From 1a00697dfa5d58bc298fe77e48f2b586c0a0659e Mon Sep 17 00:00:00 2001
From: Pavel Valena <pvalena@redhat.com>
Date: Wed, 29 Apr 2026 05:41:21 +0200
Subject: [PATCH] fix(base): replace eval with safe variable indirection in
 splitsep and export_n

splitsep: use local nameref to avoid eval injection via single-quote breakout.
export_n: use ${!var} and printf -v to avoid eval injection via double-quote breakout.

(cherry picked from commit efa38e72f2742456dc93060fb1ac28d98217ac21)

Related: RHEL-210940
---
 modules.d/99base/dracut-lib.sh | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
index b1ea95255..1c753ba16 100755
--- a/modules.d/99base/dracut-lib.sh
+++ b/modules.d/99base/dracut-lib.sh
@@ -374,12 +374,18 @@ splitsep() {
 
     while [ -n "$str" -a "$#" -gt 1 ]; do
         tmp="${str%%$sep*}"
-        eval "$1='${tmp}'"
+        local -n _splitsep_ref="$1"
+        _splitsep_ref="$tmp"
+        unset -n _splitsep_ref
         str="${str#"$tmp"}"
         str="${str#$sep}"
         shift
     done
-    [ -n "$str" -a -n "$1" ] && eval "$1='$str'"
+    if [ -n "$str" -a -n "$1" ]; then
+        local -n _splitsep_ref="$1"
+        _splitsep_ref="$str"
+        unset -n _splitsep_ref
+    fi
     debug_on
     return 0
 }
@@ -1016,14 +1022,13 @@ emergency_shell() {
 }
 
 # Retain the values of these variables but ensure that they are unexported
-# This is a POSIX-compliant equivalent of bash's "export -n"
 export_n() {
     local var
     local val
     for var in "$@"; do
-        eval val=\$$var
-        unset $var
-        [ -n "$val" ] && eval "$var=\"$val\""
+        val="${!var}"
+        unset "$var"
+        [ -n "$val" ] && printf -v "$var" '%s' "$val"
     done
 }