I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka.
My question is if that eval would be vulnerable to code injection if the invoking program surrounds its input with doble quotes, like this:
silently "function" "command \"${@}\""
Having silently this code:
#! /bin/bash
mainFunction () {
if [ "${function}" != "" ]; then
function="${function}: "
fi
error=$(eval "${command}" 2>&1)
if [ ${?} -ne 0 ]; then
echo "${function}${error}" >&2
exit "${exit}"
fi
}
setArguments () {
if [ "${1}" == "-try" ]; then
function="${2}"
command="${3}"
exit="0"
else
function="${1}"
command="${2}"
exit="1"
fi
}
setArguments "${@}"
mainFunction "${@}"
${@}
.${@}
could containecho `cat /etc/paswd`;return -1
, for sample!cat /etc/paswd
;return -1" cat: /etc/paswd: No such file or directory /usr/bin/silently: line 9: echo ;return -1: command not found