I am building a CLI APP using PHP in which I need to send notifications using notify-send as a root user.
Now I know I need to set DBUS_SESSION_BUS_ADDRESS before I try to send notification. otherwise it would not work.
Now this below code:
$c = sprintf("DBUS_SESSION_BUS_ADDRESS=".$DBUS_SESSION." /usr/bin/notify-send \"TITLE\" \"MESSAGE\"");
system($c);
Throws an error
system(): NULL byte detected. Possible attack in /filepath.php on line 186
from my extensive debugging I have found $DBUS_SESSION is causing the issue. However If I hard code the $DBUS_SESSION value then the command works without a problem!.
like this:
$c = sprintf("DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus,guid=5ded8923178f8ea19642e36a5a37eb76 /usr/bin/notify-send \"sdfTITLE\" \"MESSAGE\"");
system($c);
What is going on here? How can I solve this?
The problem is that you're directly passing the variable to sprintf, but that's not how it works. You dictate the argument type, then provide the variable in order as continued arguments to the sprintf function, like this:
$c = sprintf("DBUS_SESSION_BUS_ADDRESS=%s /usr/bin/notify-send \"TITLE\" \"MESSAGE\"", $DBUS_SESSION);
system($c);
This should solve the NULL BYTE detected error