3 ms·

Thanks. I'm still confused though: 1: Why does Bash "interpret" the environment variables' values? What is the expected result of setting a function definition

Thanks. I'm still confused though: 1: Why does Bash "interpret" the environment variables' values? What is the expected result of setting a function definition as the value of an environment variable? In my worldview (which is clearly wrong) there is no reason for Bash to look at environment variables' values until they're evaluated. 2: This is probably besides the point: but since when is the empty string a valid function name? I can't get Bash to accept "() { :; }" (as opposed to "f() { :; }" as valid bash. Edit: see my self-reply for answers.

deleted 12y ago
[deleted]
bjackman 12y ago
Aha, I found answers here: http://seclists.org/oss-sec/2014/q3/650 http://seclists.org/oss-sec/2014/q3/650 Basically, Bash interprets environment variables at start up as a means for you to pass functions into subshells. Whenever an environment variable's value starts with "() {", it is interpreted as a function, which is named according to the environment variable's name. I guess even without the bug under discussion this feature is a theoretical security flaw. If you set your user agent to "() { ping your.domain.com}", a function named HTTP_USER_AGENT, which pinged your.domain.com would exist in any shellThe name of the function is passed as the Apache spawned. It's not hard to imagine a buggy script accidentally executing it.