Re: Arithmetic + array allows for code injection

[Andreas Schwab]

Greg Wooledge <wooledg@eeg.ccf.org> writes:

> imadev:~$ : $((a[$x]))
> bash: Mon Jun 2 08:06:39 EDT 2014: syntax error in expression (error token is 
> "Jun 2 08:06:39 EDT 2014")
>
> There's the code-injection problem that started the thread.

Here the index is '$(date)'.

*Note (bash) Arithmetic Expansion:: ... All tokens in the expression
undergo parameter and variable expansion, command substitution, and
quote removal.  The result is treated as the arithmetic expression to be
evaluated.

> imadev:~$ : ${a[$x]}
> bash: $(date): syntax error: operand expected (error token is "$(date)")
>
> That also looks OK.

Here the index is '$x'.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."