Path: csiph.com!aioe.org!news.glorb.com!usenet.stanford.edu!not-for-mail
From: Stephane Chazelas <stephane.chazelas@gmail.com>
Newsgroups: gnu.bash.bug
Subject: Re: cannot declare local variables if they're readonly
Date: Thu, 23 Jul 2015 11:29:25 +0100
Lines: 47
Approved: bug-bash@gnu.org
Message-ID: <mailman.7297.1437656727.904.bug-bash@gnu.org>
References: <CAAZkfo+DWFdcabbcfq69EC-s3RvrxGRRfccLng_1sOjQQ9W1=Q@mail.gmail.com>
NNTP-Posting-Host: lists.gnu.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Trace: usenet.stanford.edu 1437656727 4310 208.118.235.17 (23 Jul 2015 13:05:27 GMT)
X-Complaints-To: action@cs.stanford.edu
To: bug-bash@gnu.org
Envelope-to: bug-bash@gnu.org
X-Injected-Via-Gmane: http://gmane.org/
X-Gmane-NNTP-Posting-Host: 90.200.231.204
Content-Disposition: inline
In-Reply-To: <CAAZkfo+DWFdcabbcfq69EC-s3RvrxGRRfccLng_1sOjQQ9W1=Q@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized.
X-Received-From: 80.91.229.3
X-Mailman-Approved-At: Thu, 23 Jul 2015 09:05:26 -0400
X-BeenThere: bug-bash@gnu.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Bug reports for the GNU Bourne Again SHell <bug-bash.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/bug-bash>, <mailto:bug-bash-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/bug-bash>
List-Post: <mailto:bug-bash@gnu.org>
List-Help: <mailto:bug-bash-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/bug-bash>, <mailto:bug-bash-request@gnu.org?subject=subscribe>
Xref: aioe.org gnu.bash.bug:11255

2015-07-23 01:12:01 +0200, isabella parakiss:
> From variables.c
> 
>                                        The test against old_var's context
>      level is to disallow local copies of readonly global variables (since I
>      believe that this could be a security hole).
> 
> Can you please explain how that can be a security hole?
> 
> 
> $ readonly wtf; fn () { local wtf; }; fn
> bash: local: wtf: readonly variable
> 
> You can't even be sure that you can set *local* variables in a function.
> This is a problem.
> 
> Most of the shells that support local variables (ksh93, mksh, zsh, dash...)
> allow this.  The only one I could find that doesn't is busybox.
[...]

I agree with you. That was discussed on another list a few
months ago. Unfortunately Chet seems to be of a different
opinion:

http://www.zsh.org/mla/workers/2015/msg00924.html

To be fair, you also need to consider cases like:

readonly c=299792458

light_year() {
  REPLY=$((c * 86400 * 365))
}

my_func() {
  local a=1 b=2 c=3
  light_year "$((a + b + c))"
}


What that means is that with this kind of dynamic scoping,
"readonly" is not very helpful. I don't remember ever using it.

-- 
Stephane