Conversation

Notices

1. Embed this notice
   yossarian (1.3.6.1.4.1.55738) (yossarian@infosec.exchange)'s status on Thursday, 21-Nov-2024 22:27:17 JST yossarian (1.3.6.1.4.1.55738)

   TIL: Some surprising code execution sources in bash

   https://yossarian.net/til/post/some-surprising-code-execution-sources-in-bash

   #til #shell #security

   • Embed this notice
     Kees Cook :tux: (kees@fosstodon.org)'s status on Thursday, 21-Nov-2024 22:27:17 JST Kees Cook :tux:

     in reply to

     @yossarian The use of '[[' is the problem. That's an evaluating comparison and is as dangerous as 'eval' (as shown). All scripts should be using just the single '['. Using '[[' is for compatibility with ancient shells.

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     hanno (hanno@mastodon.social)'s status on Thursday, 21-Nov-2024 23:06:21 JST hanno

     in reply to

     • Kees Cook :tux:

     @kees @yossarian uh, good to know. I'm pretty sure at some point I've been told (maybe by some linting tool?) that [[ is preferrable to [.

   • Embed this notice
     Kees Cook :tux: (kees@fosstodon.org)'s status on Thursday, 21-Nov-2024 23:06:21 JST Kees Cook :tux:

     in reply to

     • hanno

     @hanno @yossarian Yeah this was a common recommendation long ago to "avoid bash-isms" for compatibility. Since then busybox and dash (the common non-bash "/bin/sh" instances) grew '[' support either internally or via /usr/bin/[

   • Embed this notice
     hanno (hanno@mastodon.social)'s status on Thursday, 21-Nov-2024 23:06:21 JST hanno

     in reply to

     • Kees Cook :tux:

     @kees @yossarian I'm confused, this tells me [[ is the bash'ism, and [ the posix thing: https://mywiki.wooledge.org/BashFAQ/031

   • Embed this notice
     Kees Cook :tux: (kees@fosstodon.org)'s status on Thursday, 21-Nov-2024 23:06:21 JST Kees Cook :tux:

     in reply to

     • hanno

     @hanno @yossarian Ah, I may have it backwards then, but '[' remains the safe one. 😅

     Haelwenn /элвэн/ :triskell: likes this.