【PHP8.x】escapeshellcmd関数の使い方

Copy
1<?php
2
3/**
4 * Executes shell commands safely, demonstrating the distinct purposes of
5 * escapeshellarg() and escapeshellcmd().
6 *
7 * escapeshellarg() is used to safely escape individual arguments for a shell command,
8 * ensuring they are treated as a single, quoted string by the shell.
9 *
10 * escapeshellcmd() is used to escape the entire command string itself, primarily
11 * to prevent command chaining (e.g., using ';' or '&&' to execute another command).
12 * It is generally less secure for arguments than escapeshellarg().
13 *
14 * @param string $baseCommand The base command to execute (e.g., 'ls', 'echo').
15 * @param array $args An array of arguments to pass to the command.
16 * @return string A summary of the demonstration.
17 */
18function demonstrateShellEscaping(string $baseCommand, array $args): string
19{
20    echo "--- Demonstration for Base Command: '" . $baseCommand . "' with Arguments: ['" . implode("', '", $args) . "'] ---" . PHP_EOL . PHP_EOL;
21
22    // --- Scenario 1: Safely building a command with user-supplied arguments (Recommended) ---
23    // Use `escapeshellarg()` for each individual argument.
24    // This function encloses each argument in single quotes and escapes any single quotes
25    // within the argument, ensuring it is treated as a single, literal string by the shell.
26    // This is the primary method to prevent argument injection vulnerabilities.
27    $escapedArgs = array_map('escapeshellarg', $args);
28    $safeCommandWithArgs = $baseCommand . ' ' . implode(' ', $escapedArgs);
29
30    echo "--- Using escapeshellarg() for arguments ---" . PHP_EOL;
31    echo "  Purpose: Ensure each argument is treated as a single, quoted string." . PHP_EOL;
32    echo "  Constructed command: " . $safeCommandWithArgs . PHP_EOL;
33    // Execute and capture output for demonstration. '2>&1' redirects standard error to standard output.
34    echo "  Simulated output (arguments safely quoted):" . PHP_EOL;
35    echo "    " . str_replace("\n", "\n    ", shell_exec($safeCommandWithArgs . ' 2>&1')) . PHP_EOL . PHP_EOL;
36
37    // --- Scenario 2: Preventing command chaining with user-supplied entire command strings ---
38    // `escapeshellcmd()` is used when you are passing an entire (potentially user-supplied)
39    // command string to the shell and want to prevent arbitrary command execution via
40    // command chaining characters (e.g., `;`, `&&`, `||`, `|`, `&`, etc.).
41    // It escapes these specific metacharacters.
42    // NOTE: This function does NOT quote the command; it escapes specific metacharacters.
43    // It is generally safer to use a fixed base command and `escapeshellarg()` for its arguments.
44    $maliciousUserInputCommand = "echo Hello; ls -la /etc";
45    $escapedMaliciousCommand = escapeshellcmd($maliciousUserInputCommand);
46
47    echo "--- Using escapeshellcmd() for an entire (potentially malicious) command string ---" . PHP_EOL;
48    echo "  Purpose: Prevent execution of multiple commands if user input is the entire command." . PHP_EOL;
49    echo "  Original command string: " . $maliciousUserInputCommand . PHP_EOL;
50    echo "  escapeshellcmd() result:   " . $escapedMaliciousCommand . PHP_EOL;
51    echo "  Simulated output (notice '; ls -la /etc' is not executed as a separate command):" . PHP_EOL;
52    echo "    " . str_replace("\n", "\n    ", shell_exec($escapedMaliciousCommand . ' 2>&1')) . PHP_EOL . PHP_EOL;
53    
54    $userSuppliedPotentiallyHarmfulCommand = "ls -l /tmp; rm -rf /";
55    $cleanedUserSuppliedPotentiallyHarmfulCommand = escapeshellcmd($userSuppliedPotentiallyHarmfulCommand);
56    echo "  Another example with escapeshellcmd() to prevent 'rm -rf /' from running:" . PHP_EOL;
57    echo "  Original command string: " . $userSuppliedPotentiallyHarmfulCommand . PHP_EOL;
58    echo "  escapeshellcmd() result:   " . $cleanedUserSuppliedPotentiallyHarmfulCommand . PHP_EOL;
59    echo "  Simulated output (no 'rm -rf /' execution):" . PHP_EOL;
60    echo "    " . str_replace("\n", "\n    ", shell_exec($cleanedUserSuppliedPotentiallyHarmfulCommand . ' 2>&1')) . PHP_EOL . PHP_EOL;
61
62    // --- Scenario 3: Why NOT to use escapeshellcmd() for individual arguments ---
63    // `escapeshellcmd()` is not designed for arguments. It only escapes certain metacharacters
64    // within the string, but does not enclose it in quotes. This means that an argument
65    // containing spaces or other unescaped shell metacharacters could still be
66    // misinterpreted as multiple arguments or command parts by the shell.
67    $problematicArg = "file with spaces; and a semicolon.txt";
68    $incorrectlyEscapedArg = escapeshellcmd($problematicArg); // Only escapes the semicolon, not the spaces for quoting
69    $incorrectCommand = $baseCommand . ' ' . $incorrectlyEscapedArg;
70
71    echo "--- Incorrect use: escapeshellcmd() on an individual argument ---" . PHP_EOL;
72    echo "  Problematic argument: " . $problematicArg . PHP_EOL;
73    echo "  escapeshellcmd() result on argument: " . $incorrectlyEscapedArg . PHP_EOL;
74    echo "  Constructed command (incorrectly): " . $incorrectCommand . PHP_EOL;
75    echo "  Simulated output (may not work as expected or be vulnerable due to lack of proper quoting for spaces):" . PHP_EOL;
76    echo "    " . str_replace("\n", "\n    ", shell_exec($incorrectCommand . ' 2>&1')) . PHP_EOL . PHP_EOL;
77
78    return "Demonstration complete for this set of inputs.";
79}
80
81// --- Practical Usage Examples ---
82
83// Example 1: Demonstrate a safe 'echo' command with spaces and potentially malicious input
84echo demonstrateShellEscaping(
85    'echo',
86    ['Hello World!', 'This is a message with spaces; and potentially evil content.']
87) . PHP_EOL . PHP_EOL;
88
89// Example 2: Demonstrate a safe 'ls' command with options and a problematic filename
90echo demonstrateShellEscaping(
91    'ls',
92    ['-l', '/tmp', 'My Documents/Photos; rm -rf /'] // Note: 'My Documents/Photos; rm -rf /' is treated as a single filename
93) . PHP_EOL . PHP_EOL;
94
95// Example 3: Demonstrating with a command that doesn't exist to show error handling (via 2>&1)
96echo demonstrateShellEscaping(
97    'nonexistent_command_xyz', // This command will likely fail
98    ['arg1', 'arg2']
99) . PHP_EOL . PHP_EOL;
100

PHPのescapeshellcmd関数は、外部のシェルコマンドを安全に実行するために使用される重要な機能です。この関数は、引数として渡されたstring $command（コマンド文字列）全体をエスケープし、戻り値としてエスケープされたstringを返します。主な目的は、;や&&といったコマンド連結に使われる特殊文字を無効化することで、悪意のあるユーザーが意図しない追加コマンドを実行するのを防ぐことです。

この関数はescapeshellarg関数と混同されがちですが、それぞれ異なる目的で使われます。escapeshellargは、個々のコマンド引数を安全にエスケープし、引用符で囲むことで、空白を含む引数や特殊文字がシェルによって正しく一つの引数として解釈されるようにします。これにより、引数インジェクションと呼ばれる脆弱性を防ぎます。

一方、escapeshellcmdはコマンド文字列全体を保護しますが、引数を引用符で囲む機能はありません。そのため、ユーザーからの入力をコマンドの引数として渡す場合は、escapeshellargを使って引数ごとにエスケープするのが最も安全です。escapeshellcmdは、コマンド文字列自体がユーザー入力によって構築されるような、より限定的な状況でコマンド連結を防ぐ目的で利用されますが、引数の安全な処理には不十分であるため、その利用には注意が必要です。