Restrict shell-based mailers if we can't use them safely, fixes #966

changelog.md

@@ -1,5 +1,8 @@
 # PHPMailer Change Log
 
+## WIP
+* If we can't use escaping functions, refuse to do unsafe things
+
 ## Version 6.5.3 (November 25th, 2021)
 * Wrong commit tagged for the 6.5.2 release!
 * Version file updated

src/PHPMailer.php

@@ -1798,7 +1798,13 @@ class PHPMailer
      */
     protected static function isShellSafe($string)
     {
-        //Future-proof
+        //It's not possible to use shell commands safely (which includes the mail() function) without escapeshellarg,
+        //but some hosting providers disable it, creating a security problem that we don't want to have to deal with,
+        //so we don't.
+        if (!function_exists('escapeshellarg') || !function_exists('escapeshellcmd')) {
+            return false;
+        }
+
         if (
             escapeshellcmd($string) !== $string
             || !in_array(escapeshellarg($string), ["'$string'", "\"$string\""])