As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means that code at the end of a function definition inside an environmental variable will be executed when a new instance of bash launches and you obviously don't want anyone to run any code they please on your server. Function definitions themselves are apparently not a security risk though and are allowed because they have to be explicitly called for their code to be executed.

My question is why can't a malicious user simply define a function, containing their malicious code as a common command like `ls` and then hope that the script (or whatever is being run) will use this command at some point?

An example of what I have in mind:

```
$ export ls='() { echo "doing bad things..."; }'
$ bash -c ls
doing bad things...

```