8000 \Symfony\Component\Process\Process::escapeArgument as a service class · Issue #41447 · symfony/symfony · GitHub
[go: up one dir, main page]
Skip to content

\Symfony\Component\Process\Process::escapeArgument as a service class #41447

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
tdgroot opened this issue May 29, 2021 · 5 comments
Closed

\Symfony\Component\Process\Process::escapeArgument as a service class #41447

tdgroot opened this issue May 29, 2021 · 5 comments
Labels
Feature Process

Comments

@tdgroot
Copy link
tdgroot commented May 29, 2021

Description
Extract \Symfony\Component\Process\Process::escapeArgument to a separate service class, so that external classes can make use of the shell argument escaping.

Commands like \Symfony\Component\Process\Process::fromShellCommandline accept raw input, but sometimes the client wants to make sure the arguments passed to that method are actually escaped. Or is argument binding the only preferred way to achieve this?

Example

<?php

use Symfony\Component\Process\ArgumentEscaper;
use Symfony\Component\Process\Process;

function test_piped_command(string $param): void
{
    $escaper = new ArgumentEscaper();
    
    $command = [];
    $command[] = 'echo ' . $escaper->escapeArgument($param);
    $command[] = 'md5sum';

    $shellCommand = implode('|', $command);

    $process = Process::fromShellCommandline($command);
    $process->run();
}
@nicolas-grekas
Copy link
Member

It's not possible to correctly escape arguments in a portable way. That's why the API of the Process component doesn't provide a way to escape arguments, and also why you should never do so. Instead, use prepared command lines.

@stof
Copy link
Member
stof commented May 29, 2021

Instead, use prepared command lines.

@nicolas-grekas do you mean the syntax passing an array to the Process constructor ? If yes, that's not a solution here, as it does not support using shell features like piping the output of a command to another one (which is done here). If no, you will need to provide more details about your solution.

@nicolas-grekas
Copy link
Member

See #34848

@nicolas-grekas
Copy link
Member
nicolas-grekas commented May 29, 2021 •
edited
Loading

Apparently, the doc has it wrong. See symfony/symfony-docs#15387

@nicolas-grekas
Copy link
Member

Closing as explained. TLDR: never escape argument, always use prepared command lines (for the exact same reasons as escaping SQL arguments in a no-go, as it's neither reliable/portable.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Feature Process
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@nicolas-grekas @stof @tdgroot
0