fix: escape shell arguments in SDE import command to prevent command injection

[cchopin]

Security Fix: Command Injection in SDE Update Command

Vulnerability

The seat:eve:update:sde Artisan command builds a mysql shell command by directly concatenating user-supplied options (database host, user, password, name) without escaping:

exec('mysql --user=' . $this->option('db-user') . ' ...');

Impact

An administrator running this command with malicious or unexpected characters in CLI options could trigger unintended shell execution. While this command requires administrative access to run, proper shell escaping is a fundamental security practice that prevents unexpected behavior from special characters (spaces, quotes, semicolons, backticks) in any configuration value.

Examples of inputs that would cause unexpected behavior without escaping:

• A database name containing a space: my database → splits into two shell tokens
• A password containing $(...) → triggers command substitution
• A value containing ; → allows command chaining

Fix

Wrapped all dynamic values passed to shell commands with escapeshellarg(), which correctly quotes and escapes the value for safe use as a single shell argument regardless of its content.

This fix covers both the MySQL and PostgreSQL import paths, including:

• importMysqlSde(): username, password (replacing the incorrect escapeshellcmd() usage), host, port, database name, and the extracted SQL file path
• importPgSqlSde(): password (in PGPASSWORD env var assignment), database name, host, port, username, table names, and the extracted dump file path

References

• PHP Documentation: escapeshellarg()
• OWASP: Command Injection Defense Cheat Sheet
• CWE-78: Improper Neutralization of Special Elements used in an OS Command

[recursivetree]

Thank you for the report. We will investigate it further.