The fundamental problem is this:
In starting, bash treats ANY environment variable whose value
starts with "() {" (i.e. open paren, close paren, space, open
curly) as a function to be parsed and imported. For example:
$ export ls='() { echo bwahahaha ; }'
$ bash������ ������ # any invocation of bash, including from system(),
or as /bin/sh
$ ls
bwahahaha
This is the mechanism by which bash's "export -f" (export
function) works. (By default, functions are not exported to the
environment, which is why you never noticed this before.)
Basically, that functionality has a ridiculous number of potential
gotchas, even if the parsing is properly fixed. The unpatched code
just blithely throws the string at the command interpreter, and
the patches are just band-aids on top of that.
-- don
On 25/09/14 14:14, Nicholas Lee wrote:
Fix may not be complete either:
_______________________________________________
NZNOG mailing list
NZNOG@list.waikato.ac.nz
http://list.waikato.ac.nz/mailman/listinfo/nznog