2af42b1801
- fix(qemu): add missing bochs module explicitly - fix(base): escape die() message in emergency hook script - fix(base): replace eval with safe variable indirection in splitsep and export_n Resolves: RHEL-172462,RHEL-210943 From-source-git-commit: 2a395c7d4abe8e26836ecf109ab69600d4243e03
62 lines
1.8 KiB
Diff
62 lines
1.8 KiB
Diff
From 2a395c7d4abe8e26836ecf109ab69600d4243e03 Mon Sep 17 00:00:00 2001
|
|
From: Pavel Valena <pvalena@redhat.com>
|
|
Date: Thu, 7 May 2026 00:59:05 +0200
|
|
Subject: [PATCH 41/41] fix(base): replace eval with safe variable indirection
|
|
in splitsep and export_n
|
|
|
|
splitsep: use local nameref to avoid eval injection via single-quote breakout.
|
|
export_n: use ${!var} and printf -v to avoid eval injection via double-quote breakout.
|
|
|
|
(cherry picked from commit 1488eb683109cc5b2e5e038e1e89851ab0cd9508)
|
|
|
|
Related: RHEL-210943
|
|
---
|
|
modules.d/99base/dracut-lib.sh | 15 ++++++++++-----
|
|
1 file changed, 10 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
|
|
index 855305b3..48dfd590 100755
|
|
--- a/modules.d/99base/dracut-lib.sh
|
|
+++ b/modules.d/99base/dracut-lib.sh
|
|
@@ -329,12 +329,18 @@ splitsep() {
|
|
|
|
while [ -n "$str" ] && [ "$#" -gt 1 ]; do
|
|
tmp="${str%%"$sep"*}"
|
|
- eval "$1='${tmp}'"
|
|
+ local -n _splitsep_ref="$1"
|
|
+ _splitsep_ref="$tmp"
|
|
+ unset -n _splitsep_ref
|
|
str="${str#"$tmp"}"
|
|
str="${str#"$sep"}"
|
|
shift
|
|
done
|
|
- [ -n "$str" ] && [ -n "$1" ] && eval "$1='$str'"
|
|
+ if [ -n "$str" -a -n "$1" ]; then
|
|
+ local -n _splitsep_ref="$1"
|
|
+ _splitsep_ref="$str"
|
|
+ unset -n _splitsep_ref
|
|
+ fi
|
|
debug_on
|
|
return 0
|
|
}
|
|
@@ -923,14 +929,13 @@ emergency_shell() {
|
|
}
|
|
|
|
# Retain the values of these variables but ensure that they are unexported
|
|
-# This is a POSIX-compliant equivalent of bash's "export -n"
|
|
export_n() {
|
|
local var
|
|
local val
|
|
for var in "$@"; do
|
|
- eval "val=\$$var"
|
|
+ val="${!var}"
|
|
unset "$var"
|
|
- [ -n "$val" ] && eval "$var=\"$val\""
|
|
+ [ -n "$val" ] && printf -v "$var" '%s' "$val"
|
|
done
|
|
}
|
|
|
|
--
|
|
2.55.0
|
|
|