Re: [Help-bash] avoiding shell variable expansion

[Andy Chu]

Simplest way:

1. Store the command in an array.  Quote each arg properly.

mycmd=(ls '*')

2. Then run

$ "${mycmd[@]}"
ls: cannot access '*': No such file or directory

You probably want to memorize / copy-paste that sequence of characters.
See my blog post:

Thirteen Incorrect Ways and Two Awkward Ways to Use Arrays

https://www.oilshell.org/blog/2016/11/06.html

Andy



On Thu, Oct 3, 2019 at 3:07 PM Greg Silverman <address@hidden>
wrote:

> In Python one  can spawn a child process and avoid bash expanding command
> line arguments, e.g.
>
> //file: ls.py
> import subprocess
> proc = subprocess.Popen(['/bin/ls','*'],shell=False)
>
> then
> ./ls.py
> /bin/ls: cannot access '*': No such file or directory
>
> As the shell argument is set to False, the ls command is not passed to
> bash before being executed and the star is not expanded to ${PWD}.
>
> Is there a way to launch a command from a bash script which, also, avoids
> shell expansion? This question is for security, to avoid code injection.
>
> Thanks,
>
> Greg Silverman
> Principal Engineer
> Veritas Technologies
> Santa Clara, CA
>
>