I don't use this but we often have question on irc (and from time to time here) about indirect array reference, so I thought it might be worth mentionning
>From the example of http://mywiki.wooledge.org/BashFAQ/006 ref='x[$(touch evilfile; echo 0)]' ls -l evilfile # No such file or directory declare "$ref=value" ls -l evilfile # It exists now! The same thing happens if you use read and printf -v: read "$ref" </dev/null #expand the $( ) printf -v "$ref" foo # also expand the $( ) In my opinion the $( ) should not be expanded as it introduces a security hole without real value as far as I can see, since you can explicitely expand the $( ) in the first place if that's what you want. I can see how this can be difficult to implement as it's probably difficult to make a difference between a[$(getanindex)]=foo which is useful and the same thing in a variable but maybe at least a warning about it in the documentation of read or printf -v could be nice.
