[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: envsubst with bash associative array
From: |
Bruno Haible |
Subject: |
Re: envsubst with bash associative array |
Date: |
Thu, 17 Oct 2024 09:45:34 +0200 |
Hi,
Luca Casavola wrote:
> I am an happy user of your useful tool envsubst.
>
> I wonder if this tool is going to handle bash's associative arrays as
> well, available since v.4.
>
> I tried this code but it doesn't work in my case:
>
> declare -A test_var
> test_var[bas]=100
> export test_var
> echo "\${test_var[bas]}" | envsubst
> ${test_var[bas]} ( instead of 100)
The documentation [1] says that
"Other kinds of substitutions done by a shell, such as
${variable-default} or $(command-list) or `command-list`,
are not performed by the envsubst program, due to security reasons."
The same thing holds for the expressions you show above:
If we were to allow
${array_name[array_index_expression]}
it would also apply to
${test_var["b"`echo a`"s"]}
But since (as you can see by looking into gettext.sh) 'envsubst' is meant
to be applied on translated strings, provided by a translator, this would
allow the translator to include arbitrary code that will get executed
when eval_gettext is run. Which we obviously cannot allow, for security
reasons.
Bruno
[1]
https://www.gnu.org/software/gettext/manual/html_node/envsubst-Invocation.html