yossarian (1.3.6.1.4.1.55738)TIL: Some surprising code execution sources in bash
https://yossarian.net/til/post/some-surprising-code-execution-sources-in-bash
Kees Cook (old account)@yossarian The use of '[[' is the problem. That's an evaluating comparison and is as dangerous as 'eval' (as shown). All scripts should be using just the single '['. Using '[[' is for compatibility with ancient shells.
Vegard@kees @yossarian Do we need to do something about this?
$ git grep '\[\[.*\]\]' origin/master -- ':*.sh' | wc --lines
1065
edit: there is some amount of false positives from sed regexes embedded in shell scripts. but also enough real cases
NEPŘÁTELSKÉ EMOCE 🇺🇦🇨🇿@vegard @kees @yossarian more like git grep '\[' ...
at least for me the `oh bummer' part was the observation that [ also behaves this way, because in bash it's a builtin. perhaps that can actually be considered a bug?