Re: Arithmetic + array allows for code injection

2014-06-02 Thread Maarten Billemont
On Jun 2, 2014, at 9:34 AM, Greg Wooledge wrote: > On Mon, Jun 02, 2014 at 03:08:17PM +0200, Andreas Schwab wrote: >> Greg Wooledge writes: >> >>> imadev:~$ : $((a[$x])) >>> bash: Mon Jun 2 08:06:39 EDT 2014: syntax error in expression (error token >>> is "Jun 2 08:06:39 EDT 2014") >>> >>> Th

Re: Arithmetic + array allows for code injection

2014-06-02 Thread Andreas Schwab
If you want to write robust scripts, don't use shell. Andreas. -- Andreas Schwab, SUSE Labs, sch...@suse.de GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7 "And now for something completely different."

Re: Arithmetic + array allows for code injection

2014-06-02 Thread Greg Wooledge
On Mon, Jun 02, 2014 at 03:08:17PM +0200, Andreas Schwab wrote: > Greg Wooledge writes: > > > imadev:~$ : $((a[$x])) > > bash: Mon Jun 2 08:06:39 EDT 2014: syntax error in expression (error token > > is "Jun 2 08:06:39 EDT 2014") > > > > There's the code-injection problem that started the thread

Re: Arithmetic + array allows for code injection

2014-06-02 Thread Chet Ramey
On 6/2/14, 9:34 AM, Greg Wooledge wrote: > (One could argue that POSIX's wording doesn't require the command > substitution be done in a second pass AFTER the parameter expansion. > But apparently it has been interpreted this way.) Posix doesn't have arrays, and so doesn't concern itself with how

Re: Arithmetic + array allows for code injection

2014-06-02 Thread Pierre Gaston
On Mon, Jun 2, 2014 at 4:44 PM, Chet Ramey wrote: > On 6/2/14, 8:21 AM, Greg Wooledge wrote: > > On Fri, May 30, 2014 at 09:28:13PM -0500, Dan Douglas wrote: > >> The problem is most people don't realize how "variables" are evaluated. > >> Any time the shell needs to reference a variable, it take

Re: Arithmetic + array allows for code injection

2014-06-02 Thread Chet Ramey
On 6/2/14, 8:21 AM, Greg Wooledge wrote: > On Fri, May 30, 2014 at 09:28:13PM -0500, Dan Douglas wrote: >> The problem is most people don't realize how "variables" are evaluated. >> Any time the shell needs to reference a variable, it takes a string >> like: "arr[$foo]" and, if there's an index, th

Re: Arithmetic + array allows for code injection

2014-06-02 Thread Andreas Schwab
Greg Wooledge writes: > imadev:~$ : $((a[$x])) > bash: Mon Jun 2 08:06:39 EDT 2014: syntax error in expression (error token is > "Jun 2 08:06:39 EDT 2014") > > There's the code-injection problem that started the thread. Here the index is '$(date)'. *Note (bash) Arithmetic Expansion:: ... All t

Re: Arithmetic + array allows for code injection

2014-06-02 Thread Greg Wooledge
On Fri, May 30, 2014 at 09:28:13PM -0500, Dan Douglas wrote: > The problem is most people don't realize how "variables" are evaluated. > Any time the shell needs to reference a variable, it takes a string > like: "arr[$foo]" and, if there's an index, the string within the index > gets processed for

Re: Arithmetic + array allows for code injection

2014-05-30 Thread Dan Douglas
On Friday, May 30, 2014 08:57:42 PM Pierre Gaston wrote: > It doesn't seem right for code looking as innocent as $((a[$i])) or > $((a["$i"])) to allow running arbitrary commands for some value of i, that > are no even that clever: > > $ i='$( echo >&2 an arbitrary command )';: $((a["$i"])) > an a

Re: Arithmetic + array allows for code injection

2014-05-30 Thread Pierre Gaston
On Fri, May 30, 2014 at 9:08 PM, Greg Wooledge wrote: > On Fri, May 30, 2014 at 08:57:42PM +0300, Pierre Gaston wrote: > > It doesn't seem right for code looking as innocent as $((a[$i])) or > > $((a["$i"])) to allow running arbitrary commands for some value of i, > that > > are no even that clev

Re: Arithmetic + array allows for code injection

2014-05-30 Thread Greg Wooledge
On Fri, May 30, 2014 at 08:57:42PM +0300, Pierre Gaston wrote: > It doesn't seem right for code looking as innocent as $((a[$i])) or > $((a["$i"])) to allow running arbitrary commands for some value of i, that > are no even that clever: > > $ i='$( echo >&2 an arbitrary command )';: $((a["$i"]))