60 lines
1.7 KiB
Diff
60 lines
1.7 KiB
Diff
From b8f636d1cdcd2de0211cc5a7ad5424deee2a3568 Mon Sep 17 00:00:00 2001
|
|
From: Pavel Valena <pvalena@redhat.com>
|
|
Date: Wed, 29 Apr 2026 05:41:21 +0200
|
|
Subject: [PATCH] fix(base): replace eval with safe variable indirection in
|
|
splitsep and export_n
|
|
|
|
splitsep: use local nameref to avoid eval injection via single-quote breakout.
|
|
export_n: use ${!var} and printf -v to avoid eval injection via double-quote breakout.
|
|
|
|
Related: RHEL-210935
|
|
---
|
|
modules.d/99base/dracut-lib.sh | 20 ++++++++++++--------
|
|
1 file changed, 12 insertions(+), 8 deletions(-)
|
|
|
|
diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
|
|
index 832435d21..0a0604472 100755
|
|
--- a/modules.d/99base/dracut-lib.sh
|
|
+++ b/modules.d/99base/dracut-lib.sh
|
|
@@ -395,12 +395,18 @@ splitsep() {
|
|
|
|
while [ -n "$str" -a "$#" -gt 1 ]; do
|
|
tmp="${str%%$sep*}"
|
|
- eval "$1='${tmp}'"
|
|
+ local -n _splitsep_ref="$1"
|
|
+ _splitsep_ref="$tmp"
|
|
+ unset -n _splitsep_ref
|
|
str="${str#"$tmp"}"
|
|
str="${str#$sep}"
|
|
shift
|
|
done
|
|
- [ -n "$str" -a -n "$1" ] && eval "$1='$str'"
|
|
+ if [ -n "$str" -a -n "$1" ]; then
|
|
+ local -n _splitsep_ref="$1"
|
|
+ _splitsep_ref="$str"
|
|
+ unset -n _splitsep_ref
|
|
+ fi
|
|
debug_on
|
|
return 0
|
|
}
|
|
@@ -1168,15 +1174,13 @@ emergency_shell()
|
|
}
|
|
|
|
# Retain the values of these variables but ensure that they are unexported
|
|
-# This is a POSIX-compliant equivalent of bash's "export -n"
|
|
-export_n()
|
|
-{
|
|
+export_n() {
|
|
local var
|
|
local val
|
|
for var in "$@"; do
|
|
- eval val=\$$var
|
|
- unset $var
|
|
- [ -n "$val" ] && eval $var=\"$val\"
|
|
+ val="${!var}"
|
|
+ unset "$var"
|
|
+ [ -n "$val" ] && printf -v "$var" '%s' "$val"
|
|
done
|
|
}
|
|
|