Too many expansions when assigning to a "dynamic" array element?

[Pierre Gaston]

I don't use this but we often have question on irc (and from time to time here)
about indirect array reference, so I thought it might be worth mentionning

>From the example of http://mywiki.wooledge.org/BashFAQ/006

 ref='x[$(touch evilfile; echo 0)]'
 ls -l evilfile   # No such file or directory
 declare "$ref=value"
 ls -l evilfile   # It exists now!

The same thing happens if you use read and printf -v:

read "$ref" </dev/null #expand the $( )
printf -v "$ref" foo # also expand the $( )


In my opinion the $( ) should not be expanded as it introduces a security hole
without real value as far as I can see, since you can explicitely
expand the $( )
in the first place if that's what you want.

I can see how this can be difficult to implement as it's probably
difficult to make
a difference between a[$(getanindex)]=foo which is useful and the same
thing in a variable
but maybe at least a warning about it in the documentation of read or
printf -v could be nice.