Subject: dash: doesn't sanitize local variables

From: Michael Gilbert <[email-masked]>
Date: Sun, 22 Feb 2015 00:10:16 -0500

package: src:dash
severity: important
tags: security

Dash currently does not sanitize local variables, which differs from
the behavior in bash.

This can lead to issues when developers don't consider the difference
in behavior between dash and bash.  For example, this led to a
security issue in xdg-utils:
http://bugs.debian.org/777722

It would be preferable to match bash's behavior, but that probably
should a change pushed upstream.

Best wishes,
Mike