Re: Arbitrary command execution from test on a quoted string

2021-11-02 Thread Dale R. Worley
elettrino via Bug reports for the GNU Bourne Again SHell writes: > The following shows an example of bash testing a quoted string and as > a result executing a command embedded in the string. > > Here I used the command "id" to stand as an example of a command. The > output of id on this machine w

Re: Arbitrary command execution from test on a quoted string

2021-10-31 Thread Greg Wooledge
On Sun, Oct 31, 2021 at 09:05:22AM +0100, felix wrote: > Unfortunely, this won't be useable with associative array, like: > >declare -A AssocVar='([Some string.]=foo)' >test -v AssocVar['Some string.'] && echo yes || echo no >yes >isvar AssocVar['Some string.'] && echo yes || echo

Re: Arbitrary command execution from test on a quoted string

2021-10-31 Thread felix
Unfortunely, this won't be useable with associative array, like: declare -A AssocVar='([Some string.]=foo)' test -v AssocVar['Some string.'] && echo yes || echo no yes isvar AssocVar['Some string.'] && echo yes || echo no no But Lea's solution seem work: test "${AssocVar['Some

Re: Arbitrary command execution from test on a quoted string

2021-10-29 Thread Greg Wooledge
On Fri, Oct 29, 2021 at 12:48:57PM +0300, Ilkka Virta wrote: > Not that I'm sure the upper one is still safe against every input. I think > issues with associative array keys have been > discussed on the list before. Sadly, yes. Bash is the exploding barbed wire death match of programming languag

Re: Arbitrary command execution from test on a quoted string

2021-10-29 Thread Greg Wooledge
On Fri, Oct 29, 2021 at 07:37:13AM +0200, Léa Gris wrote: > A safe way to replace: > test -v "$USER_INPUT" > > Would be: > test "${USER_INPUT@Q}" > > But it is not backward-compatible with older bash versions. test -v is fairly recent as well. That was introduced in 4.2, and the @Q syntax in 4.

Re: Arbitrary command execution from test on a quoted string

2021-10-29 Thread Ilkka Virta
On Fri, Oct 29, 2021 at 1:01 AM elettrino via Bug reports for the GNU Bourne Again SHell wrote: > user@machine:~$ USER_INPUT='x[$(id>&2)]' > user@machine:~$ test -v "$USER_INPUT" > uid=1519(user) gid=1519(user) groups=1519(user),100(users) > What you're doing here, is having the user name a vari

Re: Arbitrary command execution from test on a quoted string

2021-10-28 Thread Léa Gris
Le 29/10/2021 à 00:29, Greg Wooledge écrivait : On Thu, Oct 28, 2021 at 08:33:22PM +, elettrino via Bug reports for the GNU Bourne Again SHell wrote: user@machine:~$ USER_INPUT='x[$(id>&2)]' user@machine:~$ test -v "$USER_INPUT" uid=1519(user) gid=1519(user) groups=1519(user),100(users) us

Re: Arbitrary command execution from test on a quoted string

2021-10-28 Thread Greg Wooledge
On Thu, Oct 28, 2021 at 08:33:22PM +, elettrino via Bug reports for the GNU Bourne Again SHell wrote: > > user@machine:~$ USER_INPUT='x[$(id>&2)]' > user@machine:~$ test -v "$USER_INPUT" > uid=1519(user) gid=1519(user) groups=1519(user),100(users) > user@machine:~$ Whoo. This uses a feature

Re: Arbitrary command execution from test on a quoted string

2021-10-28 Thread Kerin Millar
On Thu, 28 Oct 2021 20:33:22 + elettrino via Bug reports for the GNU Bourne Again SHell wrote: > The following shows an example of bash testing a quoted string and as a > result executing a command embedded in the string. > > Here I used the command "id" to stand as an example of a command

Arbitrary command execution from test on a quoted string

2021-10-28 Thread elettrino via Bug reports for the GNU Bourne Again SHell
The following shows an example of bash testing a quoted string and as a result executing a command embedded in the string. Here I used the command "id" to stand as an example of a command. The output of id on this machine was as follows: user@machine:~$ id uid=1519(user) gid=1519(user) groups=1