From 2624fd2534d051281d273f597fc6f244cd83b0ec Mon Sep 17 00:00:00 2001 From: wileyhy <84648683+wileyhy@users.noreply.github.com> Date: Tue, 4 Jul 2023 16:02:49 -0700 Subject: [PATCH] Add an exception (prompt vars) and quote from the man pg --- SC2089.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/SC2089.md b/SC2089.md index 5edac7b..110900c 100644 --- a/SC2089.md +++ b/SC2089.md @@ -76,7 +76,14 @@ Then you can use `touch "'; rm -rf \$'\x2F'; '.txt"` (or someone can trick you ### Exceptions -Few and far between. +Few and far between, such as, prompt variables. This from `man bash` "PROMPTING": + +> After the string is decoded, it is expanded via parameter expansion, command +> substitution, arithmetic expansion, and quote removal, subject to the value of the promptvars shell +> option (see the description of the shopt command under SHELL BUILTIN COMMANDS below). This can have +> unwanted side effects if escaped portions of the string appear within command substitution or contain +> characters special to word expansion. +> ### Additional resources