From b8f636d1cdcd2de0211cc5a7ad5424deee2a3568 Mon Sep 17 00:00:00 2001
From: Pavel Valena <pvalena@redhat.com>
Date: Wed, 29 Apr 2026 05:41:21 +0200
Subject: [PATCH] fix(base): replace eval with safe variable indirection in
 splitsep and export_n

splitsep: use local nameref to avoid eval injection via single-quote breakout.
export_n: use ${!var} and printf -v to avoid eval injection via double-quote breakout.

Related: RHEL-210935
---
 modules.d/99base/dracut-lib.sh | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
index 832435d21..0a0604472 100755
--- a/modules.d/99base/dracut-lib.sh
+++ b/modules.d/99base/dracut-lib.sh
@@ -395,12 +395,18 @@ splitsep() {
 
     while [ -n "$str" -a "$#" -gt 1 ]; do
         tmp="${str%%$sep*}"
-        eval "$1='${tmp}'"
+        local -n _splitsep_ref="$1"
+        _splitsep_ref="$tmp"
+        unset -n _splitsep_ref
         str="${str#"$tmp"}"
         str="${str#$sep}"
         shift
     done
-    [ -n "$str" -a -n "$1" ] && eval "$1='$str'"
+    if [ -n "$str" -a -n "$1" ]; then
+        local -n _splitsep_ref="$1"
+        _splitsep_ref="$str"
+        unset -n _splitsep_ref
+    fi
     debug_on
     return 0
 }
@@ -1168,15 +1174,13 @@ emergency_shell()
 }
 
 # Retain the values of these variables but ensure that they are unexported
-# This is a POSIX-compliant equivalent of bash's "export -n"
-export_n()
-{
+export_n() {
     local var
     local val
     for var in "$@"; do
-        eval val=\$$var
-        unset $var
-        [ -n "$val" ] && eval $var=\"$val\"
+        val="${!var}"
+        unset "$var"
+        [ -n "$val" ] && printf -v "$var" '%s' "$val"
     done
 }