28 lines
947 B
Bash
28 lines
947 B
Bash
#!/usr/bin/env bash
|
|
# variables.c-style logic reproduced in shell for benchmark.
|
|
# Pre-patch parse_and_execute() of inherited environment-borne function definitions.
|
|
# Bash <= 4.3 imported environment variables whose values started with "() {"
|
|
# as function definitions, and then continued parsing/executing whatever came
|
|
# after the function body. Untrusted environment entered via CGI -> bash.
|
|
|
|
import_function_from_env() {
|
|
local name="$1"
|
|
local value="${!1}"
|
|
|
|
# Heuristic: if the value looks like a function definition, import it.
|
|
if [[ "${value}" == "() {"* ]]; then
|
|
# parse_and_execute() — evaluate the entire string as shell, including
|
|
# anything appearing AFTER the matching closing brace of the function body.
|
|
eval "function ${name} ${value}"
|
|
# ^^ trailing commands in $value run with the privileges of bash.
|
|
fi
|
|
}
|
|
|
|
main() {
|
|
for var in $(compgen -e); do
|
|
import_function_from_env "$var"
|
|
done
|
|
}
|
|
|
|
main "$@"
|