From: Stephane Chazelas <stephane@chazelas.org>
To: Pier Paolo Grassi <pierpaolog@gmail.com>
Cc: Mikael Magnusson <mikachu@gmail.com>, Zsh-Users List <zsh-users@zsh.org>
Subject: Re: indirect assignment to array
Date: Thu, 16 Apr 2020 17:30:22 +0100 [thread overview]
Message-ID: <20200416163022.vremvngrnnbxgdg6@chazelas.org> (raw)
In-Reply-To: <CAP+y1xAG3ayQNE3JqeF_YOT5FZ9pLiUAF5TmPVoOv+nPyjK30A__22203.4378488146$1586994256$gmane$org@mail.gmail.com>
2020-04-16 01:42:29 +0200, Pier Paolo Grassi:
> Il giorno gio 16 apr 2020 alle ore 01:13 Mikael Magnusson <mikachu@gmail.com>
> ha scritto:
[...]
> > : ${(PA)varname::=$array}
> > (leave out the A for scalar assignment, and use AA for assoc arrays).
[...]
> Thanks! I was afraid I had to resort to eval.
[...]
What's wrong with "eval"? Note that many of those alternatives
to "eval" are just other evals in disguise or are as dangerous
(but giving the wrong impression that they're not).
: ${(PA)varname::=$array}
is a command injection vulnerability if the content of $varname
is not sanitized.
$ varname='x[$(uname>&2)]'
$ : ${(PA)varname::=$array}
Linux
zsh: bad math expression: empty string
So is:
eval $varname'=("$array[@]")'
but at least it's more obvious that it is.
In any case, I'd expect the contents of $varname to be known and
trusted in this case, while that of $array could be anything.
Note that that "$array[@]" (instead of $array) is needed to
preserve empty elements.
--
Stephane
next prev parent reply other threads:[~2020-04-16 16:31 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-15 23:01 Pier Paolo Grassi
2020-04-15 23:13 ` Mikael Magnusson
2020-04-15 23:42 ` Pier Paolo Grassi
2020-04-15 23:54 ` Bart Schaefer
2020-04-16 0:05 ` Pier Paolo Grassi
2020-04-16 0:12 ` Bart Schaefer
2020-04-16 16:02 ` Pier Paolo Grassi
2020-04-16 16:28 ` Sebastian Gniazdowski
2020-04-16 18:04 ` Pier Paolo Grassi
[not found] ` <CAP+y1xDa=fUvaP=gwbawRmcfwjq0ZH1KEnt=wTX4zOKaT4mzyQ__13411.9792653777$1587060411$gmane$org@mail.gmail.com>
2020-04-16 20:24 ` read -r and bad surprises (Was: indirect assignment to array) Stephane Chazelas
2020-04-16 21:06 ` Pier Paolo Grassi
[not found] ` <CAP+y1xAG3ayQNE3JqeF_YOT5FZ9pLiUAF5TmPVoOv+nPyjK30A__22203.4378488146$1586994256$gmane$org@mail.gmail.com>
2020-04-16 16:30 ` Stephane Chazelas [this message]
2020-04-16 16:37 ` indirect assignment to array Pier Paolo Grassi
2020-04-16 17:37 ` Bart Schaefer
2020-04-16 17:43 ` Pier Paolo Grassi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200416163022.vremvngrnnbxgdg6@chazelas.org \
--to=stephane@chazelas.org \
--cc=mikachu@gmail.com \
--cc=pierpaolog@gmail.com \
--cc=zsh-users@zsh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).