Re: [BUG] Unicode variables can be exported and are exported metafied

[Павлов Николай Александрович <kp-pav@xxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On December 19, 2014 9:17:37 PM EAT, "Christoph (Stucki) von Stuckrad" <stucki@xxxxxxxxxxxxxxx> wrote:
>On Thu, 18 Dec 2014, Bart Schaefer wrote:
>
>> Are we sure it's even "legal" to export Unicode variable names?
>Internally
>> we can kinda ignore POSIX as we choose, but the environment crosses
>those
>> boundaries.
>
>Independend of being 'legal' to me it seems dangerous!
>
>Comparing the 'working as written' example:
>
>~$ M='surprise; : ' MÄRCHEN=story sh -c 'echo $MÄRCHEN'
>story
>
>to running it with all the other shells I keep around
>(bash, dash, ash, sash - untested ksh and csh)
>you always get:
>
>..................................vvvv
>~$ M='surprise; : ' MÄRCHEN=story bash -c 'echo $MÄRCHEN'
>surprise; : ÄRCHEN
>
>Which gives interesting new ways to introduce security-sensitive
>changes into environments by letting a Program check the
>UTF8-named-Variable for its contents, but really inserting data
>by the broken-part-name, which might be passed unchecked!
>
>So PLEASE DO NOT EXPORT these !
>
>Stucki

I really do not see any problems here. If one has "surprise" in $M in an environment he runs typed scripts in then he already has much bigger problems.
-----BEGIN PGP SIGNATURE-----
Version: APG v1.1.1

iQJNBAEBCgA3BQJUlIbVMBwfMDI7PjIgHTg6PjswOSAQOzU6QTA9NEA+MjhHIDxr
cC1wYXZAeWFuZGV4LnJ1PgAKCRBu+P2/AXZZIuF9D/4oc9QkX4ziGW34IpiFzPmA
P4w5ZmbGFq8yV8IhYLX+SDukWSKP5j7K7CZgc6UU9Xftpr7RFbSXuRqyjTCWhzRM
mt6od3PeOI6+nEF+hizz+3WwqiHmrB/pagP7qed3gjX6t6y9qV7g+QCXdL7EPOQ/
uUKDoAjF0LPOc0JUtKXVJNZzE6YsCmVL/hwdeGG7pNQ7tOUeKEeS02XwNphAdUw4
5tuwE/UBRxtcPyCE3pVsV9vXa+1cyREuyY50uH/lMRGR8FuyjNmPslvRfDmzWkxw
x5OgxiyukBdxY4YLjiXuVLAVh/JqVmnZvMy2o6uqxESmv3tX8yOIjelFbwo6hZhz
L7RAdsXdw23OFBqxTrHxnSbImQuCn2yS2CrmQmBe3adilj84XIpqlpQCKy/LdXm7
LQyCGrI8gUwKLmpeqvaHrp3SbFfUZIbtMOaccQwPGBfH67JA0CUr+HZv3fJ/Iijm
F0LSsJTiQIgfeXXwk0nxHXUj/0yr5MEJUnVwFNY7C/tgOKRpDpwA5u2jgAvcYpUn
YHJddwyHryeghp2JpiECprUEd1nGRj4ijbGb4uolbs7CxVpR6z+IadEzsSg5bd2y
r499ADpGsuXM0U09unQUTMqsCaxW9y7VOeTqORSv/1jOG7O8vZIRIgLuyi+JYXsU
vMCYECRmzPKvIdYOsbQ7Gg==
=d7xB
-----END PGP SIGNATURE-----