bash: detect second part of shellshock