• State Not Answered
  • Replies replies
    0
  • Subscribers subscribers
    19
  • Views views
    52
  • Users 0 members are here

Fortify scan flagging as bug in command injection even I applied escapeshellarg() and escapeshellcmd()?

Kamakshi Rajendran

PHP:

Fortify scan flagging as bug in command injection even I applied escapeshellarg() and escapeshellcmd()

Also, I tried the proc_open() with escapeshellarg() and escapeshellcmd() - still flagging as bug in command injection

Examples:

$inp = "input.jpg";

$out = "output.jpg";

$command = "convert ".escapeshellarg($inp)." -resize 70x70 ".escapeshellarg($out)."";
shell_exec(escapeshellcmd($command));



Any suggestions to overcome this bug?

Thanks in advance.

Resources

Support
Documentation
Learning Services
Partner Programs
Privacy
Compliance
Help
Company
Privacy Policy
Terms of Use
Cookies Preferences
Accessibility
Anti-Slavery Statement
Support
Contact Us
Careers
Code of Business Conduct and Ethics
The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.