Command Injection in Laravel with Jwt Tokens

Remediation focuses on never passing untrusted JWT claims directly to shell commands. Use strict allowlisting, avoid shell execution where possible, and apply defense-in-depth validation.

• Validate and sanitize all JWT-derived data: Treat decoded claims as untrusted. Use allowlists for known values instead of blacklists.
• Avoid shell execution entirely: Prefer PHP-native operations (e.g., ZipArchive for archives) over shell commands.
• Use escapeshellarg: If shell commands are unavoidable, escape arguments properly.

Example 1: Safe filename construction

Instead of injecting a raw claim into a shell command, validate the username against a safe pattern and use PHP to create the archive:

<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use ZipArchive;

class ReportController extends Controller
{
    public function export(Request $request)
    {
        $token = $request->header('Authorization');
        if (!$token) {
            return response('Unauthorized', 401);
        }
        $decoded = JWT::decode($token, new Key(env('JWT_SECRET'), 'HS256'));
        $username = $decoded->username;

        // Strict allowlist: only alphanumeric, underscore, hyphen (adjust as needed)
        if (!preg_match('/^[a-zA-Z0-9_-]+$/D', $username)) {
            return response('Invalid username', 400);
        }

        // Safe: use PHP to create archive, no shell involvement
        $zip = new ZipArchive();
        $filename = storage_path("app/reports/report-{$username}.zip");
        if ($zip->open($filename, ZipArchive::CREATE | ZipArchive::OVERWRITE) !== true) {
            return response('Cannot create archive', 500);
        }
        $zip->addFile('/var/reports/data.txt', 'report.txt');
        $zip->close();

        return response()->download($filename);
    }
}
</code>

<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

class ReportController extends Controller
{
    public function generate(Request $request)
    {
        $token = $request->header('Authorization');
        if (!$token) {
            return response('Unauthorized', 401);
        }
        $decoded = JWT::decode($token, new Key(env('JWT_SECRET'), 'HS256'));
        $username = $decoded->username;

        if (!preg_match('/^[a-zA-Z0-9_-]+$/D', $username)) {
            return response('Invalid username', 400);
        }

        // Proper escaping; note: better to avoid shell_exec entirely
        $safeUsername = escapeshellarg($username);
        $output = shell_exec("tar -czf /tmp/report-{$safeUsername}.tar.gz /var/reports 2&& echo OK");
        return response($output);
    }
}
</code>