Re: Arithmetic + array allows for code injection

[Greg Wooledge]

On Fri, May 30, 2014 at 08:57:42PM +0300, Pierre Gaston wrote:
> It doesn't seem right for code looking as innocent as $((a[$i])) or
> $((a["$i"])) to allow running arbitrary commands for some value of i, that
> are no even that clever:
> 
> $ i='$( echo >&2 an arbitrary command )';:  $((a["$i"]))
> an arbitrary command
> 
> $ i='"$( echo >&2 an arbitrary command)"';: $((a[$i]))
> an arbitrary command

A workaround is to avoid the explicit $i inside the square brackets:

imadev:~$ i='$(date)'; : $((a[$i]))
bash: Fri May 30 14:05:34 EDT 2014: syntax error in expression (error token is 
"May 30 14:05:34 EDT 2014")
imadev:~$ i='$(date)'; : $((a[i]))
bash: $(date): syntax error: operand expected (error token is "$(date)")

I don't dispute the need to fix it, though.