** bash/shell中的注入安全浮点数学

注意:这个回答的重点是为在bash(或其他shell)中执行数学的注入安全解决方案提供思路。当然，同样也可以使用，只需稍作调整即可执行高级字符串处理等。

所提出的大多数解决方案都是使用外部数据(变量、文件、命令行、环境变量)动态构造小脚本。外部输入可用于向引擎中注入恶意代码，其中很多是恶意代码

下面是使用各种语言进行基本数学计算的比较，其中结果为浮点数。它计算A + B * 0.1(作为浮点数)。

所有的解决方案都试图避免创建难以维护的动态脚本，而是使用静态程序，并将参数传递给指定的变量。它们将安全地处理具有特殊字符的参数-减少代码注入的可能性。例外是'BC'，它不提供输入/输出功能

例外是'bc'，它不提供任何输入/输出，所有数据都来自stdin中的程序，所有输出都到stdout。所有计算都在沙箱中执行，不允许出现副作用(打开文件等)。理论上，注射是安全的设计!

A=5.2
B=4.3

# Awk: Map variable into awk
# Exit 0 (or just exit) for success, non-zero for error.
#
awk -v A="$A" -v B="$B" 'BEGIN { print A + B * 0.1 ; exit 0}'

# Perl
perl -e '($A,$B) = @ARGV ; print $A + $B * 0.1' "$A" "$B"

# Python 2
python -c 'import sys ; a = float(sys.argv[1]) ; b = float(sys.argv[2]) ; print a+b*0.1' "$A" "$B"

# Python 3
python3 -c 'import sys ; a = float(sys.argv[1]) ; b = float(sys.argv[2]) ; print(a+b*0.1)' "$A" "$B"

# BC
bc <<< "scale=1 ; $A + $B * 0.1"

Bash可以很好地计算浮点结果，不需要任何其他程序。

Bash独立甚至可以精确地计算π到小数点后第九位。

例子:

calc=104348/33215

accuracy=9

calc99p9=$((10**$accuracy))*$calc
result99p9=$((calc99p9))
result=${result99p9: -${#result99p9}: -$accuracy}.${result99p9: -$accuracy}

echo Bash calculated pi to be $result

结果

Bash calculated pi to be 3.141592653

下面是awk命令:-F =字段分隔符== +

echo "2.1+3.1" |  awk -F "+" '{print ($1+$2)}'

你不能。Bash只处理整数;您必须委托给bc之类的工具。

There are scenarios in wich you cannot use bc becouse it might simply not be present, like in some cut down versions of busybox or embedded systems. In any case limiting outer dependencies is always a good thing to do so you can always add zeroes to the number being divided by (numerator), that is the same as multiplying by a power of 10 (you should choose a power of 10 according to the precision you need), that will make the division output an integer number. Once you have that integer treat it as a string and position the decimal point (moving it from right to left) a number of times equal to the power of ten you multiplied the numerator by. This is a simple way of obtaining float results by using only integer numbers.

红利=除数×商+余数

我们来计算商和余数。 以及将这些字符串连接到一个变量中。

新方法只对log_decimal除数有效:

function main() {
  bar=10030
  divisor=100
  # divisor=50

  quotient=$((bar / divisor))
  # remainder=$((bar - v_int * divisor))
  remainder=$((bar % divisor))
  remainder_init=$remainder

  printf "%-15s --> %s\n" "quotient" "$quotient"
  printf "%-15s --> %s\n" "remainder" "$remainder"

  cnt=0
  while :; do
    remainder=$((remainder * 10))
    aux=$((remainder / divisor))
    printf "%-15s --> %s\n" "aux" "$aux"
    [[ aux -ne 0 ]] && break
    ((cnt += 1))
    printf "%-15s --> %s\n" "remainder" "$remainder"
  done
  printf "%-15s --> %s\n" "cnt" "$cnt"
  printf "%-15s --> %s\n" "aux" "$aux"

  printf $quotient
  printf "."
  for i in $(seq 1 $cnt); do printf "0"; done
  printf $remainder_init
}
clear
main

旧的错误方式:

bar=1234 \
&& divisor=1000 \
    && foo=$(printf "%s.%s" $(( bar / divisor )) $(( bar % divisor ))) \
    && printf "bar is %d miliseconds or %s seconds\n" $bar $foo

输出:bar为1234毫秒或1.234秒