Re: Arithmetic + array allows for code injection

2014-05-30 Thread Dan Douglas
On Friday, May 30, 2014 08:57:42 PM Pierre Gaston wrote: > It doesn't seem right for code looking as innocent as $((a[$i])) or > $((a["$i"])) to allow running arbitrary commands for some value of i, that > are no even that clever: > > $ i='$( echo >&2 an arbitrary command )';: $((a["$i"])) > an a

bug-bash@gnu.org

2014-05-30 Thread Chet Ramey
On 5/30/14, 2:55 PM, Dale R. Worley wrote: > The two words don't seem me to be used interchangeably in the Bash > manual page. "evaluate" is used only for obtaining the value of > "arithmetic evaluations" and "conditional expressions", whereas > "expand" is used for operations that are strictly t

bug-bash@gnu.org

2014-05-30 Thread Dale R. Worley
> From: Eduardo A. Bustamante López OK, yes, I have just obtained bash-4.3.tar.gz from ftp.gnu.org, which is the latest and is dated 26-Feb-2014. It does expand the explanation as I'd like. > Also, I wouldn't be that picky on "evaluate" vs "expand", because > they can be used interchangeable he

Re: What is the difference between a newline and a semi-colon?

2014-05-30 Thread Chet Ramey
On 5/30/14, 2:40 PM, Andreas Schwab wrote: > Bruce Korb writes: > >> Thanks, Eric & Chet. I hope nobody ever needs to load up a set of >> aliases within a Makefile script. > > A non-interactive shell does not have aliases. Not by default, if it's named `bash'. However, since Posix specifies

Re: What is the difference between a newline and a semi-colon?

2014-05-30 Thread Eric Blake
On 05/30/2014 12:40 PM, Andreas Schwab wrote: > Bruce Korb writes: > >> Thanks, Eric & Chet. I hope nobody ever needs to load up a set of >> aliases within a Makefile script. > > A non-interactive shell does not have aliases. Unless you explicitly turn them on. And there are shell scripts tha

Re: What is the difference between a newline and a semi-colon?

2014-05-30 Thread Andreas Schwab
Bruce Korb writes: > Thanks, Eric & Chet. I hope nobody ever needs to load up a set of > aliases within a Makefile script. A non-interactive shell does not have aliases. Andreas. -- Andreas Schwab, sch...@linux-m68k.org GPG Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5

Re: What is the difference between a newline and a semi-colon?

2014-05-30 Thread Bruce Korb
Thanks, Eric & Chet. I hope nobody ever needs to load up a set of aliases within a Makefile script. There's no compelling need in my mind, but there's also apparently no possible way, either. Yummy.

Re: Arithmetic + array allows for code injection

2014-05-30 Thread Pierre Gaston
On Fri, May 30, 2014 at 9:08 PM, Greg Wooledge wrote: > On Fri, May 30, 2014 at 08:57:42PM +0300, Pierre Gaston wrote: > > It doesn't seem right for code looking as innocent as $((a[$i])) or > > $((a["$i"])) to allow running arbitrary commands for some value of i, > that > > are no even that clev

Re: Arithmetic + array allows for code injection

2014-05-30 Thread Greg Wooledge
On Fri, May 30, 2014 at 08:57:42PM +0300, Pierre Gaston wrote: > It doesn't seem right for code looking as innocent as $((a[$i])) or > $((a["$i"])) to allow running arbitrary commands for some value of i, that > are no even that clever: > > $ i='$( echo >&2 an arbitrary command )';: $((a["$i"]))

Arithmetic + array allows for code injection

2014-05-30 Thread Pierre Gaston
It doesn't seem right for code looking as innocent as $((a[$i])) or $((a["$i"])) to allow running arbitrary commands for some value of i, that are no even that clever: $ i='$( echo >&2 an arbitrary command )';: $((a["$i"])) an arbitrary command $ i='"$( echo >&2 an arbitrary command)"';: $((a[$i

Re: What is the difference between a newline and a semi-colon?

2014-05-30 Thread Chet Ramey
On 5/30/14, 11:01 AM, Bruce Korb wrote: > $ . xx ; cat xx ; proj ; pwd ; pwd -P > alias proj="cd ~/'google drive'/web" > bash: proj: command not found > /home/sciadmin/tmp > /home/sciadmin/tmp > $ . xx > $ cat xx ; proj ; pwd ; pwd -P > alias proj="cd ~/'google drive

Re: What is the difference between a newline and a semi-colon?

2014-05-30 Thread Greg Wooledge
On Fri, May 30, 2014 at 09:13:01AM -0600, Eric Blake wrote: > (I've seen ONE case where an alias can do things that a function cannot: > writing an alias for 'find' that temporarily inhibits globbing on the > arguments for JUST the find command - that has to be done via an alias, > because it depen

Re: What is the difference between a newline and a semi-colon?

2014-05-30 Thread Eric Blake
On 05/30/2014 09:01 AM, Bruce Korb wrote: > $ . xx ; cat xx ; proj ; pwd ; pwd -P > alias proj="cd ~/'google drive'/web" > bash: proj: command not found > /home/sciadmin/tmp > /home/sciadmin/tmp > $ . xx > $ cat xx ; proj ; pwd ; pwd -P > alias proj="cd ~/'google dri

What is the difference between a newline and a semi-colon?

2014-05-30 Thread Bruce Korb
$ . xx ; cat xx ; proj ; pwd ; pwd -P alias proj="cd ~/'google drive'/web" bash: proj: command not found /home/sciadmin/tmp /home/sciadmin/tmp $ . xx $ cat xx ; proj ; pwd ; pwd -P alias proj="cd ~/'google drive'/web" /home/sciadmin/google drive/web /home/sci