title: Is it possible to perform shell injection through a read and/or to break out of quotes?
body: <p>Consider this example of (attempted) shell injection:</p>
  
  <p>test1.sh:</p>
  
  <pre><code>#!/bin/sh
  read FOO
  echo ${FOO}
  </code></pre>
  
  <p>z.dat:</p>
  
  <pre><code>foo &amp;&amp; sleep 1 &amp;&amp; echo 'exploited'
  </code></pre>
  
  <p>Then run:</p>
  
  <pre><code>cat z.dat | ./test.sh 
  </code></pre>
  
  <p>On my machine (Ubuntu w/bash) the payload is always (correctly) treated as a single string and never executes the malicious sleep and echo commands.</p>
  
  <p>Question 1: Is it possible to modify z.dat so that test.sh is vulnerable to injection?  In particular are there specific shells that might be vulnerable?</p>
  
  <p>Question 2: If so, is changing the test script to quote the variable (shown below) an absolute defense?</p>
  
  <p>test2.sh:</p>
  
  <pre><code>#!/bin/sh
  read FOO
  echo "${FOO}"
  </code></pre>
  
  <p>Thanks!</p>