Arbitrary code when using eq and when using test in if statements

[nitrocode]

Ref https://yossarian.net/til/post/some-surprising-code-execution-sources-in-bash/#fnref-source

Is there a way for shellcheck to catch these weaknesses and offer better alternatives?

[wileyhy]

Thx for positng

…

On Sun, Jan 26, 2025 at 11:06 PM RB ***@***.***> wrote: Ref https://yossarian.net/til/post/some-surprising-code-execution-sources-in-bash/#fnref-source Is there a way for shellcheck to catch these weaknesses and offer better alternatives? — Reply to this email directly, view it on GitHub <#3131>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AUF2F25NZSPDR3AFA4OYVCL2MXLFZAVCNFSM6AAAAABV5L6TBOVHI2DSMVQWIX3LMV43ASLTON2WKOZSHAYTEMRTGYZDIMY> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[sideeffect42]

One possible fix is to write POSIX shell scripts. Good old POSIX test does not support array and thus also doesn't resolve indexes :-)