From fb2cf96988040a6ef21074024b41c2d322f14452 Mon Sep 17 00:00:00 2001
From: Pavel Valena <pvalena@redhat.com>
Date: Thu, 7 May 2026 00:59:05 +0200
Subject: [PATCH 39/39] fix(base): replace eval with safe variable indirection
 in splitsep and export_n

splitsep: use local nameref to avoid eval injection via single-quote breakout.
export_n: use ${!var} and printf -v to avoid eval injection via double-quote breakout.

(cherry picked from commit 1488eb683109cc5b2e5e038e1e89851ab0cd9508)

Related: RHEL-210942
---
 modules.d/99base/dracut-lib.sh | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
index 855305b3..48dfd590 100755
--- a/modules.d/99base/dracut-lib.sh
+++ b/modules.d/99base/dracut-lib.sh
@@ -329,12 +329,18 @@ splitsep() {
 
     while [ -n "$str" ] && [ "$#" -gt 1 ]; do
         tmp="${str%%"$sep"*}"
-        eval "$1='${tmp}'"
+        local -n _splitsep_ref="$1"
+        _splitsep_ref="$tmp"
+        unset -n _splitsep_ref
         str="${str#"$tmp"}"
         str="${str#"$sep"}"
         shift
     done
-    [ -n "$str" ] && [ -n "$1" ] && eval "$1='$str'"
+    if [ -n "$str" -a -n "$1" ]; then
+        local -n _splitsep_ref="$1"
+        _splitsep_ref="$str"
+        unset -n _splitsep_ref
+    fi
     debug_on
     return 0
 }
@@ -923,14 +929,13 @@ emergency_shell() {
 }
 
 # Retain the values of these variables but ensure that they are unexported
-# This is a POSIX-compliant equivalent of bash's "export -n"
 export_n() {
     local var
     local val
     for var in "$@"; do
-        eval "val=\$$var"
+        val="${!var}"
         unset "$var"
-        [ -n "$val" ] && eval "$var=\"$val\""
+        [ -n "$val" ] && printf -v "$var" '%s' "$val"
     done
 }
 
-- 
2.55.0