Re: envsubst with bash associative array

[Bruno Haible]

Hi,

Luca Casavola wrote:
> I am an happy user of your useful tool envsubst.
> 
> I wonder if this tool is going to handle bash's associative arrays as 
> well, available since v.4.
> 
> I tried this code but it doesn't work in my case:
> 
> declare -A test_var
> test_var[bas]=100
> export test_var
> echo "\${test_var[bas]}" | envsubst
>       ${test_var[bas]} ( instead of 100)

The documentation [1] says that
  "Other kinds of substitutions done by a shell, such as
   ${variable-default} or $(command-list) or `command-list`,
   are not performed by the envsubst program, due to security reasons."

The same thing holds for the expressions you show above:
If we were to allow
  ${array_name[array_index_expression]}
it would also apply to
  ${test_var["b"`echo a`"s"]}
But since (as you can see by looking into gettext.sh) 'envsubst' is meant
to be applied on translated strings, provided by a translator, this would
allow the translator to include arbitrary code that will get executed
when eval_gettext is run. Which we obviously cannot allow, for security
reasons.

Bruno

[1] 
https://www.gnu.org/software/gettext/manual/html_node/envsubst-Invocation.html