mjhjmtu

I encountered a strange bug today, when running a script in a directory containing a directory with parentheses in it, such as a().

Minimal working example

I managed to reduce the bug to the following minimal working example:

Create an empty directory in /tmp and cd into it:

mkdir /tmp/foo
cd /tmp/foo

Create a script named foo.sh in it containing:

foo() 
 somevar=1;
 case somevar in
 aha) echo "something" ;;
 *) echo "other" ;;
 esac;
;

Run the following command:

eval $(/bin/cat foo.sh)

There should not be any error.

Create a file with parentheses:

touch "a()"

Run the command again:

eval $(/bin/cat foo.sh)

I now get the error:

bash: syntax error near unexpected token `(' 

Why does bash even care about what files are in the directory? Why do parentheses cause an error?

System information:

$ bash --version
GNU bash, version 4.4.19(1)-release (x86_64-pc-linux-gnu)
Copyright © 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 18.04.1 LTS
Release: 18.04
Codename: bionic

More detailed background and original error:

My problem came from using a script sourcing /usr/share/modules/init/bash from the environment-modules package, as summarized here:

$ dpkg -l environment-modules 
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-=============================================================-===================================-===================================-================================================================================================================================
ii environment-modules 4.1.1-1 amd64 Modular system for handling environment variables
$ source /usr/share/modules/init/bash
$ touch "a()"
$ source /usr/share/modules/init/bash
bash: eval: line 43: syntax error near unexpected token `('
bash: eval: line 43: ` a() _mlshdbg='' ;;'

This is neither strange nor a bug in bash (it does seem to be a bug in /usr/share/modules/init/bash though). You are using an unquoted command substitution together with eval. The string that is the result of the command substitution will, since it is unquoted, undergo word splitting and filename expansion (globbing). The *) in the code matches the filename a(), so it is replace by this filename in the filename expansion stage.

Running your example under set -x highlights this:

$ eval $(cat foo.sh)
++ cat foo.sh
+ eval 'foo()' '' 'somevar=1;' case somevar in 'aha)' echo '"something"' ';;' 'a()' echo '"other"' ';;' 'esac;' ';'
bash: syntax error near unexpected token `('

The same thing in the yash shell:

$ eval $(cat foo.sh)
+ cat foo.sh
+ eval 'foo()' '' 'somevar=1;' case somevar in 'aha)' echo '"something"' ';;' 'a()' echo '"other"' ';;' 'esac;' ';'
eval:1: syntax error: `)' is missing
eval:1: syntax error: `esac' is missing
eval:1: syntax error: `}' is missing

And with ksh93:

$ eval $(cat foo.sh)
+ cat foo.sh
+ eval 'foo()' '' somevar='1;' case somevar in 'aha)' echo '"something"' ';;' 'a()' echo '"other"' ';;' 'esac;' ';'
ksh93: eval: syntax error: `(' unexpected

And dash:

$ eval $(cat foo.sh)
+ cat foo.sh
+ eval foo() somevar=1; case somevar in aha) echo "something" ;; a() echo "other" ;; esac; ;
dash: 1: eval: Syntax error: "(" unexpected (expecting ")")

Only the zsh would handle this as it does not perform the globbing:

$ eval $(cat foo.sh)
+zsh:2> cat foo.sh
+zsh:2> eval 'foo()' '' 'somevar=1;' case somevar in 'aha)' echo '"something"' ';;' '*)' echo '"other"' ';;' 'esac;' ';'

The correct way to handle this would be to source the foo.sh script:

. ./foo.sh

There is really no reason to use eval "$(cat foo.sh)" as far as I can see.

This is also a code injection vulnerability:

$ touch '*) echo "hello" ;; *)'
$ eval $(cat foo.sh)
$ declare -f foo
foo ()

 somevar=1;
 case somevar in
 aha)
 echo "something"
 ;;
 *)
 echo "hello"
 ;;
 *)
 echo "other"
 ;;
 esac

Another way of breaking this command easily without creating a specially named file, is to set the IFS variable to a set of characters other than the default:

$ IFS='; '
+ IFS='; '
$ eval $(cat foo.sh)
++ cat foo.sh
+ eval 'foo()' '
' somevar=1 '
' case somevar 'in
' 'aha)' echo '"something"' '' '
' '*)' echo '"other"' '' '
' esac '
' ''
bash: syntax error near unexpected token `somevar=1'

This breaks it because of the word-splitting step rather than the file globbing step in the evaluation of the arguments to eval. With IFS='; ', each of those characters would be used to split the text in foo.sh up into words (and those characters would then be removed from the string).

Not even zsh would be immune to this:

$ IFS='; '
+zsh:2> IFS='; '
$ eval $(cat foo.sh)
+zsh:3> cat foo.sh
+zsh:3> eval 'foo()' $'n' 'somevar=1' $'n' case somevar $'inn' 'aha)' echo '"something"' '' $'n' '*)' echo '"other"' '' $'n' esac $'n' '' ''
zsh: parse error near `)'

Related:

• Security implications of forgetting to quote a variable in bash/POSIX shells


• When is double-quoting necessary?


• Why does my shell script choke on whitespace or other special characters?