3 ms·

Its used by bash itself for communicating with subprocesses. Input you type at the terminal is not the same as an environment variable; hackers set environment

• vidarh 12y ago
  There are many other ways Bash could do that, though, which would make it much harder for further exploits. Such as opening a pipe and writing them to the sub-process that way so it goes "out of band" from the regular environment variables. Or if it has to be in environment variables: Accept a special argument in the argument list that is a key it uses to sign the variables. It does not need to remain secret - just make sure that just inheriting environment variables with potential attempted exploits is insufficient for anything to get executed. And/or change the way these definitions are handled - I get that it's tantalizingly simple to just pass this through their usual parser since then you get the function definition parsing for free, but at the very least this parsing of the environment variables shouldn't go through a code path that even potentially executes anything.
  • masklinn 12y ago
    > There are many other ways Bash could do that, though KSH and ZSH will load functions from files they find via $FPATH.