Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: darwin18.7.0
Compiler: clang
Compilation CFLAGS: -DSSH_SOURCE_BASHRC
uname output: Darwin Mac 18.6.0 Darwin Kernel Version 18.6.0: Thu Apr 25
23:16:27 PDT 2019; root:xnu-4903.261.4~2/RELEASE_X86_64 x86_64
Machine Type: x86_64-apple-darwin18.7.0
Bash Version: 5.1
Patch Level: 4
Release Status: release
Description:
Bash (zsh/ash/etc) has incorrect character handling, when spec symbols
use in another program and work with stdout. Problem with command "!!", "!",
"$", etc.
Example: use standart output to console by python3:
python3 -c "print('ls')"
It's return ls to stdout. But if i print something like:
python3 -c "print('wow, it\'s working !!)"
bash will process "!!" like a command and substitute the previous command.
Will work the same way constructions like:
poc=whoami
$poc
python3 -c "print('!!')"
That return 'whoami' command.
Repeat-By:
I checked this bug in python3 (is an examples above), with command echo
and with command git commit -m "commit!!"
All command return stdout with previous command. This can be used for bypass
something local settings, like a ban on executable command, like run command
with NOPASSWD param and so on.
Fix:
[Description of how to fix the problem. If you don't know a
fix for the problem, don't include this section.]
