[CentOS] bash - safely pass untrusted strings?

Wed Feb 27 08:44:44 UTC 2008
Garrick Staples <garrick at usc.edu>

On Tue, Feb 26, 2008 at 11:16:27PM -0600, Les Mikesell alleged:
> Yes, but I'm looking for what happens before and after.  Why does
> unset foo
> foo=bar >$foo

This is interesting.  I would have guessed a syntax error.  I was surprised
when it worked.

This is a special case because there isn't a command being executed.  I can't
find this syntax in the manpage but it is behaving like two different
expressions because the variable is getting set in the _current_ shell:

  $ unset foo
  $ foo=bar >$foo
  $ echo $foo
  bar

So it syntactical equivalent with:
  foo=bar; >$foo

In the end, I think this may be a parsing bug.


> do something you might expect, but
> unset foo
> foo=bar echo  $foo >$foo
> doesn't?
> 
> Or why doesn't
> unset foo
> foo=bar echo $foo
> work like you'd expect while
> unset foo
> foo=bar some_other_command
> will put foo in the environment for the other command?

These examples do make sense to me.  They put foo in the env of the commands
(meaning, inside of the child process), but the string has already been
interpreted before execution.  some_other_command is free to use $foo
internally, but its args will be interpreted by the _current_ shell.

Looking at the second example, the first thing we see is variable replacement
turning it into 'foo=bar echo'; which then executes as you'd expect.

Also, I think these examples are a bit forced because it's not how you would do
it.  The point of supplying the env is for the use of child processes.  'echo'
is a shell-builtin.  The correct way is:
  (foo=bar; echo $foo)

Or a less likely:
  foo=bar eval echo \$foo


 
> >Quotes are
> >obeyed the entire time, but are actually _removed_ after the expansion.  
> >And
> >finally, file descriptors are opened the command is executed.
> 
> And how does this relate to ||, && and things on the right hand side of 
> |'s in terms of evaluation order and side effects?

The boolean operators are not part of the expressions.  They are looked at
first to divide the string into expressions.

 
> >I don't think you can write a simple list because the actual process is too
> >complex.  It would really be a tree or flowchart.
> 
> I'm sure I saw a simple list of the order of operations for the bourne 
> shell years ago with about 6 steps and which are repeated if you add an 
> eval to the line.  Bash handles some more complex expressions, but it 
> must still do the steps in the same order to be compatible.  You really 
> need to know this to do anything even slightly complicated and I'm 
> having trouble finding it again.

Well, let us know if you find it :)

-- 
Garrick Staples, GNU/Linux HPCC SysAdmin
University of Southern California

Please avoid sending me Word or PowerPoint attachments.
See http://www.gnu.org/philosophy/no-word-attachments.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://lists.centos.org/pipermail/centos/attachments/20080227/d1e60f3b/attachment-0004.sig>