Re: bash brace issues (similar to shellshock)

[Chet Ramey]

On 8/6/18 12:13 PM, Pierre Gaston wrote:
> On Mon, Aug 6, 2018 at 4:32 PM, martins dada <martinsdada03@gmail.com>
> wrote:
> 
>> Find attached details regarding bash brace issues. King regards.
>>
> 
> you are simply assigning (){ to a temporary environment before running the
> command
> 
> $  n=(){ bash -c 'echo $n'
> (){
> 
> just like:
> 
> a=foo bash -c 'echo $a'
> 
> I'd agree that I would not expect bash to accept this without quotes,
> but it does not allow to execute arbitrary commands like shellshock did.
> At least your examples don't show this.

Since bash parses the assignment as a possible compound array assignment,
it accepts the parens and doesn't throw an error. Once it discovers that
the statement doesn't qualify as a compound assignment, it has a choice:
it can go back and throw an error, or accept the assignment as if it were
quoted. It does the latter.

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    chet@case.edu    http://tiswww.cwru.edu/~chet/