Can I do this without eval? (zsh)


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Can I do this without eval? (zsh)
# 1  
Old 01-24-2017
Can I do this without eval? (zsh)

I have in one shell variable, op, a string which represents a "test operator" in a [[ ... ]] construct, for instance -d or -n or -s, an in another shell variable, arg, some arbitrary string. What I want to achieve, is basically this:

Code:
#This is INCORRECT code. I just want to get you the idea, what I'm looking for.
if  [[ ! $op $arg ]]
then
   do_something
fi

Of course, this does not work, because the operator - being a syntax construct - can not be substituted.

The closest solution I found is this:

Code:
if eval "[[ ! $op '$arg' ]]"
then
   do_something
fi

I'm not happy with this for two reasons:

1. It breaks if $arg contains sequences of backslashes or single quotes
2. While I have good control of what is stored into $op, I don't have so good control of what is stored on $arg, so it is a security hole.

I could scan arg before and reject it completely, if arg gontains either backslash or single quote - I reckon that any exploit of the security hole would require either this or the other -, but I wonder whether there is a simpler way to code this.

A proposed solution can be zsh-specific, but should be upward compatible from zsh 5.0. Any ideas?
# 2  
Old 01-24-2017
So this takes a single $op, such as "-z", and a single $arg, which is supposed to be a literal value? Feed them into the test external to test them outside the shell:

Code:
if test "$op" "$arg"
then
...
fi

test won't support the full extended zsh syntax, just the basic bourne. It won't evaluate any shell code or variables whatsoever and will never make your program quit from syntax error. If someone tries inserting multiple things into $op to be tricky, it just won't work.
These 2 Users Gave Thanks to Corona688 For This Post:
# 3  
Old 01-24-2017
Quote:
Originally Posted by Corona688
So this takes a single $op, such as "-z", and a single $arg, which is supposed to be a literal value? Feed them into the test external to test them outside the shell:

Code:
if test "$op" "$arg"
then
...
fi

test won't support the full extended zsh syntax, just the basic bourne. It won't evaluate any shell code or variables whatsoever and will never make your program quit from syntax error. If someone tries inserting multiple things into $op to be tricky, it just won't work.
op is safe, because I run into this code only if op matches the glob pattern -[a-zA-Z].

I like your idea, because of its simplicity. Its main drawback is that, at least according to my manpage of test, it does not work with the -N file test operator (true if file exists and its access time is not newer than its modification time), so I have to think about how important this is for me. It also doen't work with -o, which is not really a problem though, because this is not a file test.

Currently, I'm guarding the argument with

Code:
if [[ "${arg//['\\]/}" == $arg ]]
then
  # we are safe here
else 
  # danger!
fi

which also has the nasty side effect, that the quoting upsets the syntax highlighter of my text editor (IntelliJ IDEA) in the same way as it upsets syntax highlighting in this forum....
# 4  
Old 01-24-2017
Quote:
Originally Posted by rovf
I like your idea, because of its simplicity. Its main drawback is that, at least according to my manpage of test, it does not work with the -N file test operator (true if file exists and its access time is not newer than its modification time)
I just tried that out of curiosity and now realize I was slightly wrong.

In most shells, test is a builtin which supports all operators the shell does.

Code:
$ test -N /etc/passwd
$ echo $?
0
$ whereis test
test: /usr/bin/test /usr/share/man/man1/test.1.bz2 /usr/share/man/man1p/test.1p.bz2
$ /usr/bin/test -N /etc/passwd
/usr/bin/test: extra argument '-N'
$

...so if your shell has it as a builtin you are set.

I definitely reccommend against injection rejection which leaves you wide open to things you don't know about and can react badly to valid things you still didn't expect. (What if a filename contains a literal backtick?) Better to not leave the door open in the first place and use something which doesn't allow for shell interpretation.

Last edited by Corona688; 01-24-2017 at 01:19 PM..
# 5  
Old 01-24-2017
Please test with type
Code:
type test
test is a shell builtin
type "["
[ is a shell builtin

if  [ ! "$op" "$arg" ]
then
    do_something
fi

Compare this with
Code:
type "[["


Last edited by MadeInGermany; 01-24-2017 at 01:26 PM..
# 6  
Old 01-24-2017
Quote:
Originally Posted by MadeInGermany
Please test with type
Code:
if  [ ! $op $arg ]
then
    do_something
fi

This makes it possible for the user to force the shell to quit with a syntax error. That's something test won't do.
# 7  
Old 01-24-2017
What do you mean? [ ] and test are functionally identical.
In my code example I have added quotes around the variables, for increased robustness.
Login or Register to Ask a Question

Previous Thread | Next Thread

8 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Zsh array -a vs. -A question

Inside a zsh function, I create a local array with local -a arrayname and a local associative array with local -A arrayname. I also can create an array using set, like this: set -A arrayname value1 value2 value3In this form, I can not explicitly declare that an array is associative or... (2 Replies)
Discussion started by: rovf
2 Replies

2. Shell Programming and Scripting

Error in eval eval command to print html tags

anyone has any info on why this is complaining??? vivek@vivek-c5e55ef2e ~/TAC $ zoneCounter=1 vivek@vivek-c5e55ef2e ~/TAC $ optUsage1=23% vivek@vivek-c5e55ef2e ~/TAC $ eval eval echo "<th>Zone $zoneCounter </th><th align=\"left\"> \$optUsage$zoneCounter </th>" -bash: syntax error... (13 Replies)
Discussion started by: vivek d r
13 Replies

3. Shell Programming and Scripting

Error in eval eval command to print html tags

anyone has any info on why this is complaining??? vivek@vivek-c5e55ef2e ~/TAC $ zoneCounter=1 vivek@vivek-c5e55ef2e ~/TAC $ optUsage1=23% vivek@vivek-c5e55ef2e ~/TAC $ eval eval echo "<th>Zone $zoneCounter </th><th align=\"left\"> \$optUsage$zoneCounter </th>" -bash: syntax error... (1 Reply)
Discussion started by: vivek d r
1 Replies

4. Shell Programming and Scripting

Strange result of eval, how does eval really work with ssh?

Hi all, some small script with eval turned me to crazy. my OS is linux Linux s10-1310 2.6.16.53-0.8.PTF.434477.3.TDC.0-smp #1 SMP Fri Aug 31 06:07:27 PDT 2007 x86_64 x86_64 x86_64 GNU/Linux below script works well #!/bin/bash eval ssh remotehost date eval ssh remotehost ls below... (1 Reply)
Discussion started by: summer_cherry
1 Replies

5. Shell Programming and Scripting

Using zsh

Hi all i am forced to use tcsh at work but i want to use zsh, so i have added this to my .cshrc if (! $?STARTTCSH) then if ("$tty" != "" && -x /bin/zsh) exec /bin/zsh exit endif but this now stopped me going back to tcsh if i need to, is there a way to do this, i would... (7 Replies)
Discussion started by: ab52
7 Replies

6. UNIX for Dummies Questions & Answers

question about zsh

hi, In bash, $ bind -P | grep yank-last yank-last-arg can be found on "\M-.", "\M-_". this allows me to press ALT key and the period (.) to yank the last argument of the previous command line into the current command line. How can I get the same behavior in zsh ? Thanks ... (0 Replies)
Discussion started by: Andrewkl
0 Replies

7. UNIX for Dummies Questions & Answers

Z-shell (zsh)

Z-shell (zsh) anyone use it and how do ya like it? (1 Reply)
Discussion started by: Bodhi
1 Replies

8. Shell Programming and Scripting

tutorials about zsh

hi there I'm looking for tutorials about zsh (beginners to experts) can you give me addresses please? thx a lot (3 Replies)
Discussion started by: SpY974
3 Replies
Login or Register to Ask a Question

Featured Tech Videos