7x31/shellcheck
1
0
Fork 0
mirror of https://github.com/koalaman/shellcheck.git synced 2025-10-03 19:29:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

Revert e073e65e5e29c08a1deb5219cd86411c57b7787b...701bc00f495afe654b72dfb9d4f9c7b1512fa2b6 on SC2156

wodry
2021-08-09 20:52:11 +02:00
parent 701bc00f49
commit c4f0f33e10
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
SC2156.md

@@ -9,14 +9,14 @@ find . -name '*.mp3' -exec sh -c 'i="{}"; sox "$i" "${i%.mp3}.wav"' \;
### Correct code: ### Correct code:
```sh ```sh
find . -name '*.mp3' -exec sh -c 'i="$1"; sox "$i" "${i%.mp3}.wav"' shell {} \; find . -name '*.mp3' -exec sh -c 'i="$1"; sox "$i" "${i%.mp3}.wav"' _ {} \;
``` ```
### Rationale: ### Rationale:
In the problematic example, the filename is passed by injecting it into a shell string. Any shell metacharacters in the filename will be interpreted as part of the script, and not as part of the filename. This can break the script and allow arbitrary code execution exploits. In the problematic example, the filename is passed by injecting it into a shell string. Any shell metacharacters in the filename will be interpreted as part of the script, and not as part of the filename. This can break the script and allow arbitrary code execution exploits.
In the correct example, the filename is passed as a parameter. It will be safely treated as literal text. Note that when using shell command with `-c`, the first parameter to the shell command (in the example "shell") becomes `$0` in the shell command's environment, where it is used e.g. in shell error messages (you can set it to an arbitrary value, but it makes sense to set it to the shell's name). You should not use the first parameter to the shell command as data processing parameter, because you could not access `$0` e.g. via `$*` in the shell command (because `$*` starts with `$1`), and as said, `$0` is used in the shell command's error messages, what would be confusing. In the correct example, the filename is passed as a parameter. It will be safely treated as literal text. The `_` is a dummy string that becomes `$0` in the script.
### Exceptions: ### Exceptions: