chore: safe shell_exec

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

Author: vitormattos

src/Sign/JSignService.php

@@ -187,11 +187,7 @@ private function pkcs12Read(JSignParam $params): array
             }
             file_put_contents($tempPassword, $password);
             file_put_contents($tempEncriptedOriginal, $certificate);
-            shell_exec(<<<REPACK_COMMAND
-                cat $tempPassword | openssl pkcs12 -legacy -in $tempEncriptedOriginal -nodes -out $tempDecrypted -passin stdin &&
-                cat $tempPassword | openssl pkcs12 -in $tempDecrypted -export -out $tempEncriptedRepacked -passout stdin
-                REPACK_COMMAND
-            );
+            $this->safeShellExec($tempPassword, $tempEncriptedOriginal, $tempDecrypted, $tempEncriptedRepacked);
             $certificateRepacked = file_get_contents($tempEncriptedRepacked);
             if ($certificateRepacked === false) {
                 return [];
@@ -208,6 +204,25 @@ private function pkcs12Read(JSignParam $params): array
         return [];
     }
 
+    private function safeShellExec(
+        string $tempPassword,
+        string $tempEncriptedOriginal,
+        string $tempDecrypted,
+        string $tempEncriptedRepacked,
+    ): void
+    {
+        $tempPassword = escapeshellarg($tempPassword);
+        $tempEncriptedOriginal = escapeshellarg($tempEncriptedOriginal);
+        $tempDecrypted = escapeshellarg($tempDecrypted);
+        $tempEncriptedRepacked = escapeshellarg($tempEncriptedRepacked);
+
+        shell_exec(<<<REPACK_COMMAND
+            cat $tempPassword | openssl pkcs12 -legacy -in $tempEncriptedOriginal -nodes -out $tempDecrypted -passin stdin &&
+            cat $tempPassword | openssl pkcs12 -in $tempDecrypted -export -out $tempEncriptedRepacked -passout stdin
+            REPACK_COMMAND
+        );
+    }
+
     private function exportToPkcs12(\OpenSSLCertificate|string $certificate, \OpenSSLAsymmetricKey|\OpenSSLCertificate|string $privateKey, string $password): string
     {
         $certContent = null;