September 2014. Shellshock. For years Bash could receive a function through an environment variable, and the trouble was what it did next: it kept reading and ran any code tacked on behind the function. Since web servers routinely dump request headers into environment variables, an attacker could smuggle commands straight onto the machine, no login needed. The fix reads the function definition and stops dead at its closing brace. Build that.
Objective
Read a Bash-style function definition and copy only its body, dropping any code smuggled after the closing brace.
Steps
$ parse_func_def(out, "() { echo hi; }; rm -rf /")
[ echo hi; ]
$ parse_func_def(out, "config=1")
[config=1]
Expected files
Allowed functions
None. Write every helper yourself.
Loading solutions...