[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Arithmetic + array allows for code injection
|
From: |
Pierre Gaston |
|
Subject: |
Arithmetic + array allows for code injection |
|
Date: |
Fri, 30 May 2014 20:57:42 +0300 |
It doesn't seem right for code looking as innocent as $((a[$i])) or
$((a["$i"])) to allow running arbitrary commands for some value of i, that
are no even that clever:
$ i='$( echo >&2 an arbitrary command )';: $((a["$i"]))
an arbitrary command
$ i='"$( echo >&2 an arbitrary command)"';: $((a[$i]))
an arbitrary command
- Arithmetic + array allows for code injection,
Pierre Gaston <=