From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.0 required=5.0 tests=MAILING_LIST_MULTI,
	RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham autolearn_force=no
	version=3.4.2
Received: (qmail 6502 invoked from network); 16 Apr 2020 16:31:14 -0000
Received-SPF:  pass (primenet.com.au: domain of zsh.org
  designates 203.24.36.2 as permitted sender)
  receiver=inbox.vuxu.org; client-ip=203.24.36.2
  envelope-from=<zsh-users-return-24781-ml=inbox.vuxu.org@zsh.org>
Received: from ns1.primenet.com.au (HELO primenet.com.au) (203.24.36.2)
  by inbox.vuxu.org with UTF8ESMTPZ; 16 Apr 2020 16:31:14 -0000
Received: (qmail 24983 invoked by alias); 16 Apr 2020 16:31:08 -0000
Mailing-List: contact zsh-users-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Users List <zsh-users.zsh.org>
List-Post: <mailto:zsh-users@zsh.org>
List-Help: <mailto:zsh-users-help@zsh.org>
List-Unsubscribe: <mailto:zsh-users-unsubscribe@zsh.org>
X-Seq: 24781
Received: (qmail 846 invoked by uid 1010); 16 Apr 2020 16:31:08 -0000
X-Qmail-Scanner-Diagnostics: from relay6-d.mail.gandi.net by f.primenet.com.au (envelope-from <stephane@chazelas.org>, uid 7791) with qmail-scanner-2.11 
 (clamdscan: 0.102.2/25779. spamassassin: 3.4.4.  
 Clear:RC:0(217.70.183.198):SA:0(-2.6/5.0):. 
 Processed in 2.764505 secs); 16 Apr 2020 16:31:08 -0000
X-Envelope-From: stephane@chazelas.org
X-Qmail-Scanner-Mime-Attachments: |
X-Qmail-Scanner-Zip-Files: |
Received-SPF: pass (ns1.primenet.com.au: SPF record at _nblcust.gandi.net designates 217.70.183.198 as permitted sender)
X-Originating-IP: 94.3.152.49
Date: Thu, 16 Apr 2020 17:30:22 +0100
From: Stephane Chazelas <stephane@chazelas.org>
To: Pier Paolo Grassi <pierpaolog@gmail.com>
Cc: Mikael Magnusson <mikachu@gmail.com>,
	Zsh-Users List <zsh-users@zsh.org>
Subject: Re: indirect assignment to array
Message-ID: <20200416163022.vremvngrnnbxgdg6@chazelas.org>
Mail-Followup-To: Pier Paolo Grassi <pierpaolog@gmail.com>,
	Mikael Magnusson <mikachu@gmail.com>,
	Zsh-Users List <zsh-users@zsh.org>
References: <CAP+y1xCb3NJn8BRsuwpO6XVgzAtGsBvP870M5na3mAH+CwJ_OA@mail.gmail.com>
 <CAHYJk3TmiNicTrwem6iRxKMxdNT5-ZB8W8vT5Gc=t7DrbPfBdQ@mail.gmail.com>
 <CAP+y1xAG3ayQNE3JqeF_YOT5FZ9pLiUAF5TmPVoOv+nPyjK30A__22203.4378488146$1586994256$gmane$org@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAP+y1xAG3ayQNE3JqeF_YOT5FZ9pLiUAF5TmPVoOv+nPyjK30A__22203.4378488146$1586994256$gmane$org@mail.gmail.com>
User-Agent: NeoMutt/20180716

2020-04-16 01:42:29 +0200, Pier Paolo Grassi:
> Il giorno gio 16 apr 2020 alle ore 01:13 Mikael Magnusson <mikachu@gmail.com>
> ha scritto:
[...]
> > : ${(PA)varname::=$array}
> > (leave out the A for scalar assignment, and use AA for assoc arrays).
[...]
> Thanks! I was afraid I had to resort to eval.
[...]

What's wrong with "eval"? Note that many of those alternatives
to "eval" are just other evals in disguise or are as dangerous
(but giving the wrong impression that they're not).

: ${(PA)varname::=$array}

is a command injection vulnerability if the content of $varname
is not sanitized.


$ varname='x[$(uname>&2)]'
$ : ${(PA)varname::=$array}
Linux
zsh: bad math expression: empty string

So is:

eval $varname'=("$array[@]")'

but at least it's more obvious that it is.

In any case, I'd expect the contents of $varname to be known and
trusted in this case, while that of $array could be anything.

Note that that "$array[@]" (instead of $array) is needed to
preserve empty elements.

-- 
Stephane