What can you do with the
eval command? Why is it useful? Is it some kind of a built-in function in bash? There is no
man page for it..
What can you do with the
Its described in the "POSIX Programmer's Manual": http://www.unix.com/man-page/posix/1posix/eval/
It will take an argument and construct a command of it, which will be executed by the shell. This is the example of the manpage:
Usually it is used in combination with a Command Substitution. Without an explicit
Note the difference:
Last but not least,
In addition, the output if
The eval statement tells the shell to take eval’s arguments as command and run them through the command-line. It is useful in a situation like below:
In your script if you are defining a command into a variable and later on you want to use that command then you should use eval:
In shells, it's implemented as a shell builtin command.
It's very powerful because you can construct code dynamically and run it, something you can't do in compiled languages like C.
But it's also dangerous as it's important to sanitize the dynamic (externally provided) parts of what is passed to
For instance, above if
The evilness of
OK, it's dangerous, but at least we know it's dangerous.
A lot of other commands will evaluate shell code in its arguments if not sanitized, like (depending on the shell),
Examples (here using
What is eval?
eval is a shell command which is usually implemented as a builtin.
What does it do?
In simple terms: makes an input line to be parsed twice.
How does it do that?
The shell has a sequence of steps that it follows to "process" a line. You could look at this image and realize that eval is the only line that goes up, back to step 1, on the left. From the POSIX description:
At step 6 a built-in will be executed.
Effects of parsing twice.
And most important effect to understand. Is that one consequence of the first time a line is subject to the seven shell steps shown above, is quoting. Inside step 4 (expansions), there is also a sequence of steps to perform all expansions, the last of which is Quote Removal:
So, always, there is one level of quoting removed.
As consequence of that first effect, additional/different parts of the line become exposed to the shell parsing and all the other steps.
That allows to execute indirect expansions:
Because on the first loop, the first
It is then, on the second loop that the string
To "see" what eval will produce on the first loop (to be evaluated again), use echo. Or any command/script/program that clearly shows the arguments:
Replace eval by echo to "see" what is happening:
It is also possible to show all the "parts" of a line with:
Which, in this example, is only one echo and one variable, but remember it to help in evaluating more complex cases.
It must be said that: there is a mistake in the code above, can you see it?.
How? you may ask. Simple, let's change the variables (not the code):
See the missing spaces?
If that does not convince you, try this:
Missing quotes. To make it work correctly (add internal
About the manual:
No, there is not an independent man page for this.
The search for manual with
It is included inside
An easier way to get help is:
In bash, you could do
Why is eval called evil?
Because it is binding text to code dynamically.
In other words: it converts the list of its arguments (and/or expansions of such arguments) into an executed line. If for any reason, an argument has been set by an attacker, you will be executing attacker code.
Or even simpler, with eval you are telling whoever defined the value of one or several arguments:
Is that dangerous? Should be clear for everyone that it is.
The safety rule for eval should be:
Read more detail here.