Docker

Docker

Made by DeepSource

eval used with special characters DOK-SC1098

Bug risk
Major

Shells differ widely in how they handle unescaped parentheses in eval expressions.

eval foo=bar is allowed by dash, bash and ksh. eval foo=(bar) is allowed by bash and ksh, but not dash. eval $var=(bar) is allowed by ksh, but not bash or dash. eval foo() ( echo bar; ) is not allowed by any shell.

Since the expression is evaluated as shell script code anyway, it should be passed in as a literal string without relying on special case parsing rules in the target shell. It is recommended to quote/escape the characters accordingly.

Bad Practice

eval $var=(a b)

Recommended

eval "$var=(a b)"