Bug 1012015 - Bash performs brace expansion on commands with double-quoted strings within a double-quoted command-substitution
Bash performs brace expansion on commands with double-quoted strings within a...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: bash (Show other bugs)
6.3
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Ondrej Oprala
Martin Frodl
:
Depends On:
Blocks: 1070830 1116301 1116350
  Show dependency treegraph
 
Reported: 2013-09-25 10:44 EDT by Miciah Dashiel Butler Masters
Modified: 2016-01-31 21:09 EST (History)
3 users (show)

See Also:
Fixed In Version: bash-4.1.2-18.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1116301 1116350 (view as bug list)
Environment:
Last Closed: 2014-10-14 03:10:01 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Nested Dquote brace-expansions patch (734 bytes, text/plain)
2014-05-26 11:31 EDT, Ondrej Oprala
no flags Details

  None (edit)
Description Miciah Dashiel Butler Masters 2013-09-25 10:44:33 EDT
Description of problem:
If I enclose a command substitution within double-quotes, and the command includes a double-quoted string, Bash performs brace expansion on the command before performing command substitution.


Version-Release number of selected component (if applicable):
bash-4.1.2-15.el6_4.x86_64

I also ran through the Steps to Reproduce on Fedora 19 with bash-4.2.45-1.fc19.x86_64 and got the same results.


How reproducible:
Completely.


Steps to Reproduce:
1. printf '1=%s 2=%s\n' "$(echo {a,b})"
2. printf '1=%s 2=%s\n' "$(echo '{a,b}')"
3. printf '1=%s 2=%s\n' "$(echo "{a,b}")"


Actual results:

Step 1 prints "1=a b 2=" as expected.
Step 2 prints "1=a b 2=" as expected.
Step 3 prints "1=a b 2=" because {a,b} is expanded before the echo command is run.


Expected results:

Step 3 should print the same output as Step 1 and Step 2.


Additional info:

$ printf '1=%s 2=%s\n' "$(echo {a,b})"
1=a b 2=
$ printf '1=%s 2=%s\n' "$(echo '{a,b}')"
1={a,b} 2=
$ printf '1=%s 2=%s\n' "$(echo "{a,b}")"
1=a 2=b
$ printf '1=%s 2=%s\n' "`echo {a,b}`"
1=a b 2=
$ printf '1=%s 2=%s\n' "`echo '{a,b}'`"
1={a,b} 2=
$ printf '1=%s 2=%s\n' "`echo "{a,b}"`"
1=a 2=b
$ set -x
$ printf '1=%s 2=%s\n' "$(echo {a,b})"
++ echo a b
+ printf '1=%s 2=%s\n' 'a b'
1=a b 2=
$ printf '1=%s 2=%s\n' "$(echo '{a,b}')"
++ echo '{a,b}'
+ printf '1=%s 2=%s\n' '{a,b}'
1={a,b} 2=
$ printf '1=%s 2=%s\n' "$(echo "{a,b}")"
++ echo a
++ echo b
+ printf '1=%s 2=%s\n' a b
1=a 2=b
$ printf '1=%s 2=%s\n' "`echo {a,b}`"
++ echo a b
+ printf '1=%s 2=%s\n' 'a b'
1=a b 2=
$ printf '1=%s 2=%s\n' "`echo '{a,b}'`"
++ echo '{a,b}'
+ printf '1=%s 2=%s\n' '{a,b}'
1={a,b} 2=
$ printf '1=%s 2=%s\n' "`echo "{a,b}"`"
++ echo a
++ echo b
+ printf '1=%s 2=%s\n' a b
1=a 2=b
$

From the above, we can see that brace expansion is indeed happening before the command substitution is performed, with the result that the command echo "{a,b}" is expanded into two commands: echo a and echo b.  Further, the problem is present with backtick syntax as well as $() syntax, but only with nested double-quote marks.
Comment 1 Roman Rakus 2013-09-26 06:00:03 EDT
Thanks for the report.

It is fixed in bash-4.3-beta (first fix in alpha).

So far bash-4.3 is not released and beta is not part of Fedora. I'm not sure how difficult it will be to back port this fix.
Comment 3 Ondrej Oprala 2014-05-26 11:31:11 EDT
Created attachment 899325 [details]
Nested Dquote brace-expansions patch

I've backported the relevant code from bash-4.3-alpha. More info: http://lists.gnu.org/archive/html/bug-bash/2013-01/msg00094.html
Comment 4 Branislav Náter 2014-05-30 05:05:30 EDT
Reproducer available, qa_ack+ for rhel-6.6
Comment 6 Martin Frodl 2014-06-03 12:20:04 EDT
(In reply to Miciah Dashiel Butler Masters from comment #0)

I am a bit confused by this, so let us make things absolutely clear:

> Steps to Reproduce:
> 2. printf '1=%s 2=%s\n' "$(echo '{a,b}')"

> Actual results:
> Step 2 prints "1=a b 2=" as expected.

> Additional info:
> $ printf '1=%s 2=%s\n' "$(echo '{a,b}')"
> 1={a,b} 2=

If I understand correctly, the actual (and also expected) result of Step 2 is the one with {a,b} (see Additional info) rather than the one provided in Actual results. As a consequence, the expected result is not Step 3 producing the same output as both Step 1 and 2 (since these are different from one another), but rather Step 3 should print the same message as Step 1.

Am I right?
Comment 7 Miciah Dashiel Butler Masters 2014-06-03 12:24:08 EDT
I believe you are right.  I must have made an error in my initial report.  Sorry!
Comment 9 errata-xmlrpc 2014-10-14 03:10:01 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1503.html

Note You need to log in before you can comment on or make changes to this bug.