Conversation

One interesting property of shell (bash, etc.) is that all heap objects are uniquely owned and never borrowed, so there's no GC necessary to achieve memory safety.

Replying to

Variable names are essentially addresses and namerefs are pretty much pointers: #!/bin/bash set -o nounset name=var declare -n p=$name declare -n q=$name p=1 echo $q p=2 echo $q unset p echo $q Attacker controlled nameref value can easily be an arbitrary (variable) read/write.

Replying to

and

Most people don't know about namerefs so they would use eval which is obviously a lot scarier. It hardly matters in a language where simply writing $var is arbitrary code execution running the variable as a command. Still, you CAN have references including dangling ones in Bash.

4:46 AM · Jul 31, 2021Twitter Web App