Commit e6d64fa
committed
ini: use envsubst
eval was prob used to expand $VAR refs ini values ie: path =
$HOME/.config
reason for this patch: if say the ini is updated via session_token or
user_input then think of backticks or $() or ! in user_input_pw
envsubst would continue to expand available env vars
unknown vars become empty strings
so key=val of "credentials=user:${NONEXISTENT}" becomes
"credentials=user:"
if a token or password contains $ .. itll be silently empty and literal
but at least not executed
- Known env var: ($HOME) is expanded (OK)
- Unknown env var: ($NONEXISTENT) becomes EMPTY STRING
- string with bang: (!) is passed through as is (OK)
- backticks or exec: (`) or ($()) is passwd through as is (OK)1 parent d98deae commit e6d64fa
3 files changed
Lines changed: 3 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
47 | 47 | | |
48 | 48 | | |
49 | 49 | | |
50 | | - | |
| 50 | + | |
51 | 51 | | |
52 | 52 | | |
53 | 53 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
47 | 47 | | |
48 | 48 | | |
49 | 49 | | |
50 | | - | |
| 50 | + | |
51 | 51 | | |
52 | 52 | | |
53 | 53 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
47 | 47 | | |
48 | 48 | | |
49 | 49 | | |
50 | | - | |
| 50 | + | |
51 | 51 | | |
52 | 52 | | |
53 | 53 | | |
| |||
0 commit comments