Re: Arithmetic + array allows for code injection

[Chet Ramey]

On 6/2/14, 9:34 AM, Greg Wooledge wrote:

> (One could argue that POSIX's wording doesn't require the command
> substitution be done in a second pass AFTER the parameter expansion.
> But apparently it has been interpreted this way.)

Posix doesn't have arrays, and so doesn't concern itself with how array
indices are expanded.  It does, however, only require that variables
whose value looks like an integer constant be expanded within expressions.
Bash has never done that; the variable's value is treated as an expression.

Chet
-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet@case.edu    http://cnswww.cns.cwru.edu/~chet/