Dear Debian Team,

i hit a bug in the echo command (coreutils).

The echo command recently started to interpret wildcards, when read
from a file, via "cat" in a for loop.

It has been noticed in the results, after processing textfiles with a
for-loop.
There are occurences of filenames of my hardrive, in the resulting
textfile, when I joined some files via "cat" and some "egrep"
filters.
So i tried to reproduce the issue and i found the cause.

I cannot reproduce this bug, out of a for-loop. But this
particular behavior can be reproduced to 100% under
similar circumstances. To use a absolute path in echo command
"/usr/bin/echo" and "/bin/echo" didn't change the outcome.


Screenshots are attached.


--------------------
Steps To Reproduce /
------------------

works like expected:

$ echo * ==> list current working directory
$ echo "*" ==> prints a '*'
$ var='*'; echo "$var" ==> prints a '*'
$ echo '*' >file; cat file ==> prints a '*'
$ echo '*' >file; a=`cat file`; echo "$a" ==> either print a '*'


fails:

$ echo "*" >b; for i in `cat b`; do echo "$i"; done
==> list current working directory instead of printing the wildcard '*'

----------

Same behavior I found with other wildcards, like '?'.

Strangely this command don't show any result - just a empty line:
$ while read i; do echo "$i"; done <<textfile_with_wildcard_in_it>


Whilst following command the exact desired result, of printing the
wildcard:
$ while read i; do echo "$i"; done <<<`cat <textfile_with_wildcard_in>`




Additional Information
---------------------------------------------------------------------------------------------------------------
Linux m0b1 5.18.0-kali7-amd64 0000001 SMP PREEMPT_DYNAMIC Debian
5.18.16-1kali1 (2022-08-31) x86_64 GNU/Linux

PRETTY_NAME="Kali GNU/Linux Rolling"
NAME="Kali GNU/Linux"
VERSION="2022.4"
VERSION_ID="2022.4"
VERSION_CODENAME="kali-rolling"

Package: coreutils
Essential: yes
Status: install ok installed
Priority: required
Section: utils
Installed-Size: 18062
Maintainer: Michael Stone <mstone@debian.org>
Architecture: amd64
Multi-Arch: foreign
Version: 9.1-1



$ which echo
/usr/bin/echo

$ file
/usr/bin/echo /usr/bin/echo: ELF 64-bit LSB pie executable, x86-64,
version 1 (SYSV), dynamically linked, interpreter
/lib64/ld-linux-x86-64.so.2,
BuildID[sha1]=a18e44e70d0bf293fabf3685eb1b75bd89fa6663, for GNU/Linux
3.2.0, stripped

$ file /bin/echo
/bin/echo: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV),
dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,
BuildID[sha1]=a18e44e70d0bf293fabf3685eb1b75bd89fa6663, for GNU/Linux
3.2.0, stripped
---------------------------------------------------------------------------------------------------------------

I hope this help to locate the issue.
If you need additional information, you are welcome to ask.

Kind regards and keep on your good work.

Greetings,
m4tt