#!/usr/bin/env bash
# variables.c-style logic reproduced in shell for benchmark.
# Pre-patch parse_and_execute() of inherited environment-borne function definitions.
# Bash <= 4.3 imported environment variables whose values started with "() {"
# as function definitions, and then continued parsing/executing whatever came
# after the function body. Untrusted environment entered via CGI -> bash.

import_function_from_env() {
  local name="$1"
  local value="${!1}"

  # Heuristic: if the value looks like a function definition, import it.
  if [[ "${value}" == "() {"* ]]; then
    # parse_and_execute() — evaluate the entire string as shell, including
    # anything appearing AFTER the matching closing brace of the function body.
    eval "function ${name} ${value}"
    # ^^ trailing commands in $value run with the privileges of bash.
  fi
}

main() {
  for var in $(compgen -e); do
    import_function_from_env "$var"
  done
}

main "$@"