Re: uname lead to embed code execution

[Alex fxmbsw7 Ratchev]

as a side info, only interpretation of vars in builtins may be affected, eg
solution as written : single quote the '$ley', on the other side
${var[$faulty_key]} doesnt eval it, only args usage as for declare unset
and [[ -v
.. maybe ..

On Mon, Mar 1, 2021 at 3:40 PM Greg Wooledge <greg@wooledge.org> wrote:

> felix (felix@f-hauri.ch) wrote:
>
> > There it is:
> >
> > $ declare -A map; key='foo$(uname >/dev/tty)bar'; map[$key]=
> > $ echo map["$key"]
> > map[foo$(uname >/dev/tty)bar]
> > $ echo ${map["$key"]}
> >
> > $ unset map["$key"]
> > Linux
>
> Yeah, it's sad but true.  I've just added a whole (short) section on
> associative array index multiple expansions to my CodeInjection page.
>
> https://mywiki.wooledge.org/CodeInjection
>
>