-
-
Notifications
You must be signed in to change notification settings - Fork 2
Closed
Labels
enhancementNew feature or requestNew feature or request
Description
Currently, the task runner can be manually called with a correctly crafted command instruction. This is supposedly different from Laravel 11's new Concurrency module, which runs the task in a hidden Artisan command.
This allows attackers to just input whatever stuff into the command line to run arbitrary code.
We have 2 options:
- Try to understand how this Concurrency module handles "hidden Artisan commands", and learn from them; or
- Add a way for this library to verify the runner instruction is sent from itself, and is not from an outsider
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or request