Is this Bash code vulnerable to code injection?

Question

I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka.

My question is if that eval would be vulnerable to code injection if the invoking program surrounds its input with doble quotes, like this:

silently "function" "command \"${@}\""

Having silently this code:

#! /bin/bash


mainFunction () {
    if [ "${function}" != "" ]; then
        function="${function}: "
    fi

    error=$(eval "${command}" 2>&1)

    if [ ${?} -ne 0 ]; then
        echo "${function}${error}" >&2
        exit "${exit}"
    fi
}


setArguments () {
    if [ "${1}" == "-try" ]; then
        function="${2}"
        command="${3}"
        exit="0"
    else
        function="${1}"
        command="${2}"
        exit="1"
    fi
}


setArguments "${@}"
mainFunction "${@}"

Answer 1

There are two quick observation:

• Using eval is very dangerous and your variable ${command} is not efficiently sanitized. (They could contain backticks, period, control chars, etc)

• Using bash for sensible operation is not recommended as they suffer from a lot of vulnerabilities. I recommend using poor shell (like dash), for critical scripts. (Or more evolved languages like Python or Perl).

• Sample of unexpected behaviour:

  /path/to/silently Blah "'echo `date`;return 1'"
  Blah: Wed Oct 16 08:26:16 CEST 2019
  

  Where command between backticks are executed, semicolons do command separation (as usual) and return 1 force mainFunction to consider the result as an error then print them.

  By using the code you've published @gitlab.com, result of this look like:

  /path/to/silently Blah "'echo `date`;return 1'"
  silently: surplus arguments on: Blah 'echo Thu Oct 17 13:54:36 CEST 2019;return 1'
  Note that command must be quoted
  

  date command is executed and result shown as error text.

  Then you could try:

  /path/to/silently Blah "'echo `cat /etc/passwd`;return 1'"
  

Using bash to do sensible operation is something possible, but do require strong experience. I personally recomand to not do that!

Answer 2

First of all, there is no reason to worry about code injection on a local shell script.

If you are running this remotely it could be an issue. I did some experimenting with the example below and didn't find any direct ways to inject any extra commands, except for the one word. Keep in mind, that you should also whitelist the allowed commands in a production environment.

Example: silently "command \"whoami\""

#! /bin/bash
command="${@}"
result=$(eval "${command}" 2>&1)
echo "${result}"