From: Sebastian Pipping Date: Fri, 6 Mar 2015 13:06:21 +0000 (+0100) Subject: Add missing escaping of user input (issue #58) X-Git-Tag: v0.69~2 X-Git-Url: https://git.grml.org/?p=grml-debootstrap.git;a=commitdiff_plain;h=92b1de2dc5253f1ec6f7281dcf77f48b2a8db2a9;hp=7b07013305bea95e8d6db7239c82be09624a11b8;ds=sidebyside Add missing escaping of user input (issue #58) --- diff --git a/grml-debootstrap b/grml-debootstrap index f7b85eb..0f3304c 100755 --- a/grml-debootstrap +++ b/grml-debootstrap @@ -1177,47 +1177,49 @@ preparechroot() { CHROOT_VARIABLES="/var/cache/grml-debootstrap/variables_${SHORT_TARGET}" touch "$CHROOT_VARIABLES" chmod 600 "$CHROOT_VARIABLES" # make sure nobody except root can read it - echo "# Configuration of ${PN}" > "$CHROOT_VARIABLES" - [ -n "$ARCH" ] && echo "ARCH=\"$ARCH\"" >> "$CHROOT_VARIABLES" - [ -n "$BACKPORTREPOS" ] && echo "BACKPORTREPOS=\"$BACKPORTREPOS\"" >> "$CHROOT_VARIABLES" - [ -n "$CHROOT_SCRIPTS" ] && echo "CHROOT_SCRIPTS=\"$CHROOT_SCRIPTS\"" >> "$CHROOT_VARIABLES" - [ -n "$CONFFILES" ] && echo "CONFFILES=\"$CONFFILES\"" >> "$CHROOT_VARIABLES" - [ -n "$DEBCONF" ] && echo "DEBCONF=\"$DEBCONF\"" >> "$CHROOT_VARIABLES" - [ -n "$DEBIAN_FRONTEND" ] && echo "DEBIAN_FRONTEND=\"$DEBIAN_FRONTEND\"" >> "$CHROOT_VARIABLES" - [ -n "$DEBOOTSTRAP" ] && echo "DEBOOTSTRAP=\"$DEBOOTSTRAP\"" >> "$CHROOT_VARIABLES" - [ -n "$DEFAULT_LOCALES" ] && echo "DEFAULT_LOCALES=\"$DEFAULT_LOCALES\"" >> "$CHROOT_VARIABLES" - [ -n "$DEFAULT_LANGUAGE" ] && echo "DEFAULT_LANGUAGE=\"$DEFAULT_LANGUAGE\"" >> "$CHROOT_VARIABLES" - [ -n "$EXTRAPACKAGES" ] && echo "EXTRAPACKAGES=\"$EXTRAPACKAGES\"" >> "$CHROOT_VARIABLES" - [ -n "$FALLBACK_MIRROR" ] && echo "FALLBACK_MIRROR=\"$FALLBACK_MIRROR\"" >> "$CHROOT_VARIABLES" - [ -n "$FORCE" ] && echo "FORCE=\"$FORCE\"" >> "$CHROOT_VARIABLES" - [ -n "$GRMLREPOS" ] && echo "GRMLREPOS=\"$GRMLREPOS\"" >> "$CHROOT_VARIABLES" - [ -n "$GRUB" ] && echo "GRUB=\"$GRUB\"" >> "$CHROOT_VARIABLES" - [ -n "$HOSTNAME" ] && echo "HOSTNAME=\"$HOSTNAME\"" >> "$CHROOT_VARIABLES" - [ -n "$INITRD" ] && echo "INITRD=\"$INITRD\"" >> "$CHROOT_VARIABLES" - [ -n "$INSTALL_NOTES" ] && echo "INSTALL_NOTES=\"$INSTALL_NOTES\"" >> "$CHROOT_VARIABLES" - [ -n "$ISODIR" ] && echo "ISODIR=\"$ISO\"" >> "$CHROOT_VARIABLES" - [ -n "$ISO" ] && echo "ISO=\"$ISO\"" >> "$CHROOT_VARIABLES" - [ -n "$KEEP_SRC_LIST" ] && echo "KEEP_SRC_LIST=\"$KEEP_SRC_LIST\"" >> "$CHROOT_VARIABLES" - [ -n "$LOCALES" ] && echo "LOCALES=\"$LOCALES\"" >> "$CHROOT_VARIABLES" - [ -n "$MIRROR" ] && echo "MIRROR=\"$MIRROR\"" >> "$CHROOT_VARIABLES" - [ -n "$MKFS" ] && echo "MKFS=\"$MKFS\"" >> "$CHROOT_VARIABLES" - [ -n "$NOPASSWORD" ] && echo "NOPASSWORD=\"true\"" >> "$CHROOT_VARIABLES" - [ -n "$NOKERNEL" ] && echo "NOKERNEL=\"true\"" >> "$CHROOT_VARIABLES" - [ -n "$PACKAGES" ] && echo "PACKAGES=\"$PACKAGES\"" >> "$CHROOT_VARIABLES" - [ -n "$PRE_SCRIPTS" ] && echo "PRE_SCRIPTS=\"$PRE_SCRIPTS\"" >> "$CHROOT_VARIABLES" - [ -n "$RECONFIGURE" ] && echo "RECONFIGURE=\"$RECONFIGURE\"" >> "$CHROOT_VARIABLES" - [ -n "$RELEASE" ] && echo "RELEASE=\"$RELEASE\"" >> "$CHROOT_VARIABLES" - [ -n "$RM_APTCACHE" ] && echo "RM_APTCACHE=\"$RM_APTCACHE\"" >> "$CHROOT_VARIABLES" - [ -n "$ROOTPASSWORD" ] && echo "ROOTPASSWORD=\"$ROOTPASSWORD\"" >> "$CHROOT_VARIABLES" - [ -n "$SCRIPTS" ] && echo "SCRIPTS=\"$SCRIPTS\"" >> "$CHROOT_VARIABLES" - [ -n "$SECURE" ] && echo "SECURE=\"$SECURE\"" >> "$CHROOT_VARIABLES" - [ -n "$SELECTED_PARTITIONS" ] && echo "SELECTED_PARTITIONS=\"$SELECTED_PARTITIONS\"" >> "$CHROOT_VARIABLES" - [ -n "$TARGET" ] && echo "TARGET=\"$TARGET\"" >> "$CHROOT_VARIABLES" - [ -n "$UPGRADE_SYSTEM" ] && echo "UPGRADE_SYSTEM=\"$UPGRADE_SYSTEM\"" >> "$CHROOT_VARIABLES" - [ -n "$TARGET_UUID" ] && echo "TARGET_UUID=\"$TARGET_UUID\"" >> "$CHROOT_VARIABLES" - [ -n "$TIMEZONE" ] && echo "TIMEZONE=\"$TIMEZONE\"" >> "$CHROOT_VARIABLES" - [ -n "$TUNE2FS" ] && echo "TUNE2FS=\"$TUNE2FS\"" >> "$CHROOT_VARIABLES" - [ -n "$VMSIZE" ] && echo "VMSIZE=\"$VMSIZE\"" >> "$CHROOT_VARIABLES" + echo "# Configuration of ${PN}" > "$CHROOT_VARIABLES" + # Resorting to sed(1) for escaping since "VAR='${VAR//\'/\'\\\'\'}'" does not work with all versions of Bash, + # e.g. not with 4.2.37(1)-release (a.k.a 4.2+dfsg-0.1+deb7u3) of Debian wheezy + [ -n "$ARCH" ] && echo "ARCH='$(sed "s,','\\\\'',g" <<<"${ARCH}")'" >> "$CHROOT_VARIABLES" + [ -n "$BACKPORTREPOS" ] && echo "BACKPORTREPOS='$(sed "s,','\\\\'',g" <<<"${BACKPORTREPOS}")'" >> "$CHROOT_VARIABLES" + [ -n "$CHROOT_SCRIPTS" ] && echo "CHROOT_SCRIPTS='$(sed "s,','\\\\'',g" <<<"${CHROOT_SCRIPTS}")'" >> "$CHROOT_VARIABLES" + [ -n "$CONFFILES" ] && echo "CONFFILES='$(sed "s,','\\\\'',g" <<<"${CONFFILES}")'" >> "$CHROOT_VARIABLES" + [ -n "$DEBCONF" ] && echo "DEBCONF='$(sed "s,','\\\\'',g" <<<"${DEBCONF}")'" >> "$CHROOT_VARIABLES" + [ -n "$DEBIAN_FRONTEND" ] && echo "DEBIAN_FRONTEND='$(sed "s,','\\\\'',g" <<<"${DEBIAN_FRONTEND}")'" >> "$CHROOT_VARIABLES" + [ -n "$DEBOOTSTRAP" ] && echo "DEBOOTSTRAP='$(sed "s,','\\\\'',g" <<<"${DEBOOTSTRAP}")'" >> "$CHROOT_VARIABLES" + [ -n "$DEFAULT_LOCALES" ] && echo "DEFAULT_LOCALES='$(sed "s,','\\\\'',g" <<<"${DEFAULT_LOCALES}")'" >> "$CHROOT_VARIABLES" + [ -n "$DEFAULT_LANGUAGE" ] && echo "DEFAULT_LANGUAGE='$(sed "s,','\\\\'',g" <<<"${DEFAULT_LANGUAGE}")'" >> "$CHROOT_VARIABLES" + [ -n "$EXTRAPACKAGES" ] && echo "EXTRAPACKAGES='$(sed "s,','\\\\'',g" <<<"${EXTRAPACKAGES}")'" >> "$CHROOT_VARIABLES" + [ -n "$FALLBACK_MIRROR" ] && echo "FALLBACK_MIRROR='$(sed "s,','\\\\'',g" <<<"${FALLBACK_MIRROR}")'" >> "$CHROOT_VARIABLES" + [ -n "$FORCE" ] && echo "FORCE='$(sed "s,','\\\\'',g" <<<"${FORCE}")'" >> "$CHROOT_VARIABLES" + [ -n "$GRMLREPOS" ] && echo "GRMLREPOS='$(sed "s,','\\\\'',g" <<<"${GRMLREPOS}")'" >> "$CHROOT_VARIABLES" + [ -n "$GRUB" ] && echo "GRUB='$(sed "s,','\\\\'',g" <<<"${GRUB}")'" >> "$CHROOT_VARIABLES" + [ -n "$HOSTNAME" ] && echo "HOSTNAME='$(sed "s,','\\\\'',g" <<<"${HOSTNAME}")'" >> "$CHROOT_VARIABLES" + [ -n "$INITRD" ] && echo "INITRD='$(sed "s,','\\\\'',g" <<<"${INITRD}")'" >> "$CHROOT_VARIABLES" + [ -n "$INSTALL_NOTES" ] && echo "INSTALL_NOTES='$(sed "s,','\\\\'',g" <<<"${INSTALL_NOTES}")'" >> "$CHROOT_VARIABLES" + [ -n "$ISODIR" ] && echo "ISODIR='$(sed "s,','\\\\'',g" <<<"${ISO}")'" >> "$CHROOT_VARIABLES" + [ -n "$ISO" ] && echo "ISO='$(sed "s,','\\\\'',g" <<<"${ISO}")'" >> "$CHROOT_VARIABLES" + [ -n "$KEEP_SRC_LIST" ] && echo "KEEP_SRC_LIST='$(sed "s,','\\\\'',g" <<<"${KEEP_SRC_LIST}")'" >> "$CHROOT_VARIABLES" + [ -n "$LOCALES" ] && echo "LOCALES='$(sed "s,','\\\\'',g" <<<"${LOCALES}")'" >> "$CHROOT_VARIABLES" + [ -n "$MIRROR" ] && echo "MIRROR='$(sed "s,','\\\\'',g" <<<"${MIRROR}")'" >> "$CHROOT_VARIABLES" + [ -n "$MKFS" ] && echo "MKFS='$(sed "s,','\\\\'',g" <<<"${MKFS}")'" >> "$CHROOT_VARIABLES" + [ -n "$NOPASSWORD" ] && echo "NOPASSWORD=\"true\"" >> "$CHROOT_VARIABLES" + [ -n "$NOKERNEL" ] && echo "NOKERNEL=\"true\"" >> "$CHROOT_VARIABLES" + [ -n "$PACKAGES" ] && echo "PACKAGES='$(sed "s,','\\\\'',g" <<<"${PACKAGES}")'" >> "$CHROOT_VARIABLES" + [ -n "$PRE_SCRIPTS" ] && echo "PRE_SCRIPTS='$(sed "s,','\\\\'',g" <<<"${PRE_SCRIPTS}")'" >> "$CHROOT_VARIABLES" + [ -n "$RECONFIGURE" ] && echo "RECONFIGURE='$(sed "s,','\\\\'',g" <<<"${RECONFIGURE}")'" >> "$CHROOT_VARIABLES" + [ -n "$RELEASE" ] && echo "RELEASE='$(sed "s,','\\\\'',g" <<<"${RELEASE}")'" >> "$CHROOT_VARIABLES" + [ -n "$RM_APTCACHE" ] && echo "RM_APTCACHE='$(sed "s,','\\\\'',g" <<<"${RM_APTCACHE}")'" >> "$CHROOT_VARIABLES" + [ -n "$ROOTPASSWORD" ] && echo "ROOTPASSWORD='$(sed "s,','\\\\'',g" <<<"${ROOTPASSWORD}")'" >> "$CHROOT_VARIABLES" + [ -n "$SCRIPTS" ] && echo "SCRIPTS='$(sed "s,','\\\\'',g" <<<"${SCRIPTS}")'" >> "$CHROOT_VARIABLES" + [ -n "$SECURE" ] && echo "SECURE='$(sed "s,','\\\\'',g" <<<"${SECURE}")'" >> "$CHROOT_VARIABLES" + [ -n "$SELECTED_PARTITIONS" ] && echo "SELECTED_PARTITIONS='$(sed "s,','\\\\'',g" <<<"${SELECTED_PARTITIONS}")'" >> "$CHROOT_VARIABLES" + [ -n "$TARGET" ] && echo "TARGET='$(sed "s,','\\\\'',g" <<<"${TARGET}")'" >> "$CHROOT_VARIABLES" + [ -n "$UPGRADE_SYSTEM" ] && echo "UPGRADE_SYSTEM='$(sed "s,','\\\\'',g" <<<"${UPGRADE_SYSTEM}")'" >> "$CHROOT_VARIABLES" + [ -n "$TARGET_UUID" ] && echo "TARGET_UUID='$(sed "s,','\\\\'',g" <<<"${TARGET_UUID}")'" >> "$CHROOT_VARIABLES" + [ -n "$TIMEZONE" ] && echo "TIMEZONE='$(sed "s,','\\\\'',g" <<<"${TIMEZONE}")'" >> "$CHROOT_VARIABLES" + [ -n "$TUNE2FS" ] && echo "TUNE2FS='$(sed "s,','\\\\'',g" <<<"${TUNE2FS}")'" >> "$CHROOT_VARIABLES" + [ -n "$VMSIZE" ] && echo "VMSIZE='$(sed "s,','\\\\'',g" <<<"${VMSIZE}")'" >> "$CHROOT_VARIABLES" cp $VERBOSE "${CONFFILES}"/chroot-script "${MNTPOINT}"/bin/chroot-script chmod 755 "${MNTPOINT}"/bin/chroot-script