#778956 dash: doesn't sanitize local variables

Package:
dash
Source:
dash
Description:
POSIX-compliant shell
Submitter:
Michael Gilbert
Date:
2015-11-20 18:33:07 UTC
Severity:
important
Tags:
#778956#5
Date:
2015-02-22 05:10:16 UTC
From:
To:
package: src:dash
severity: important
tags: security

Dash currently does not sanitize local variables, which differs from
the behavior in bash.

This can lead to issues when developers don't consider the difference
in behavior between dash and bash.  For example, this led to a
security issue in xdg-utils:
http://bugs.debian.org/777722

It would be preferable to match bash's behavior, but that probably
should a change pushed upstream.

Best wishes,
Mike
#778956#10
Date:
2015-11-18 23:11:37 UTC
From:
To:
Hi,

to make future triaging easier I am copying here the testcase described
in the original bug, slightly modified.

     $ cat testme.sh
     testme() {
        x=oldvalue
        local x
        echo "<$x>"
     }
     testme

     $ bash testme.sh
     <>
     $ dash testme.sh
     <oldvalue>

Cheers,