Laravel Dangerous Function Calls: How to Eliminate eval, shell_exec, and system from Your Codebase

The Problem

How to Fix

1. 1

   Find all dangerous function calls in your codebase

   Search for dangerous functions across your project:

   grep -rn 'eval\|shell_exec\|system\|exec\|proc_open\|passthru\|popen\|pcntl_exec' app/ routes/ resources/

   Also check for backtick operator usage:

   grep -rn '`.*\$' app/

   Document each occurrence and trace whether user input can reach it.

2. 2

   Replace with safe Laravel alternatives

   Laravel provides safe alternatives for most use cases:

   // Instead of shell_exec('git log')
   use Symfony\Component\Process\Process;
   $process = new Process(['git', 'log', '--oneline', '-10']);
   $process->run();

   // Instead of exec('convert image.png ...')
   use Intervention\Image\Facades\Image;
   Image::make($path)->resize(300, 200)->save();

   // Instead of eval() for dynamic logic
   use a strategy pattern, config-driven behavior, or Blade::render()

   The Symfony Process component is preferred because it uses array arguments, preventing shell injection by design.

3. 3

   If you must use process execution, sanitize strictly

   When shell commands are unavoidable, never pass user input directly:

   // DANGEROUS
   shell_exec('ffmpeg -i ' . $request->input('file'));

   // SAFE — use escapeshellarg for each argument
   $file = escapeshellarg($validated['file']);
   shell_exec('ffmpeg -i ' . $file);

   // SAFEST — use Symfony Process with array arguments
   use Symfony\Component\Process\Process;
   $process = new Process(['ffmpeg', '-i', $validated['file']]);
   $process->setTimeout(60);
   $process->run();

   Array-based process execution prevents shell metacharacter injection entirely.

4. 4

   Disable dangerous functions in php.ini

   On production servers, disable functions you never need:

   ; php.ini disable_functions = eval,exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec

   Note: Some packages legitimately need exec() or proc_open() (like Symfony Process). Only disable functions your application does not require. Test thoroughly after making changes.

How to Verify

php artisan stackshield:scan --check=SS003

grep -rn 'eval(\|shell_exec(\|system(' app/ --include='*.php'

Prevention

Frequently Asked Questions