Re: REGRESSION: shellshock patch rejects valid function names

[Eric Blake]

On 09/29/2014 08:33 PM, David Korn wrote:
> I fixed the bug in ksh that allows you delete a special builtin.

Thanks; here's another ksh bug:

$ env 'a|b=' bash -c 'set | grep a"."b'
$ env 'a|b=' ksh -c 'set | grep a"."b'
a|b=''

But per the documentation of set, "If no options or arguments are
specified, set shall write the names and values of all shell variables
in the collation sequence of the current locale."  And elsewhere,

Environment variable names used by the utilities in the Shell and
Utilities volume of IEEE Std 1003.1-2001 consist solely of uppercase
letters, digits, and the '_' (underscore) from the characters defined in
Portable Character Set and do not begin with a digit. Other characters
may be permitted by an implementation; applications shall tolerate the
presence of such names.

Where this is a problem is that by exposing the name "a|b" through set,
ksh is making the claim that it is a valid shell variable, even though:

$ ksh -c 'unset "a|b"'
ksh: unset: a|b: invalid variable name

So ksh should be fixed to behave like bash to sanitize the environment
and strip out any invalid names before populating the set of shell
variables advertised through 'set' (you can still leave such name/value
pairs in the environment handed to children, unmolested, the way bash
does; it's just that you should not be able to get at or modify those
names from the shell).

https://bugzilla.redhat.com/show_bug.cgi?id=1147645 is also tracking
this issue.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

signature.asc
Description: OpenPGP digital signature