zsh-workers 43616, typeset doesn't report tied parameters

zsh-workers 43616, typeset doesn't report tied parameters

[TS]

Hello Stephane,
Hello folks,


regarding patch 43616 i would like to ask the following.
cites from patch:

1)
+When an existing scalar is tied to a new array, the value of the scalar
+is preserved but no attribute other than export will be preserved.

2)
+ More generally, the readonly attribute should not be relied on as a security
+ mechanism.

3)
+ Special variables that have been made readonly retain their value
+and readonly attribute when made local.


IMHO 1+2 are inconsistent with 3.
What 1 means is, if a readonly scalar is tied to an array. the content of the
scalar is changeable through the array interface.
At least in 5.6.2 that works that way, so this is not new.

Not sure if that is the best way to handle that situation.
In other shells AFAIK a readonly is unchangeable.

IMHO when a readonly is tied, the newly tied var (either scalar or array what
ever comes last) should take over the content AND the readonly flag in one go.
OR a readonly should not be tieable at all.

Leaving it the way as currently is inconsistent IMHO.


kind regards,

     Thilo

Re: zsh-workers 43616, typeset doesn't report tied parameters

[Stephane Chazelas]

2018-10-09 00:54:16 +0200, TS:
[...]
> IMHO when a readonly is tied, the newly tied var (either scalar or array what
> ever comes last) should take over the content AND the readonly flag in one go.
> OR a readonly should not be tieable at all.
[...]

I kind of agree. On the other hand, attributes are not mirrored
between pairs of tied parameters  (anyway, most attributes only
apply to scalars and not arrays).

One could imagine someone wanting to make only the array or only
the scalar readonly to force modification using the other one.

readonly is kind of a programming aid (reminder that the
parameter  should be constant). Tied parameters are really
designed for the LD_LIBRARY_PATH, INFOPATH... They are
different concepts that would generally not be used together I
would say.

One can always make both INFOPATH and infopath readonly if they
don't want it to be modified.

-- 
Stephane

Re: zsh-workers 43616, typeset doesn't report tied parameters

[TS]

Stephane Chazelas schrieb/wrote:
> 2018-10-09 00:54:16 +0200, TS:
> [...]
>> IMHO when a readonly is tied, the newly tied var (either scalar or array what
>> ever comes last) should take over the content AND the readonly flag in one go.
>> OR a readonly should not be tieable at all.
> [...]


> readonly is kind of a programming aid (reminder that the
> parameter  should be constant). Tied parameters are really
> designed for the LD_LIBRARY_PATH, INFOPATH... They are
> different concepts that would generally not be used together I
> would say.

apart from malicious code writers.

e.g.:
% prv() { print -l "${(t)${(P)1}} ${1}=${(P)1}" ; }
% IMPORTANTVAR=foo
% prv IMPORTANTVAR
scalar IMPORTANTVAR=foo
% readonly IMPORTANTVAR
% prv IMPORTANTVAR
scalar-readonly IMPORTANTVAR=foo
% IMPORTANTVAR=buuz
zsh: read-only variable: IMPORTANTVAR
% prv IMPORTANTVAR
scalar-readonly IMPORTANTVAR=foo
% typeset -T IMPORTANTVAR importantvar
zsh: read-only variable: IMPORTANTVAR
% prv IMPORTANTVAR
scalar-readonly-tag_local IMPORTANTVAR=foo
% prv importantvar
array-tag_local importantvar=foo
% importantvar=(buuz)
% prv IMPORTANTVAR
scalar-readonly-tag_local IMPORTANTVAR=buuz

basically currently the readonly flag is bypasable this way for every var
and therefore mood. Somehow i can't believe this is by design, instead of an
overlook.



Mit freundlichen Grüßen

    Thilo Six

Re: zsh-workers 43616, typeset doesn't report tied parameters

[Stephane Chazelas]

2018-10-09 10:00:14 +0200, TS:
[...]
> % prv() { print -l "${(t)${(P)1}} ${1}=${(P)1}" ; }
> % IMPORTANTVAR=foo
> % prv IMPORTANTVAR
> scalar IMPORTANTVAR=foo
> % readonly IMPORTANTVAR
[...]
> % importantvar=(buuz)
> % prv IMPORTANTVAR
> scalar-readonly-tag_local IMPORTANTVAR=buuz
> 
> basically currently the readonly flag is bypasable this way for every var
> and therefore mood. Somehow i can't believe this is by design, instead of an
> overlook.
[...]

But no need for that to change the value of a readonly variable.
readonly is not a security feature (except maybe for specials,
but even then that's pointless unless you use the restricted
mode (and even then, I'd argue the shell is not the right place
to restrict the user, it's better to use OS containing
features)).

$ readonly VAR=foo
$ typeset +r VAR
$ VAR=bar
$ echo $VAR
bar

-- 
Stephane

Re: zsh-workers 43616, typeset doesn't report tied parameters

[TS]

Hello Stephane,

Stephane Chazelas schrieb/wrote:

-- <snip> --

> $ readonly VAR=foo
> $ typeset +r VAR
> $ VAR=bar
> $ echo $VAR
> bar
> 

Thanks for that hint. I was going claim that this is not documented
but actually i must have overlooked the word spezial in the manual now several
times:

Note that if name is a special parameter, the  readonly  attribute  can  be
turned on, but cannot then be turned off.

hmm

Can we have a additional sentence there along the lines of:

Note that in zsh (unlike other shells) it is possible to turn off readonly, when
the parameter is not spezial.

? please.

Thanks Stephane!


kind regards,

     Thilo