The Daily WTF

Source control history can go a long way to telling a story. Take Cassi, who needed to run some PHP software which depended on a few binaries and shell calls to do its job. We can see the initial attempt to locate the path of a binary:

function findPathOf($path) { if (file_exists(“/usr/bin/$path”)) return “/usr/bin/$path”; return “/usr/local/bin/$path”; }

Now, this worked, so long as the binary was in one of those two places, but in any other case, that’s a problem. So someone changed it to:

function findPathOf($path) { exec(“which ” . escapeshellarg($path), $output, $returnVar); if ($output != 0) { return null; } return $output[0]; }

This version is completely wrong. $returnVar would contain the shell return code, which would be a non-zero value in the case of an error. $output will always be an array, and even in PHP, an empty array is never going to equal zero. So this

To read the full article click on the 'post' link at the top.