diff --git a/include/thirdparty/process/Finder.php b/include/thirdparty/process/Finder.php index 5e44243..ed41211 100644 --- a/include/thirdparty/process/Finder.php +++ b/include/thirdparty/process/Finder.php @@ -39,12 +39,19 @@ class Finder $this->validateTimeout($timeout); $this->timeout = $timeout; } - - public function setFinder(string $finder): self + + public function setFinder(string $finder): self { + // STRICT SECURITY: Only allow 'find' or 'finder'. + $allowed = ['find', 'finder']; + + if (!in_array($finder, $allowed)) { + throw new \InvalidArgumentException("Security Error: The finder type '$finder' is not allowed."); + } + $this->finder = $finder; return $this; - } + } /** * Update the timeout after instantiation.