hardening(poller): escapeshellarg hostname and port before exec() in collect_ups_data

[somethingwithproof]

Summary

poller_apcupsd.php:366 concatenates $ups['hostname'] and $ups['port'] from the database directly into a shell command string passed to exec() without escapeshellarg(). A hostname containing ;, |, or backticks causes OS command injection as the poller process user. An admin account is required to write the device record, but a SQL injection elsewhere could bypass that requirement.

Details

Field	Value
File	poller_apcupsd.php
Line	366
Auth required	Yes — Cacti admin to set hostname
CWE	CWE-78

// Before
$command = $found_path . 'apcaccess -u -h ' . $ups['hostname'] . ':' . $ups['port'];
exec($command, $output, $return);

// After — via CommandBuilder::buildApcaccessCommand()
// hostname validated: /^[a-zA-Z0-9.\-]{1,253}$/
// port validated: integer 1-65535
// binary path validated against allowlist
// escapeshellarg() applied to all arguments

Fix applied in src/Security/CommandBuilder.php, branch security/apcupsd-escapeshellarg-hostname-port.

Acceptance criteria

• Hostname validated against [a-zA-Z0-9.\-]{1,253} before exec
• Port validated as integer 1-65535
• escapeshellarg() applied to all shell arguments
• Regression tests in tests/Security/CommandInjectionRegressionTest.php

[somethingwithproof]

Closing public issue — moving to private security advisory per responsible disclosure policy.