[Bug 278361] adduser after password confirmation shows [: -a: unexpected operator

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=278361

            Bug ID: 278361
           Summary: adduser after password confirmation shows [: -a:
                    unexpected operator
           Product: Base System
           Version: 14.0-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: correabuscar+freebsdboogs@gmail.com

/usr/sbin/adduser is affected by this issue that happens in /bin/sh and in
/usr/local/bin/bash and in /bin/[

https://lists.gnu.org/archive/html/bug-bash/2024-04/msg00088.html

ie. there's code in adduser that does this:
[ -z ">" -a -z ">" ] ...
which errors like:
[: -a: unexpected operator

so if I want to set the password to ">" for example, I get to see that error,
but still works as expected in the end.

Any code anywhere that uses bash or sh or /bin/[ , that starts with:
[ -z "$something" -a ...

where -z can be -n
and -a can be -o
and ... can be anything valid after
and [ is sh or bash internal, or /bin/[

will eval as false  if $something evals to one character and is one of the two
angle brackets ie. ">" or "<" (without the double quotes)


The issue doesn't happen on Gentoo's /usr/bin/[ which is from
sys-apps/coreutils-9.5::gentoo package.


Something like:
[ -z ">>" -a -z "" ]
won't error, because it's more than one character (">>") and doesn't trigger
the issue.

In bash it looks like:
[ -z ">" -a -z "abc" ] || echo hi
-bash: [: syntax error: `-z' unexpected
hi

-- 
You are receiving this mail because:
You are the assignee for the bug.