Comment by benmmurphy

i'm not sure if there was an original pattern where the env var was in double quotes.

https://github.com/snowflakedb/snowflake-connector-net/pull/...

but if you have:

X=$(echo "$BLAH")

then in bash I believe this is safe, because bash will just substitute this as putting the BLAH variable as the first argument to echo without doing any further parsing. without the double quotes can be safe as well but more risky.

X=$(echo $BLAH)

and the only difference is bash will split the arguments. so if you have BLAH="x y" then bash will pass two arguments to echo. though, this can be dangerous if the command you are invoking has dangerous command line options.

however, they had something similar to:

TITLE=$(echo '${{ github.event.issue.title }}')

and this ${{ }} is some kind of template substitution that is happening before the command is sent to bash. so if the variable `github.event.issue.title` was `foo bar` then bash sees something like:

TITLE=$(echo 'foo bar')

and then you start to have problems because `'` can be put into the title to escape.

the bash variable substitution will protect you in a lot of cases from command line injection but if you pass user input directly into command evaluation without using variables then bash can't protect you.