Timeline for Security implications of forgetting to quote a variable in bash/POSIX shells
Current License: CC BY-SA 4.0
24 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| yesterday | comment | added | BrianO | Further evidence, if any were needed, that bash is among the worst languages programmers have to suffer. An incredible amount of time wasted by devs on chin-scratching and hair-tearing, only to find, Yes, there's a workaround! but it's unintuitive, unmemorable, unreadable, and ugly. | |
| Feb 2, 2024 at 11:41 | comment | added | Martin Kealey |
The bitrate case has a relatively simple (and portable) solution: rather than bitrate='--bitrate 19200' then use unquoted $bitrate, you can write bitrate=19200 and then to use it, write ${bitrate:+ --bitrate "$bitrate" } (harmless extra spaces inserted for clarity)
|
|
| Aug 30, 2022 at 21:20 | comment | added | G-Man Says 'Reinstate Monica' |
(Cont’d) … (2) I never said «find "$criteria"»; I said «find $criteria» (without quotes) — and then I proceeded to present a better way, with quotes, using an array. … … … … … … … The whole point of my answer was to debunk common “reasons” (excuses) for not using quotes. If you didn’t grasp that point, I have to wonder what you did understand. … … … … … … … … P.S. Do you believe that “joint string” is a standard term? I’m not familiar with it.
|
|
| Aug 30, 2022 at 21:20 | comment | added | G-Man Says 'Reinstate Monica' | @TheMaster: It seems like you understand me perfectly and not at all, at the same time. And what do you mean by ‘‘if I am the only one who can control the script.’’? (1) Everybody knows that, if you let Boris Badenov edit your code, it’s not your code anymore. If you accept input from an untrustworthy user and use it directly in commands, it’s not your computer anymore. … (Cont’d) | |
| Aug 30, 2022 at 17:28 | comment | added | TheMaster |
criteria="-type f" This would only work if I am the only one who can control the script. What if I want to get the params from the user: echo "Any additional parameters for the command?"; read criteria. (Say user enters type -f) Now type -f is a joint string. If I quote in a command find "$criteria", it'll never work.
|
|
| Jul 8, 2022 at 3:09 | comment | added | G-Man Says 'Reinstate Monica' | Related: Transform an array into arguments of a command. | |
| Nov 17, 2021 at 3:28 | history | edited | G-Man Says 'Reinstate Monica' | CC BY-SA 4.0 |
Extended the warning; restored formatting to what it was five years ago.
|
| Mar 7, 2020 at 16:57 | history | edited | G-Man Says 'Reinstate Monica' | CC BY-SA 4.0 |
Added a warning against an obvious misinterpretation.
|
| Jun 9, 2019 at 17:37 | comment | added | G-Man Says 'Reinstate Monica' | See Understanding IFS, What is the 'IFS'?, Understanding the default value of IFS, Setting IFS for a single statement and Split string using IFS. Also related: Why does my shell script choke on whitespace or other special characters? (And did you read all the answers to this question?) | |
| Jun 9, 2019 at 16:26 | comment | added | Freedo | What is IFS? I see a lot of talk about it, but nobody says what it is. without context is hard to someone that doesn't know what it is to understand | |
| Jun 8, 2019 at 17:38 | comment | added | G-Man Says 'Reinstate Monica' |
You seem not to be understanding what I’m saying. Yes, of course your bitrate variable contains a, e, b, i, 2 and 3 — I listed all the characters that are in your variable. The issue is whether the IFS variable contains them. Please read all the answers to the question.
|
|
| Jun 8, 2019 at 9:57 | comment | added | Freedo |
Well my variable has both a,e,b,i 2 and 3 characters and still works fine with ${bitrate:+$bitrate}
|
|
| Jun 7, 2019 at 19:15 | comment | added | G-Man Says 'Reinstate Monica' |
(Cont’d) … Your suggestion (using ${variable:+$variable} with no ") will fail if IFS contains -, 0, 2, 3, a, b, e, i, r or t.
|
|
| Jun 7, 2019 at 19:15 | comment | added | G-Man Says 'Reinstate Monica' |
@Freedo: I find your comment unclear. I’m especially unclear what you want to know that I haven’t already said. See the second “But what if” heading — “But what if I have a variable that I want/need to be split into words?” That’s your situation, and you should be following the advice there. But if you can’t (e.g., because you’re using a shell other than bash, ksh, zsh or yash, and you’re using $@ for something else), or you simply refuse to use an array for other reasons, I refer you to “As discussed in the other answer”. … (Cont’d)
|
|
| Jun 7, 2019 at 7:14 | comment | added | Freedo |
In bash, bitrate="--bitrate 320" works with ${bitrate:+$bitrate}, and bitrate=--bitrate 128 won't work ${bitrate:+"$bitrate"} because it breaks the command. Is is safe to use ${variable:+$variable} with no "?
|
|
| Apr 3, 2018 at 20:41 | history | edited | G-Man Says 'Reinstate Monica' | CC BY-SA 3.0 |
Trivial formatting change.
|
| Feb 8, 2018 at 16:38 | comment | added | Stéphane Chazelas |
Note that in csh, you'd rather use $var:q than "$var" as the latter doesn't work for variables that contain newline characters (or if you want to quote the elements of the array individually, rather than join them with spaces into a single argument).
|
|
| Jun 20, 2017 at 1:28 | history | edited | G-Man Says 'Reinstate Monica' | CC BY-SA 3.0 |
added 89 characters in body
|
| Jun 20, 2017 at 0:52 | history | edited | G-Man Says 'Reinstate Monica' | CC BY-SA 3.0 |
Added some more explanations and references; fixed typo.
|
| May 8, 2017 at 5:39 | history | edited | G-Man Says 'Reinstate Monica' | CC BY-SA 3.0 |
Added a tricky case where a filename needs to be quoted.
|
| Apr 13, 2017 at 12:36 | history | edited | CommunityBot |
replaced http://unix.stackexchange.com/ with https://unix.stackexchange.com/
|
|
| Jul 28, 2016 at 13:08 | history | edited | Stéphane Chazelas | CC BY-SA 3.0 |
arrays were introduced to the Bourne world by ksh, not bash.
|
| Jul 6, 2016 at 15:36 | history | edited | G-Man Says 'Reinstate Monica' | CC BY-SA 3.0 |
Added comment to clarify `+=`.
|
| May 30, 2016 at 0:48 | history | answered | G-Man Says 'Reinstate Monica' | CC BY-SA 3.0 |