github/shellcheck
1
0
Fork 0
mirror of https://github.com/koalaman/shellcheck.git synced 2025-03-12 12:35:25 -07:00
Code Issues Packages Projects Releases Wiki Activity

Remove confusing "_" dummy parameter

wodry 2021-08-09 04:58:59 +02:00
parent 2660d91200
commit a4566ad83c
1 changed files with 2 additions and 2 deletions

4
SC2156.md

@ -9,14 +9,14 @@ find . -name '*.mp3' -exec sh -c 'i="{}"; sox "$i" "${i%.mp3}.wav"' \;
### Correct code:
```sh
find . -name '*.mp3' -exec sh -c 'i="$1"; sox "$i" "${i%.mp3}.wav"' _ {} \;
find . -name '*.mp3' -exec sh -c 'i="$0"; sox "$i" "${i%.mp3}.wav"' {} \;
```
### Rationale:
In the problematic example, the filename is passed by injecting it into a shell string. Any shell metacharacters in the filename will be interpreted as part of the script, and not as part of the filename. This can break the script and allow arbitrary code execution exploits.
In the correct example, the filename is passed as a parameter. It will be safely treated as literal text. The `_` is a dummy string that becomes `$0` in the script.
In the correct example, the filename is passed as a parameter. It will be safely treated as literal text. Note that when using shell command with `-c`, the first parameter to the shell command becomes `$0`.
### Exceptions: