Magebean Logo Magebean
← Back to Baseline

MB-0822

Partially automated Review request data reaching command and query calls

MB-C03 Secure Coding Practices High

Flag supported direct and single assignment flows from request superglobals into shell calls or named query text arguments.

Overview

Trace supported direct and single-assignment request flows into shell calls and named query text arguments. Confirm receiver identity and the actual trust boundary before classifying exploitability.

Why it Matters

Request-controlled command or query text deserves focused trust-boundary review.

Interpret the reported resource and collection scope before making changes. Unsupported source, unresolved symbols and bounded collection gaps cannot establish a clean result.

Verification Steps

Manual Verification

  1. Trace supported direct and single-assignment request flows into shell calls and named query text arguments. Confirm receiver identity and the actual trust boundary before classifying exploitability.
  2. Inspect the reported file, declaration, package or evidence record in the same selected release. Keep source observations separate from effective runtime behavior.
  3. Apply the rule-specific remediation below, validate the affected behavior in staging, and rerun the same selection.

Command / Review Sample

php magebean.phar audit --path=/var/www/magento --profile=module-source --rules=MB-0822 --modules=Vendor_Module

Use the assessed Magento project and the appropriate application or read-only review account. Replace example hosts, paths and identifiers with the assessment scope; configuration and source fragments are illustrative.

Remediation / Fix Guidance

  1. Review the exact reported source location and declared target.
  2. Validate the corrected code against the intended deployment in staging.
  3. Rerun MB-0822 against the same release, profile and relevant file/key/package scope; compare the new evidence and inspect any independent collection gaps.

Examples

Illustrative declaration/review examples, not recorded scan output. A pass example concerns only the stated predicate and supported collected scope.

Fail Example

shell_exec($_GET["command"]);

Pass Example

// Remove user-controlled command execution.
$taskRunner->runApprovedTask($authorizedTaskId);
// Review this service and authorization separately; a wrapper alone is no proof of safety.

Scope and Evidence Limits

Rule revision: 1. Target modes: LOCAL.

Flag supported direct and single assignment flows from request superglobals into shell calls or named query text arguments.

Bounded static detection. Findings apply to the documented syntax, declaration or flow patterns only.

Catalog coverage describes implementation capability, not a scan outcome. An incomplete manual review cannot establish that the criterion is satisfied.

References