[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Arithmetic + array allows for code injection

From: Andreas Schwab
Subject: Re: Arithmetic + array allows for code injection
Date: Mon, 02 Jun 2014 15:08:17 +0200
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux)

Greg Wooledge <address@hidden> writes:

> imadev:~$ : $((a[$x]))
> bash: Mon Jun 2 08:06:39 EDT 2014: syntax error in expression (error token is 
> "Jun 2 08:06:39 EDT 2014")
> There's the code-injection problem that started the thread.

Here the index is '$(date)'.

*Note (bash) Arithmetic Expansion:: ... All tokens in the expression
undergo parameter and variable expansion, command substitution, and
quote removal.  The result is treated as the arithmetic expression to be

> imadev:~$ : ${a[$x]}
> bash: $(date): syntax error: operand expected (error token is "$(date)")
> That also looks OK.

Here the index is '$x'.


Andreas Schwab, SUSE Labs, address@hidden
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."

reply via email to

[Prev in Thread] Current Thread [Next in Thread]