Inheriting IFS from environment

Inheriting IFS from environment

[Martijn Dekker]

Unlike bash, *ksh and zsh, dash allows inheriting IFS from the environment:

$ IFS=bla dash -c "x='hela hola'; echo \$x"
he  ho

This seems a bit dodgy from a security point of view. For instance, most
scripts don't bother to quote their variables in test commands such as [
$var -eq 0 ], making it possible to influence the program flow by
manipulating IFS from the outside.

- M.

Re: Inheriting IFS from environment

[Gioele Barabucci]

On 30/12/2015 18:06, Martijn Dekker wrote:
> Unlike bash, *ksh and zsh, dash allows inheriting IFS from the environment:
> 
> $ IFS=bla dash -c "x='hela hola'; echo \$x"
> he  ho
> 
> This seems a bit dodgy from a security point of view.

Hi,

The Debian BTS contains a similar report:
<https://bugs.debian.org/541642>. One suggestion from that thread:

> POSIX says (IEEE Std 1003.1, 2004 Edition; 2.5.3 Shell Variables):
>
>> Implementations may ignore the value of IFS in the environment at the
>> time the shell is invoked, treating IFS as if it were not set.

Regards,

--
Gioele Barabucci <gioele@svario.it>