Cookie Consent by Free Privacy Policy Generator 📌 HPR3713: Bash snippet - short-circuit evaluation in Bash Boolean expressions

🏠 Team IT Security News

TSecurity.de ist eine Online-Plattform, die sich auf die Bereitstellung von Informationen,alle 15 Minuten neuste Nachrichten, Bildungsressourcen und Dienstleistungen rund um das Thema IT-Sicherheit spezialisiert hat.
Ob es sich um aktuelle Nachrichten, Fachartikel, Blogbeiträge, Webinare, Tutorials, oder Tipps & Tricks handelt, TSecurity.de bietet seinen Nutzern einen umfassenden Überblick über die wichtigsten Aspekte der IT-Sicherheit in einer sich ständig verändernden digitalen Welt.

16.12.2023 - TIP: Wer den Cookie Consent Banner akzeptiert, kann z.B. von Englisch nach Deutsch übersetzen, erst Englisch auswählen dann wieder Deutsch!

Google Android Playstore Download Button für Team IT Security



📚 HPR3713: Bash snippet - short-circuit evaluation in Bash Boolean expressions


💡 Newskategorie: Podcasts
🔗 Quelle: hackerpublicradio.org

Preamble

This is a case where I came upon a thing in Bash I had never considered before and was pleased and surprised that there was a way of doing what I wanted to do! If this is completely obvious to you, apologies, but it wasn’t to me!

Overview

Many programming languages have the concept of short-circuit evaluation in Boolean expressions. What this means is that in an expression such as:

A AND B

if A is false then the whole expression must be false, and B doesn’t have to be evaluated. That is because both arguments to AND have to be true for the overall result to be true.

If A is true on the other hand, then B has to be evaluated to determine if the overall result is true.

Similarly with:

A OR B

if A is true then the whole expression must be true and B can be skipped without evaluation. This is because only one argument to OR needs to be true to return a true result.

If A is false on the other hand, then B has to be evaluated to determine if the overall result is false.

Both of these expressions are evaluated from left to right. This is not a given in all languages. Some use special operators such as 'and_then' and 'or_else' which explicitly perform short-circuiting and left-to-right evaluation.

Definition

In simple terms, short-circuiting is where the evaluation of an expression is stopped as soon as its outcome is determined.

The Wikipedia article Short-circuit evaluation defines it as:

Short-circuit evaluation, minimal evaluation, or McCarthy evaluation (after John McCarthy) is the semantics of some Boolean operators in some programming languages in which the second argument is executed or evaluated only if the first argument does not suffice to determine the value of the expression: when the first argument of the AND function evaluates to false, the overall value must be false; and when the first argument of the OR function evaluates to true, the overall value must be true.

This article contains a table entitled Boolean operators in various languages which shows details of how various programming and scripting languages cater for this feature.

Use case

I was writing a Bash script in which I wanted to ask questions about various steps - should they be done or not? Alternatively, I wanted to be able to set an option to run without interaction and assume the answer is 'yes' to all questions.

I’d encountered short-circuit evaluation before in Pascal and Perl so I wondered if I could use it in Bash.

The expression I was trying to write was:

if [[ $YES -eq 1 ]] || yes_no 'Create directory? %s ' 'N'; then
    # Create directory
fi

The requirement was that if YES was set to 1 I didn’t want the function to be called at all.

I was a little surprised, and very happy, to find that this is what happens.

Here is the full example from the script that started me thinking about this issue - and therefore caused me to make this show:

#
# We need a show directory. If it doesn't exist then we'll create it because
# other scripts will use it.
#
if [[ ! -d $SHOWDIR ]]; then
    echo "${red}There is no directory for show $show${reset}"

    #
    # If the -Y option was not chosen ask with 'yes_no'. It -Y was chosen
    # we're to go ahead regardless. This relies on the fact that Bash
    # "short-circuits" logical expressions like this.
    #
    if [[ $YES -eq 1 ]] || yes_no 'Create directory? %s ' 'N'; then
        mkdir "$SHOWDIR"
        _silent "${green}Directory created for show $show${reset}"
    else
        _silent "${yellow}Not changed${reset}"
    fi
fi

Notes:

  • I have a Bash function that defines colours which is included into this script. That’s why you see 'echo "${red}...${reset}"' in the above. I also have a function to turn off colour by setting the relevant variables to empty strings.
  • The 'yes_no' function takes a prompt string with an (optional) '%s' placeholder for the expected inputs and default. This is followed by the default: 'N'.
  • The function '_silent' writes the message given as its argument, depending on the setting of a 'SILENT' variable set earlier.

Should it be used?

Case 1

Bash uses short-circuiting in other contexts. This was discussed in the Bash Tips series, episode 10 with the example:

[ -e /some/file ] || exit 1

Here the test is performed using '-e' to determine if '/some/file' exists. The result is either true or false. If the test returns true then the overall result of the or is true and the evaluation is short-circuited so that the 'exit 1' is not invoked. If the test is false then the second expression has to be evaluated to determine the overall result, so the 'exit 1' is invoked and the script exits.

Incidentally, the '[ -e file ]' construct is actually an instance of the test command so could be written:

test -e /some/file || exit 1

You might be familiar with command pipelines which use this technique, such as:

sudo apt update && sudo apt upgrade

If the 'apt update' is successful the 'apt upgrade' is run. If it fails then the second command is not run.

Case 2

We have seen the example that prompted me to make this show:

if [[ $YES -eq 1 ]] || yes_no 'Create directory? %s ' 'N'; then
    # Create directory
fi

This could have been written as:

if [[ $YES -eq 1 ]]; then
    # Create directory
elif yes_no 'Create directory? %s ' 'N'; then
    # Create directory
fi

I prefer the first way, but it could be argued in a development environment that co-workers might find it confusing.

Conclusion

So, my conclusion is that short-circuiting is a desirable feature that I will continue to use.

Links

...



📌 JavaScript String to Boolean – How to Parse a Boolean in JS


📈 43.12 Punkte

📌 Boolean Strings in Go (String to Boolean)


📈 43.12 Punkte

📌 Frog CMS 0.9.5 Edit Snippet admin/ snippet[name] cross site scripting


📈 40.88 Punkte

📌 Wolf CMS 0.8.3.1 Add SNippet /?/admin/snippet/add cross site scripting


📈 40.88 Punkte

📌 CVE-2023-23277 | Snippet-box 1.0.0 Form Field Snippet code cross site scripting (Issue 57)


📈 40.88 Punkte

📌 msynth: Code deobfuscation framework to simplify Mixed Boolean-Arithmetic (MBA) expressions


📈 40.19 Punkte

📌 Efficient Deobfuscation of Linear Mixed Boolean-Arithmetic Expressions


📈 40.19 Punkte

📌 DenuvoSoftwareSolutions/SiMBA: Efficient Deobfuscation of Linear Mixed Boolean-Arithmetic Expressions


📈 40.19 Punkte

📌 angular-expressions up to 1.1.1 expressions.compile injection


📈 37.25 Punkte

📌 How to declare Boolean variables in bash and use them in a shell script


📈 30.47 Punkte

📌 Medium CVE-2018-18758: Open faculty evaluation system project Open faculty evaluation system


📈 30.22 Punkte

📌 Medium CVE-2018-18757: Open faculty evaluation system project Open faculty evaluation system


📈 30.22 Punkte

📌 HPR3985: Bash snippet - be careful when feeding data to loops


📈 29.35 Punkte

📌 HPR3071: Bash snippet - quotes inside quoted strings


📈 29.35 Punkte

📌 HPR3722: Bash snippet - plurals in messages


📈 29.35 Punkte

📌 niieani/bash-oo-framework: Bash Infinity is a modern boilerplate / framework / standard library for bash


📈 26.73 Punkte

📌 Bash Scripting - BASH Scripts For Heavy Commandline Users [Bash Snippets]


📈 26.73 Punkte

📌 Bash Scripting - BASH Scripts For Heavy Commandline Users [Bash Snippets]


📈 26.73 Punkte

📌 Back to bash: Inception, running bash inside bash


📈 26.73 Punkte

📌 OWASP Multidae Tutorials - SQLMAP Techniques Union, Boolean, & Time-Based


📈 21.56 Punkte

📌 OWASP Multidae Tutorials - SQLMAP Techniques Boolean, & Time-Based


📈 21.56 Punkte

📌 OWASP Multidae Tutorials - SQLMAP Techniques Union, Boolean, & Time-Based


📈 21.56 Punkte

📌 #0daytoday #CBAS-Web 19.0.0 - (id) Boolean-based Blind SQL Injection Vulnerability [#0day #Exploit]


📈 21.56 Punkte

📌 Mail.ru: Boolean-based SQL Injection on relap.io


📈 21.56 Punkte

📌 Xamarin.Forms 101: Controls for boolean, numeric, and date and time input


📈 21.56 Punkte

📌 Boolean logic with if statements [25 of 51] | Beginner's Series to JavaScript


📈 21.56 Punkte

📌 Demo: Boolean logic with switch and other syntax [28 of 51] | Beginner's Series to JavaScript


📈 21.56 Punkte

📌 Making Mass Effect not require administrator rights, or maybe how not to write a boolean check


📈 21.56 Punkte

📌 Lesson 169: ARM-64 Course (Part 12 - Boolean Primitive Datatype)


📈 21.56 Punkte

📌 [webapps] IPeakCMS 3.5 - Boolean-based blind SQLi


📈 21.56 Punkte

📌 OWASP Multidae Tutorials - SQLMAP Techniques Boolean, & Time-Based


📈 21.56 Punkte

📌 [webapps] - dotCMS 3.6.1 - Blind Boolean SQL Injection


📈 21.56 Punkte











matomo