Fix Command Injection in Spiral

Command injection in Spiral/RoadRunner environments is a critical RCE vector. High-performance apps often offload tasks to CLI tools; failing to sanitize inputs leads to full system compromise. Here's how to lock it down.

The Vulnerable Pattern

public function ping(Request $request)
{
    $host = $request->input('host');
    // CRITICAL: Direct concatenation into shell_exec allows command chaining (e.g., 'google.com; cat /etc/passwd')
    $output = shell_exec("ping -c 4 " . $host);
    return $output;
}

The Secure Implementation

To prevent command injection, you must eliminate the use of shell-invoking functions like shell_exec(), system(), or backticks with unsanitized user data. These functions pass the entire string to /bin/sh or cmd.exe, where metacharacters like ';' or '&' allow attackers to execute arbitrary binaries. The fix is twofold: First, apply strict input validation (whitelisting or regex) to ensure the data is what you expect. Second, use the Symfony Process component (standard in Spiral) and pass the command as an array. This method bypasses the shell entirely, passing arguments directly to the OS execve system call, making injection virtually impossible.

use Symfony\Component\Process\Process;
public function ping(Request $request)
{
$host = $request->input(‘host’);
// 1. Strict Validation: Ensure input matches expected format
if (!filter_var($host, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) && !filter_var($host, FILTER_VALIDATE_IP)) {
    throw new \InvalidArgumentException('Invalid host format');
}

// 2. Use Symfony Process: Passing an array bypasses the shell interpreter
$process = new Process(['ping', '-c', '4', $host]);
$process->run();

if (!$process->isSuccessful()) {
    return 'Error executing command';
}

return $process->getOutput();
}