Re: Arbitrary command execution in shell - by design!

2021-10-29 Thread L A Walsh
On 2021/10/29 12:33, Greg Wooledge wrote: On Fri, Oct 29, 2021 at 11:59:02AM -0700, L A Walsh wrote: How much lameness Chet has introduced into bash to accommodate the wrong users. This is quite unfair. Huh? It's true--look at how functions have to be stored in the environment

hash not restored after running command -p

2021-10-29 Thread Roger Morris
Configuration Information [Automatically generated, do not change]: Machine: x86_64 OS: linux-gnu Compiler: gcc Compilation CFLAGS: -g -O2 -fdebug-prefix-map=/build/bash-a6qmCk/bash-5.0=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -Wno-parentheses -Wno-format-security uname

Re: Arbitrary command execution in shell - by design!

2021-10-29 Thread Robert Elz
Date:Fri, 29 Oct 2021 11:59:02 -0700 From:L A Walsh Message-ID: <617c4476.2010...@tlinx.org> | Bash is a command_line console language designed to execute commands | locally in the context of the user. Local user access to a console, | from a security

Re: Arbitrary command execution in shell - by design!

2021-10-29 Thread Léa Gris
on 29/10/2021 at 21:33, Greg Wooledge wrote : Making bash *less horrible* to use for programming purposes doesn't qualify as "lameness" in my book. Even if it does "enable" people to use shells for unsuited purposes, I'd still much rather have indexed and associative arrays (bash) than not

Re: Arbitrary command execution in shell - by design!

2021-10-29 Thread Greg Wooledge
On Fri, Oct 29, 2021 at 11:59:02AM -0700, L A Walsh wrote: > How much lameness Chett has introduced into bash to accommodate > the wrong users. This is quite unfair. The major systemic problems with bash (and sh) weren't introduced by Chet Ramey. They've been baked in from the very beginning.

Re: Arbitrary command execution in shell - by design!

2021-10-29 Thread L A Walsh
On 2021/10/29 05:01, Greg Wooledge wrote: On Fri, Oct 29, 2021 at 12:48:57PM +0300, Ilkka Virta wrote: Not that I'm sure the upper one is still safe against every input. I think issues with associative array keys have been discussed on the list before. Sadly, yes. Bash is the

Re: Arbitrary command execution from test on a quoted string

2021-10-29 Thread Greg Wooledge
On Fri, Oct 29, 2021 at 12:48:57PM +0300, Ilkka Virta wrote: > Not that I'm sure the upper one is still safe against every input. I think > issues with associative array keys have been > discussed on the list before. Sadly, yes. Bash is the exploding barbed wire death match of programming

Re: Arbitrary command execution from test on a quoted string

2021-10-29 Thread Greg Wooledge
On Fri, Oct 29, 2021 at 07:37:13AM +0200, Léa Gris wrote: > A safe way to replace: > test -v "$USER_INPUT" > > Would be: > test "${USER_INPUT@Q}" > > But it is not backward-compatible with older bash versions. test -v is fairly recent as well. That was introduced in 4.2, and the @Q syntax in

Re: Arbitrary command execution from test on a quoted string

2021-10-29 Thread Ilkka Virta
On Fri, Oct 29, 2021 at 1:01 AM elettrino via Bug reports for the GNU Bourne Again SHell wrote: > user@machine:~$ USER_INPUT='x[$(id>&2)]' > user@machine:~$ test -v "$USER_INPUT" > uid=1519(user) gid=1519(user) groups=1519(user),100(users) > What you're doing here, is having the user name a