2014-12-06 20:19:21 -0500, Chet Ramey:
> On 12/6/14 6:24 PM, Stephane Chazelas wrote:
> > Hiya,
> >
> > this is potentially dangerous:
> >
> > If $a was previously used as an array (or hash), then:
> >
> > declare a=$external_input
>
> So what you're saying is that blindly using external input
Stephane Chazelas wrote:
declare -l a="$external_input"
he's entitled to expect $a to contain the lower case version of
$external_input whatever $external_input contain.
---
Only if you properly quote "external input".
If you properly quote the external input I don't see the problem:
Doe
On Sun, Dec 07, 2014 at 07:34:53PM -0800, Linda Walsh wrote:
> Only if you properly quote "external input".
Well, that's the whole point, as a script writer, I don't expect to get
arbitrary code execution here:
| dualbus@hp:~/t$ unset var; value='[$(ls -l)]=1 [2]=2'; declare -a
var="($value)"; de
