Unquoted expression injection bash

user_7964318 0
Viewed 4968

I recently read that it is dangerous to use unquoted parameter in bash scripts. my question is:

Is it possible to bypass the condition in order to make it always true?

if test $TOTO -eq ${1} 2>/dev/null; then
    echo "Bypass"
else
    echo "No"
fi

Regards,

R

linux security bash
2 Answers

If you're asking whether you can choose a parameter $1 so that this condition is true for any integer value of $TOTO, then yes:

./yourscript "0 -o foo"

This makes any condition become

test 1234 -eq 0 -o foo

This is the equivalent of 1234 == 0 || "foo" in other languages, with one irrelevant comparison OR'd with the truth value of the string foo.

Since test considers all non-empty strings to be true, this expression is always true.

user_18996400

As @that other guy said, the "0 -o whatever" will bypass the check. The reason why it does is because of the -o option of the test binary:

EXPRESSION1 -o EXPRESSION2
              either EXPRESSION1 or EXPRESSION2 is true

So basically what the script will do is test if

$TOTO -eq 0 || "whatever"

Since non empty string are always True the overall check result will be True and here is the bypass :)

user_154142400
Related