Problem
The #2112 fix (handoff #2123) reads a line holding (( or $[ as opening nothing, plus each << alone and each together with every later one whose body closes. Where the arithmetic shift's own operand matches a later line, as Z in $((1 << Z)), no reading matches bash's, which skips the shift and reads the two real heredocs in order. Develop allows the command below too, so this is a gap the fix left rather than a regression.
Reproduce (constructed)
cat <<A; echo $((1 << Z)); cat <<B
B
A
cat <<X
B
while [ ! -f /x ]; do sleep 1; done
X
Z
Bash reads A's body as B and B's body as cat <<X, then runs the loop. The guard allows the command on the branch and on develop, since every reading it builds hides the loop.
Done looks like
The command above is denied, and a self-test row pins it.
Found by the local strict review of the #2112 fix, and filed as a follow-up under decision #2126.
Problem
The #2112 fix (handoff #2123) reads a line holding
((or$[as opening nothing, plus each<<alone and each together with every later one whose body closes. Where the arithmetic shift's own operand matches a later line, asZin$((1 << Z)), no reading matches bash's, which skips the shift and reads the two real heredocs in order. Develop allows the command below too, so this is a gap the fix left rather than a regression.Reproduce (constructed)
Bash reads A's body as
Band B's body ascat <<X, then runs the loop. The guard allows the command on the branch and on develop, since every reading it builds hides the loop.Done looks like
The command above is denied, and a self-test row pins it.
Found by the local strict review of the #2112 fix, and filed as a follow-up under decision #2126.