zsh-users
 help / color / mirror / code / Atom feed
From: Pier Paolo Grassi <pierpaolog@gmail.com>
To: Pier Paolo Grassi <pierpaolog@gmail.com>,
	Mikael Magnusson <mikachu@gmail.com>,
	 Zsh-Users List <zsh-users@zsh.org>
Subject: Re: indirect assignment to array
Date: Thu, 16 Apr 2020 18:37:47 +0200	[thread overview]
Message-ID: <CAP+y1xAjAub4cN_N1mgQUp-kZFpCRRRMzj3Ro6g68P9d1NQJTg@mail.gmail.com> (raw)
In-Reply-To: <20200416163022.vremvngrnnbxgdg6@chazelas.org>

[-- Attachment #1: Type: text/plain, Size: 1507 bytes --]

thanks Stephane, it is indeed a good habit to sanitize the varname
whichever method is utilized. From your explanation I admit the eval
solution would have been equally valid
regards

Pier Paolo Grassi
linkedin: https://www.linkedin.com/in/pier-paolo-grassi-19300217
founder: https://www.meetup.com/it-IT/Machine-Learning-TO


Il giorno gio 16 apr 2020 alle ore 18:30 Stephane Chazelas <
stephane@chazelas.org> ha scritto:

> 2020-04-16 01:42:29 +0200, Pier Paolo Grassi:
> > Il giorno gio 16 apr 2020 alle ore 01:13 Mikael Magnusson <
> mikachu@gmail.com>
> > ha scritto:
> [...]
> > > : ${(PA)varname::=$array}
> > > (leave out the A for scalar assignment, and use AA for assoc arrays).
> [...]
> > Thanks! I was afraid I had to resort to eval.
> [...]
>
> What's wrong with "eval"? Note that many of those alternatives
> to "eval" are just other evals in disguise or are as dangerous
> (but giving the wrong impression that they're not).
>
> : ${(PA)varname::=$array}
>
> is a command injection vulnerability if the content of $varname
> is not sanitized.
>
>
> $ varname='x[$(uname>&2)]'
> $ : ${(PA)varname::=$array}
> Linux
> zsh: bad math expression: empty string
>
> So is:
>
> eval $varname'=("$array[@]")'
>
> but at least it's more obvious that it is.
>
> In any case, I'd expect the contents of $varname to be known and
> trusted in this case, while that of $array could be anything.
>
> Note that that "$array[@]" (instead of $array) is needed to
> preserve empty elements.
>
> --
> Stephane
>

  reply	other threads:[~2020-04-16 16:39 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-15 23:01 Pier Paolo Grassi
2020-04-15 23:13 ` Mikael Magnusson
2020-04-15 23:42   ` Pier Paolo Grassi
2020-04-15 23:54     ` Bart Schaefer
2020-04-16  0:05       ` Pier Paolo Grassi
2020-04-16  0:12         ` Bart Schaefer
2020-04-16 16:02           ` Pier Paolo Grassi
2020-04-16 16:28   ` Sebastian Gniazdowski
2020-04-16 18:04     ` Pier Paolo Grassi
     [not found]     ` <CAP+y1xDa=fUvaP=gwbawRmcfwjq0ZH1KEnt=wTX4zOKaT4mzyQ__13411.9792653777$1587060411$gmane$org@mail.gmail.com>
2020-04-16 20:24       ` read -r and bad surprises (Was: indirect assignment to array) Stephane Chazelas
2020-04-16 21:06         ` Pier Paolo Grassi
     [not found]   ` <CAP+y1xAG3ayQNE3JqeF_YOT5FZ9pLiUAF5TmPVoOv+nPyjK30A__22203.4378488146$1586994256$gmane$org@mail.gmail.com>
2020-04-16 16:30     ` indirect assignment to array Stephane Chazelas
2020-04-16 16:37       ` Pier Paolo Grassi [this message]
2020-04-16 17:37         ` Bart Schaefer
2020-04-16 17:43           ` Pier Paolo Grassi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAP+y1xAjAub4cN_N1mgQUp-kZFpCRRRMzj3Ro6g68P9d1NQJTg@mail.gmail.com \
    --to=pierpaolog@gmail.com \
    --cc=mikachu@gmail.com \
    --cc=zsh-users@zsh.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.vuxu.org/mirror/zsh/

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).