4 ms·
Can someone explain why bash is evaluating and looking for function definitions in every environment variable? What would be broken if this entire "feature", wh
by ambrop7 12y ago
Can someone explain why bash is evaluating and looking for function definitions in every environment variable? What would be broken if this entire "feature", whatever it is, was completely disabled?
That's almost like a C compiler looking for C programs in string literals. It just doesn't make sense to me.
- asveikau 12y agoFrom reading one of the threads I think I get it. It allows you to "export" functions (export -f). I guess that's passed via the environment, so process start scans for them. The issue is that it was evaluating the whole variable to get them into your process. So if you have "garbage" at the end it's interpreted as the next command following the function definition.
- bodyfour 12y agoIt's so you can export a function into child shells: http://stackoverflow.com/questions/1885871/exporting-a-function-in-shell http://stackoverflow.com/questions/1885871/exporting-a-funct... Hardly worth the security cost in retrospect, but some bash scripts will surely break if it were just ripped out.
- RexRollman 12y agoSeems like something that should be turned off by default and enabled when desired/needed.
- acdha 12y agoI was thinking the same thing – if there ever was a case for a "bash --allow-terribly-insecure-features" flag this is it.
- justincormack 12y agoDon't use bash as a system or scripting shell then - thats exactly why dash, or the BSD shells exist. Exporting functions makes no real sense anyway, at least if you did it by hand it would be obvious how dangerous it is.