oss-sec mailing list archives

Re: Array importing in bash 4.3


From: Chet Ramey <chet.ramey () case edu>
Date: Mon, 29 Sep 2014 20:34:52 -0400

On 9/29/14, 10:42 AM, Florian Weimer wrote:
From: Florian Weimer <fweimer () redhat com>

Note that if you ship 4.3, you might want to reevaluate a decision to
enable array variable import from the environment.

I changed the subject because I'm sure this parenthetical comment got lost.

Fortunately, in bash 4.3 (patchlevel 25), you cannot just -DARRAY_EXPORT
and get array variable import/export.  The code doesn't compile, and if you
fix that, it does not link, and if you fix that, well, you end up with the
following issue.

That's a ton of trouble to go through just for this.  I don't have any
plans to enable array export.

The array import/export feature allows one to export and import variables
while preserving their array status.  Unfortunately, it enables this:

$ env -i 'FOO=([$(echo broken > /dev/tty)]=a)' ./bash -c true
broken
./bash: []=a: bad array subscript

That's actually how array assignment works.  The array index is run
through the shell word expansions, including command substitution, and
then the arithmetic expression evaluator to get the index.

Chet
-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet () case edu    http://cnswww.cns.cwru.edu/~chet/


Current thread: