Skip to content

Allow securing the task runner #10

@Vectorial1024

Description

@Vectorial1024

Currently, the task runner can be manually called with a correctly crafted command instruction. This is supposedly different from Laravel 11's new Concurrency module, which runs the task in a hidden Artisan command.

This allows attackers to just input whatever stuff into the command line to run arbitrary code.

We have 2 options:

  • Try to understand how this Concurrency module handles "hidden Artisan commands", and learn from them; or
  • Add a way for this library to verify the runner instruction is sent from itself, and is not from an outsider

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions