This is completely safe: [ "${payload}" -eq 42 ]
This can evaluate arbitrary code: [[ "${payload}" -eq 42 ]]
Here is one example of a malicious payload:
payload='a[$(touch /tmp/pwned)]'This can evaluate arbitrary code: [[ "${payload}" -eq 42 ]]
Here is one example of a malicious payload:
payload='a[$(touch /tmp/pwned)]'Now I need to figure out whether (( payload == 42 )) is safe.