Command injection from HTTP request data in shell command execution in PHP

<?php
// SECURE: Using escapeshellarg for arguments
function processFileSafe($filename, $destination) {
    // Validate inputs first
    if (!isValidFilename($filename)) {
        throw new InvalidArgumentException('Invalid filename');
    }
    
    if (!isValidDestination($destination)) {
        throw new InvalidArgumentException('Invalid destination');
    }
    
    // SECURE: Escape arguments properly
    $safeFilename = escapeshellarg($filename);
    $safeDestination = escapeshellarg($destination);
    
    // Use fixed command with escaped arguments
    $command = "cp $safeFilename $safeDestination";
    
    exec($command, $output, $returnCode);
    
    if ($returnCode !== 0) {
        throw new RuntimeException('Command failed');
    }
    
    return $output;
}

function isValidFilename($filename) {
    // Strict validation
    return preg_match('/^[a-zA-Z0-9._-]+$/', $filename) &&
           strlen($filename) <= 255 &&
           !str_contains($filename, '..');
}

function isValidDestination($dest) {
    $allowedDirs = ['/backup', '/tmp/uploads'];
    return in_array($dest, $allowedDirs, true);
}

<?php
// SECURE: Using proc_open with argument array
function executeCommandSafe($operation, $filename) {
    // Validate operation against allowlist
    $allowedOps = ['count', 'checksum', 'info'];
    if (!in_array($operation, $allowedOps, true)) {
        throw new InvalidArgumentException('Operation not allowed');
    }
    
    // Validate filename
    if (!isValidFilename($filename)) {
        throw new InvalidArgumentException('Invalid filename');
    }
    
    // Map operations to commands
    $commands = [
        'count' => ['wc', '-l', $filename],
        'checksum' => ['sha256sum', $filename],
        'info' => ['file', $filename]
    ];
    
    $command = $commands[$operation];
    
    // SECURE: proc_open with argument array (no shell)
    $descriptors = [
        0 => ['pipe', 'r'],  // stdin
        1 => ['pipe', 'w'],  // stdout
        2 => ['pipe', 'w']   // stderr
    ];
    
    $process = proc_open($command, $descriptors, $pipes, '/safe/workdir');
    
    if (!is_resource($process)) {
        throw new RuntimeException('Failed to start process');
    }
    
    // Close stdin
    fclose($pipes[0]);
    
    // Read output
    $output = stream_get_contents($pipes[1]);
    $error = stream_get_contents($pipes[2]);
    
    fclose($pipes[1]);
    fclose($pipes[2]);
    
    $returnCode = proc_close($process);
    
    if ($returnCode !== 0) {
        throw new RuntimeException("Command failed: $error");
    }
    
    return $output;
}

<?php
// SECURE: Native PHP alternatives to shell commands
class SecureFileProcessor {
    private array $allowedOperations = ['copy', 'info', 'hash', 'lines'];
    private string $workDir = '/safe/uploads';
    private string $backupDir = '/safe/backup';
    
    public function processFile(string $operation, string $filename): array {
        // Validate inputs
        $this->validateOperation($operation);
        $filePath = $this->validateAndResolvePath($filename);
        
        // Execute operation using native PHP
        switch ($operation) {
            case 'copy':
                return $this->copyFile($filePath);
            case 'info':
                return $this->getFileInfo($filePath);
            case 'hash':
                return $this->calculateHash($filePath);
            case 'lines':
                return $this->countLines($filePath);
            default:
                throw new InvalidArgumentException('Unknown operation');
        }
    }
    
    private function copyFile(string $filePath): array {
        $filename = basename($filePath);
        $backupPath = $this->backupDir . '/' . $filename . '.' . time() . '.bak';
        
        // SECURE: Native PHP file copy
        if (!copy($filePath, $backupPath)) {
            throw new RuntimeException('Copy operation failed');
        }
        
        return [
            'success' => true,
            'message' => 'File copied successfully',
            'backup_path' => basename($backupPath)
        ];
    }
    
    private function getFileInfo(string $filePath): array {
        // SECURE: Native PHP file operations
        $stat = stat($filePath);
        $info = [
            'name' => basename($filePath),
            'size' => $stat['size'],
            'modified' => date('Y-m-d H:i:s', $stat['mtime']),
            'permissions' => substr(sprintf('%o', fileperms($filePath)), -4),
            'type' => filetype($filePath)
        ];
        
        return ['success' => true, 'info' => $info];
    }
    
    private function calculateHash(string $filePath): array {
        // SECURE: Native PHP hash calculation
        $hash = hash_file('sha256', $filePath);
        if ($hash === false) {
            throw new RuntimeException('Hash calculation failed');
        }
        
        return [
            'success' => true,
            'algorithm' => 'sha256',
            'hash' => $hash
        ];
    }
    
    private function countLines(string $filePath): array {
        // SECURE: Native PHP line counting
        $handle = fopen($filePath, 'r');
        if (!$handle) {
            throw new RuntimeException('Cannot open file');
        }
        
        $lineCount = 0;
        while (!feof($handle)) {
            if (fgets($handle) !== false) {
                $lineCount++;
            }
        }
        fclose($handle);
        
        return [
            'success' => true,
            'lines' => $lineCount
        ];
    }
    
    private function validateOperation(string $operation): void {
        if (!in_array($operation, $this->allowedOperations, true)) {
            throw new InvalidArgumentException('Operation not allowed');
        }
    }
    
    private function validateAndResolvePath(string $filename): string {
        // Filename validation
        if (!preg_match('/^[a-zA-Z0-9._-]+$/', $filename)) {
            throw new InvalidArgumentException('Invalid filename format');
        }
        
        if (strlen($filename) > 255) {
            throw new InvalidArgumentException('Filename too long');
        }
        
        // Resolve full path
        $filePath = realpath($this->workDir . '/' . $filename);
        
        // Ensure file is within work directory
        if (!$filePath || !str_starts_with($filePath, realpath($this->workDir))) {
            throw new InvalidArgumentException('File not in allowed directory');
        }
        
        // Check file exists and is readable
        if (!is_file($filePath) || !is_readable($filePath)) {
            throw new InvalidArgumentException('File not found or not readable');
        }
        
        return $filePath;
    }
}