Re: Execution of code by ${...@P}

2016-11-14 Thread Chet Ramey
On 11/14/16 1:37 PM, Clint Hepner wrote: > Bash Version: 4.4 > Patch Level: 0 > Release Status: release > > Description: > > ${...@P} expansion allows arbitrary code to run. This might > be intentional, as it is how prompt strings work, but it > does feel like an understated secur

Execution of code by ${...@P}

2016-11-14 Thread Clint Hepner
Configuration Information [Automatically generated, do not change]: Machine: x86_64 OS: darwin16.0.0 Compiler: clang Compilation CFLAGS: -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64' -DCONF_OSTYPE='darwin16.0.0' -DCONF_MACHTYPE='x86_64-apple-darwin16.0.0' -DCONF_VENDOR='apple' -DLOCALEDIR='/usr/loca