{"version":"2.1.124","anchor":"bash-tool-printf-safety-hardening","canonical_anchor":"bash-tool-printf-safety-hardening","heading":"Bash-tool \/ printf safety hardening","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.124\/e\/bash-tool-printf-safety-hardening","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.124","markdown":"### Bash-tool \/ printf safety hardening\n\nThe Bash command analyzer now rejects `printf` invocations that could execute arbitrary code via format-string substitution: `printf` arguments containing `$`, `\\u\/\\U` escapes, format specifiers paired with non-numeric runtime values, or any flag other than the literal `--` are no longer auto-allowed.\n\nFor double-bracket arithmetic, the diagnostic now points out that `bash` may run `$(cmd)` while reusing `[[`'s semantics: `' contains array subscript or runtime-determined value \u2014 bash evaluates $(cmd) in subscripts` and `...' operand is non-numeric \u2014 \\`[[\\` arithmetically evaluates identifiers\/subscripts (may run $(cmd))`.\n\nA new escape-line-continuation rule replaces the older one to handle even-vs-odd backslashes correctly when deciding whether a backslash-newline pair is a real line continuation.\n\n**Evidence**\n\nBash analyzer (search for `\"contains array subscript or runtime-determined value\"` and `\"Delimiters-only string node contains unparsed command substitution\"`)."}