Is stdin the script, or is it data?
The guard denied every pipe into bash. But a shell executes
stdin as a script only when it has nothing else to run. Type a command, or
pick one.
before
after this PR
The one signal that separates them
| shape | what bash runs | stdin is |
|---|---|---|
curl … | bash | stdin | the script |
… | bash -s | stdin | the script |
… | bash -c "cmd" | the -c string | data |
… | bash ./known.sh | the file | data |
The old check basenamed the interpreter word and stopped. The file operand
was sitting in the same string, never inspected. -s is the case
a naive "is there a trailing word" test gets wrong: bash -s -- arg
has trailing words and still executes stdin.
A network source still denies even with a file operand: fetching bytes to
feed a local script is worth a stop on its own. Issue #3559.