Inheriting IFS from environment
Unlike bash, *ksh and zsh, dash allows inheriting IFS from the environment:
$ IFS=bla dash -c "x='hela hola'; echo \$x" he ho
This seems a bit dodgy from a security point of view. For instance, most scripts don't bother to quote their variables in test commands such as [ $var -eq 0 ], making it possible to influence the program flow by manipulating IFS from the outside.
- M.
Quoted 6 lines · Martijn Dekker
Unlike bash, *ksh and zsh, dash allows inheriting IFS from the environment:
$ IFS=bla dash -c "x='hela hola'; echo \$x" he hoThis seems a bit dodgy from a security point of view.
Hi,
The Debian BTS contains a similar report:
<https://bugs.debian.org/541642>. One suggestion from that thread:
Quoted 4 lines
POSIX says (IEEE Std 1003.1, 2004 Edition; 2.5.3 Shell Variables):
Quoted 2 lines
Implementations may ignore the value of IFS in the environment at the time the shell is invoked, treating IFS as if it were not set.
Regards,
--
Gioele Barabucci <[email protected]>