[CentOS] bash - safely pass untrusted strings?

Wed Feb 27 00:10:09 UTC 2008
Garrick Staples <garrick at usc.edu>

On Tue, Feb 26, 2008 at 05:13:12PM -0600, Les Mikesell alleged:
> Garrick Staples wrote:
> >On Tue, Feb 26, 2008 at 04:33:30PM -0600, Les Mikesell alleged:
> >>Does anyone have a quick reference to the order of operations as the 
> >>shell parses a command line (variable parsing,i/o redirection, wildcard 
> >>and variable expansion, splitting on IFS, quote removal, command 
> >>substitution etc.)?  That's really the first thing you need to know 
> >>about the shell and if there is a simple description it must be buried 
> >>in the middle of some obscure manual.
> >
> >This is from the "EXPANSION" section of the bash manpage:
> >
> >       The  order  of  expansions  is:  brace expansion, tilde expansion, 
> >       parameter, variable and arithmetic
> >       expansion and command substitution (done in a left-to-right 
> >       fashion), word  splitting,  and  pathname
> >       expansion.
> 
> That's one step in the bigger picture.  I want the one that includes 
> variable assignment, i/o redirection, quote removal, and a few other 
> operations.  I think I knew that a few decades ago, but now I don't even 
> know where to look it up.

That's pretty much the entire process for your basic expression.  Quotes are
obeyed the entire time, but are actually _removed_ after the expansion.  And
finally, file descriptors are opened the command is executed.

I don't think you can write a simple list because the actual process is too
complex.  It would really be a tree or flowchart.

-- 
Garrick Staples, GNU/Linux HPCC SysAdmin
University of Southern California

Please avoid sending me Word or PowerPoint attachments.
See http://www.gnu.org/philosophy/no-word-attachments.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://lists.centos.org/pipermail/centos/attachments/20080226/0dd1a7a4/attachment-0004.sig>