a4e2d2c4c7
The original code used eval to read an array variable with a dynamic name:
eval "var_value=\"\${${var_name}[@]}\"" # sorry
eval works, but it executes arbitrary code — if $var_name were ever a
crafted string, it could inject commands.
bash 4.3+ nameref (local -n) creates an alias to the variable named in
$var_name without executing any code:
local -n _ct_arr_ref="${var_name}"
var_value="${_ct_arr_ref[*]}"
unset -n _ct_arr_ref
unset -n removes only the alias (not the referenced array), preventing
"already a nameref" warnings on subsequent loop iterations.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| functions | ||
| tools | ||
| library-functions.sh | ||
| single.sh | ||