IMO I see no security issue with exec() in this setup. The command in exec() is hardcoded, not using any user inputs. > Someone would have to find a way to write their own php script to use exec() and get it uploaded into my vhost to cause any problems. > If they can manage to do that that can cause enough issues even with exec() disabled. I have seen quite many times when a host with exec enabled and user code don't have any exec calls, where a someone managed to use trigger eval and then executed exec. I see both exec (and similar) and eval as no no in a web server. There will always come a day when you want to add something more and suddenly you have something that will allow things to go wrong, I think it's better to do a more solid solution from start, even if it takes more work, no matter if you do use a database or a message queue. But it's your system, so you decide how you want to do things. -- //Aho