<commit_before># System commands
-------

## Example:


    <?php

		class systemCommands{ 	

			/*
			Define the whitelist pattern and validation type and input parameter like:
			getFiles("value1,value2,etc", "alphanummeric", $_GET['filename'], "3")
			*/
			public function command($whiteListPattern, $validationType, $inputParameter){

				//Here we include al the necessary classes like audit logs, whitelisting and validation:
				include("classes.php");

				$validate  = new validation();
				$whitelist = new whitelisting();

				$continue = true;

				/*
				Whenever a system command is finished, you should properly sanitize and escape this user input.
				System command functions examples are: system(), eval(), exec()

				First, we want to filter the filenames for expected values. For this example we use only a-z/0-9
				Whenever the values are tampered with, we can assume an attacker is trying to inject malicious input.
				for more information about validation see "input validations" in the code examples:
				*/

				if($validate->inputValidation($inputParameter, $validationType,
				"Invalid userinput for system commands", "HIGH", $countLevel) == false) {$continue = false;}

				/*
				Seccond, we want to whitelist the filenames for expected values, in this example they are,
				page1,page2 etc.. for more information about whitelisting see "white-listing" in the code examples:
				*/

				if($whitelist->checkpattern($whiteListPattern, $inputParameter, $countLevel) == false)
				{$continue = false;}

				//If all went good we include the filename
				if($continue == true){

					//Even though there is a match we still escape the shellcommand:
					$command = './configure '.$inputParameter;
					$escaped_command = escapeshellcmd($command);
					//Only after validation do we put the shellcommand into the system() function:
					system($inputParameter);
				}
			}
		}

    ?>
<commit_msg>Security bug fix (#361)<commit_after># System commands
-------

## Example:


    <?php

		class systemCommands{ 	

			/*
			Define the whitelist pattern and validation type and input parameter like:
			getFiles("value1,value2,etc", "alphanummeric", $_GET['filename'], "3")
			*/
			public function command($whiteListPattern, $validationType, $inputParameter){

				//Here we include al the necessary classes like audit logs, whitelisting and validation:
				include("classes.php");

				$validate  = new validation();
				$whitelist = new whitelisting();

				$continue = true;

				/*
				Whenever a system command is finished, you should properly sanitize and escape this user input.
				System command functions examples are: system(), eval(), exec()

				First, we want to filter the filenames for expected values. For this example we use only a-z/0-9
				Whenever the values are tampered with, we can assume an attacker is trying to inject malicious input.
				for more information about validation see "input validations" in the code examples:
				*/

				if($validate->inputValidation($inputParameter, $validationType,
				"Invalid userinput for system commands", "HIGH", $countLevel) == false) {$continue = false;}

				/*
				Seccond, we want to whitelist the filenames for expected values, in this example they are,
				page1,page2 etc.. for more information about whitelisting see "white-listing" in the code examples:
				*/

				if($whitelist->checkpattern($whiteListPattern, $inputParameter, $countLevel) == false)
				{$continue = false;}

				//If all went good we include the filename
				if($continue == true){

					//Even though there is a match we still escape the shellcommand:
					$command = './configure '.$inputParameter;
					$escaped_command = escapeshellcmd($command);
					//Only after validation do we put the shellcommand into the system() function:
					system($escaped_command);
				}
			}
		}

    ?>

{'fraction_non_alphanumeric': 0.09831531305003771, 'fraction_numerical': 0.004274578828262509, 'mean_word_length': 3.0925925925925926, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4264609', 'n_tokens_mistral': 1310, 'n_tokens_neox': 1019, 'n_words': 409}