"there's a hidden eval every time you use shell arithmetic." -- http://www.oilshell.org/blog/2019/06/17.html#toc_6
```
% x=(PATH=2)
% echo $((x+1))
3
% echo $PATH
2
```
Wow.
@akkartik It is a very explicit eval via a subshell. There should be no surprise here other than users can't recognize subshells :)
@gcb Sorry, something ate all-important quotes the first time around. Here's a correction:
```
% x='(PATH=2)'
% echo $((x+1))
3
% echo $PATH
2
```
(The original `x=(PATH=2)` without quotes doesn't actually perform any eval.)
Does it make sense now? This is indeed quite subtle.
"..things that can be parsed as variable names are treated as variable names in arithmetic contexts. ..bash does this *recursively* until it gets to an integer, or to something that can't be parsed as either an integer or a variable name."
https://lists.gnu.org/archive/html/help-bash/2018-10/msg00008.html
OMG. This is _not_ documented.
shit like this is why I made s lol. https://github.com/rain-1/s
@rain @kingcons @akkartik If a webapp is building a string to send to any shell, even this S shell, it is already susceptible to shellshock-like attacks since it is by definition building a string that will be evaluated. The only protection against this is if the language the webapp is using has proper shell string building library that handles escaping properly, like most have to SQL et al.
@rain @alcinnz @gcb @kingcons @akkartik So the original method uses escaped plaintext queries. But at some point someone figured out that they could parse a symbolic version of a query, save that parsed version, and then provide non-escaped arguments to that pre-parsed query, which is both faster (for complex queries) and much safer. I have no idea what the protocol looks like for this but I assume it has explicit string lengths or null terminators or something, instead of quoting.
@someonetellmetosleep @alcinnz @gcb @kingcons @akkartik
super interesting stuff! thanks for sharing. I'll see if i can find out what it look like on-the-wire
@someonetellmetosleep @alcinnz @gcb @kingcons @akkartik
yes it seems to be quite nice and simple the way it works and basically parameters are sent as something similar to netstrings.
https://dev.mysql.com/doc/internals/en/prepared-statements.html
https://dev.mysql.com/doc/internals/en/binary-protocol-value.html
Server run by the main developers of the project 
It is not focused on any particular niche interest - everyone is welcome as long as you follow our code of conduct!
I hope all the shell scripts in the world are sanitizing their inputs.
@gcb @rain @kingcons