fix #2367

system/Commands/Server/Serve.php

@@ -97,14 +97,14 @@ class Serve extends BaseCommand
 	/**
 	 * The current port offset.
 	 *
-	 * @var int
+	 * @var integer
 	 */
 	protected $portOffset = 0;
 
 	/**
 	 * The max number of ports to attempt to serve from
 	 *
-	 * @var int
+	 * @var integer
 	 */
 	protected $tries = 10;
 
@@ -136,7 +136,7 @@ public function run(array $params)
 		}
 
 		// Collect any user-supplied options and apply them.
-		$php  = CLI::getOption('php') ?? PHP_BINARY;
+		$php  = escapeshellarg(CLI::getOption('php') ?? PHP_BINARY);
 		$host = CLI::getOption('host') ?? 'localhost';
 		$port = (int) (CLI::getOption('port') ?? '8080') + $this->portOffset;
 
@@ -155,7 +155,8 @@ public function run(array $params)
 		// to ensure our environment is set and it simulates basic mod_rewrite.
 		passthru($php . ' -S ' . $host . ':' . $port . ' -t ' . $docroot . ' ' . $rewrite, $status);
 
-		if ($status && $this->portOffset < $this->tries) {
+		if ($status && $this->portOffset < $this->tries)
+		{
 			$this->portOffset += 1;
 
 			$this->run($params);