Do not use a shell in proc_open if not really needed

sebastianbergmann · Mar 23, 2024 · 75efa73 · 75efa73
1 parent 406a2b4
commit 75efa73
Showing 1 changed file with 20 additions and 12 deletions.
diff --git a/src/Util/PHP/AbstractPhpProcess.php b/src/Util/PHP/AbstractPhpProcess.php
@@ -156,12 +156,15 @@ public function runTestJob(string $job, Test $test, string $processResultFile):
 
     /**
      * Returns the command based into the configurations.
+     *
+     * @return string[]
      */
-    public function getCommand(array $settings, ?string $file = null): string
+    public function getCommand(array $settings, ?string $file = null): array
     {
         $runtime = new Runtime;
 
-        $command = $runtime->getBinary();
+        $command = [];
+        $command[] = $runtime->getRawBinary();
 
         if ($runtime->hasPCOV()) {
             $settings = array_merge(
@@ -179,29 +182,29 @@ public function getCommand(array $settings, ?string $file = null): string
             );
         }
 
-        $command .= $this->settingsToParameters($settings);
+        $command = array_merge($command, $this->settingsToParameters($settings));
 
         if (PHP_SAPI === 'phpdbg') {
-            $command .= ' -qrr';
+            $command[] = '-qrr';
 
             if (!$file) {
-                $command .= 's=';
+                $command[] = 's=';
             }
         }
 
         if ($file) {
-            $command .= ' ' . escapeshellarg($file);
+            $command[] = $file;
         }
 
         if ($this->arguments) {
             if (!$file) {
-                $command .= ' --';
+                $command[] = '--';
             }
-            $command .= ' ' . $this->arguments;
+            $command[] = $this->arguments;
         }
 
         if ($this->stderrRedirection) {
-            $command .= ' 2>&1';
+            $command[] = '2>&1';
         }
 
         return $command;
@@ -212,12 +215,17 @@ public function getCommand(array $settings, ?string $file = null): string
      */
     abstract public function runJob(string $job, array $settings = []): array;
 
-    protected function settingsToParameters(array $settings): string
+    /**
+     * @param array $settings
+     * @return list<string>
+     */
+    protected function settingsToParameters(array $settings): array
     {
-        $buffer = '';
+        $buffer = [];
 
         foreach ($settings as $setting) {
-            $buffer .= ' -d ' . escapeshellarg($setting);
+            $buffer[] = '-d';
+            $buffer[] = $setting;
         }
 
         return $buffer;