Skip to content

A Shift Outside a (( Line Still Strips the Commands After It #2062

Open

Description

@ptr727

Problem

_heredoc_openers in gh-write-guard.py tells an arithmetic shift from a heredoc only by a (( token on the same line. A shift in any other arithmetic context has no such token, so its << is read as a heredoc opener and every line after it is stripped as body. A wait loop on those lines is then never judged.

Reproduce (constructed)

Each of these is allowed on develop, and each loops under timeout 3 bash until the timeout kills it:

x=$((
1 << n ))
while [ ! -f /nonexistent ]; do sleep 1; done
x=$[ 1 << n ]
while [ ! -f /nonexistent ]; do sleep 1; done

${a[ i << n ]} tokenizes the same way, to a bare << followed by n.

Done looks like

The commands above are denied, and a self-test row pins each. One route is to give such a line the same two readings a (( line now gets, keyed on the $[ or ${ token or on an arithmetic context left open by an earlier line.

Found by the local strict review of the #2059 fix (handoff #2061), which keys only on ((. It is older than that fix.

Activity

  1. added
    bugSomething isn't working
    agentsAgents instructions
    pre-existingReview finding classed pre-existing per local-strict-review Disposing of Findings
    on Sep 29, 2026
  2. ptr727 commented on Sep 30, 2026

    @ptr727
    OwnerAuthor

    One more shape, found by the local strict review of the #2059 fix and reproduced on develop at 4c9087d: an assignment's subscript, which bash reads as one unit, so its << opens no heredoc. Allowed, although bash runs the loop:

    a[ 1 << EOF ]=1
    while [ ! -f /nonexistent ]; do sleep 1; done
    EOF
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agentsAgents instructionsbugSomething isn't workingpre-existingReview finding classed pre-existing per local-strict-review Disposing of Findings

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions