Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
    public function getSoffice(){
        $check = 'LibreOffice';
		$data = Action($this->pluginName)->_appConfig('lb');
        $bin = isset($data['soffice']) ? $data['soffice'] : '';
		$bin = '"'.trim(iconv_system($bin)).'"';	// win路径空格处理
        $result = $this->checkBin($bin,$check);
        return $result ? $bin : false;
    }