diff --git a/SC2089.md b/SC2089.md index 5edac7b..110900c 100644 --- a/SC2089.md +++ b/SC2089.md @@ -76,7 +76,14 @@ Then you can use `touch "'; rm -rf \$'\x2F'; '.txt"` (or someone can trick you ### Exceptions -Few and far between. +Few and far between, such as, prompt variables. This from `man bash` "PROMPTING": + +> After the string is decoded, it is expanded via parameter expansion, command +> substitution, arithmetic expansion, and quote removal, subject to the value of the promptvars shell +> option (see the description of the shopt command under SHELL BUILTIN COMMANDS below). This can have +> unwanted side effects if escaped portions of the string appear within command substitution or contain +> characters special to word expansion. +> ### Additional resources