Skip to content

Commit e6d64fa

Browse files
committed
ini: use envsubst
eval was prob used to expand $VAR refs ini values ie: path = $HOME/.config reason for this patch: if say the ini is updated via session_token or user_input then think of backticks or $() or ! in user_input_pw envsubst would continue to expand available env vars unknown vars become empty strings so key=val of "credentials=user:${NONEXISTENT}" becomes "credentials=user:" if a token or password contains $ .. itll be silently empty and literal but at least not executed - Known env var: ($HOME) is expanded (OK) - Unknown env var: ($NONEXISTENT) becomes EMPTY STRING - string with bang: (!) is passed through as is (OK) - backticks or exec: (`) or ($()) is passwd through as is (OK)
1 parent d98deae commit e6d64fa

3 files changed

Lines changed: 3 additions & 3 deletions

File tree

examples/config/src/lib/ini.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ ini_load() {
4747
elif [[ $line =~ $key_regex ]]; then
4848
key="${BASH_REMATCH[1]}"
4949
value="${BASH_REMATCH[2]}"
50-
[[ $value == *\$* ]] && eval "value=\"$value\""
50+
[[ $value == *\$* ]] && value=$(envsubst <<< "$value")
5151
ini["${section}${key}"]="$value"
5252
fi
5353
done <"$ini_file"

examples/ini/src/lib/ini.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ ini_load() {
4747
elif [[ $line =~ $key_regex ]]; then
4848
key="${BASH_REMATCH[1]}"
4949
value="${BASH_REMATCH[2]}"
50-
[[ $value == *\$* ]] && eval "value=\"$value\""
50+
[[ $value == *\$* ]] && value=$(envsubst <<< "$value")
5151
ini["${section}${key}"]="$value"
5252
fi
5353
done <"$ini_file"

lib/bashly/libraries/ini/ini.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ ini_load() {
4747
elif [[ $line =~ $key_regex ]]; then
4848
key="${BASH_REMATCH[1]}"
4949
value="${BASH_REMATCH[2]}"
50-
[[ $value == *\$* ]] && eval "value=\"$value\""
50+
[[ $value == *\$* ]] && value=$(envsubst <<< "$value")
5151
ini["${section}${key}"]="$value"
5252
fi
5353
done <"$ini_file"

0 commit comments

Comments
 (0)