mjhjmtu

I was trying to write a simple function that checks if a config file is "sanitized" and safe for sourcing or not. I seemingly got it to work in bash, and in ksh (Version ABIJM 93v- 2014-06-25) in the first invocation of the function only. This is the watered-down version of the function that still reproduces this bug for me:

function sanitized_source
 
 typeset source_filename=$1
 (
 #shopt -s extdebug # Need this if using bash
 trap 'if [[ $? != 0 ]]; then return 66; fi' DEBUG
 PATH=.
 set -re
 . "$source_filename"
 )

and the config file:

cd /root || echo 'what?'
echo 'why is this executed?'

How I run it and what I see:

% . ./dotfile
% sanitized_source test.conf
ksh: sanitized_source[79]: sanitized_source[1]: cd: restricted
% sanitized_source test.conf
ksh: sanitized_source[79]: .[1]: cd: restricted
what?
why is this executed?

The intent of the trap is to cover cases where set -e won't exit the shell even if a command failed. From man bash:

[set] -e

[...]
The shell does not exit if the command that fails is [...] part of any command executed in a && or || list except the command following the final && or || [...]

extdebug

[...]
2. If the command run by the DEBUG trap returns a non-zero value, the next command is skipped and not executed.

I noticed the parameters .sh.command and .sh.subshell got changed between the first and second invocations:

% sanitized_source test.conf
ksh: sanitized_source[9]: sanitized_source[1]: cd: restricted
% echo "$.sh.command"
echo 'what?'
% echo "$.sh.subshell"
0
% sanitized_source test.conf
ksh: sanitized_source[9]: .[1]: cd: restricted
what?
why is this executed?
% echo "$.sh.command" 
`���2
% echo "$.sh.subshell" 

%

Also, if I replace the return or exit statement in trap with echo, for example, I can see that the trap statement is then executed every time.

So why is this behavior only observed in ksh and not bash? What is the root cause and how do I fix it?