[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: bash brace issues (similar to shellshock)
From: |
Chet Ramey |
Subject: |
Re: bash brace issues (similar to shellshock) |
Date: |
Mon, 6 Aug 2018 12:22:23 -0400 |
User-agent: |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 |
On 8/6/18 12:13 PM, Pierre Gaston wrote:
> On Mon, Aug 6, 2018 at 4:32 PM, martins dada <martinsdada03@gmail.com>
> wrote:
>
>> Find attached details regarding bash brace issues. King regards.
>>
>
> you are simply assigning (){ to a temporary environment before running the
> command
>
> $ n=(){ bash -c 'echo $n'
> (){
>
> just like:
>
> a=foo bash -c 'echo $a'
>
> I'd agree that I would not expect bash to accept this without quotes,
> but it does not allow to execute arbitrary commands like shellshock did.
> At least your examples don't show this.
Since bash parses the assignment as a possible compound array assignment,
it accepts the parens and doesn't throw an error. Once it discovers that
the statement doesn't qualify as a compound assignment, it has a choice:
it can go back and throw an error, or accept the assignment as if it were
quoted. It does the latter.
--
``The lyf so short, the craft so long to lerne.'' - Chaucer
``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU chet@case.edu http://tiswww.cwru.edu/~chet/