I'm doing the Shellshock lab, the tutorial gives an approach to pass a function to child process by environment variable:
$ foo='() { echo "hello"; }'
$ export foo
$ /bin/bash
$ foo
hello
However, when I tried this on my Ubuntu 20.04, foo was not converted to a function in the child process.
$ foo='() { echo "hello"; }'
$ export foo
$ /bin/bash
$ foo
Command 'foo' not found, did you mean: ...
Is there anything I missed, or this approach only works for certain versions of bash?
In Bash you define a shell function like so:
name () { ...; }
or like so:
function name { ...; }
and a multi-line one would look like this:
name ()
{
...
...
}
or like this:
function name
{
...
...
}
and is exported with -f like so:
export -f name
So, declare your function like this:
foo () { echo "hello"; }
and then export it like this:
export -f foo
Technical Notice
That said, what you describe resembles a historical vulnerability that used to exist in Bash (particularly in the "function export" feature/mechanism syntax and subsequent parsing) about a decade ago but has been fixed long ago too so not applicable in Bash anymore unless you somehow still have an non-patched/non-updated version of Bash all that time on your system.
Please see:
Since Bash 4.4, functions are now exported as BASH_FUNC_foo%% instead of just as foo. This isn't a valid shell variable name, so you can't set it directly within Bash, but you can with other commands such as env, e.g., with env BASH_FUNC_foo%%='() { echo "hello"; }' /bin/bash.
