diff options
| author |   Guillaume Lambert <guillaume.lambert@orange.com> | 2021-03-10 16:09:31 +0100 |
|---|---|---|
| committer |   Krzysztof Opasiak <k.opasiak@samsung.com> | 2021-05-26 06:55:45 +0000 |
| commit | f3454863133c2979f5091e6881cde3a496b2e12d (patch) | |
| tree | 65b5d180b3947f9e9b2d0dbae3e683f16939c790 /kubernetes/portal | |
| parent | 9970854c6fec9e99bf8c5fd88d2183041a8c9fb7 (diff) | |
[COMMON] Fix ${!name} bashisms
pointed out by checkbashisms.
Note this kind of indirections can only be replaced directly in POSIX
by commands using eval.
Security risks must be evaluated for each context where eval is called.
For a safe use, the context must ensure that only a limited number of
possible constrainted values are passed to eval.
https://mywiki.wooledge.org/Bashism#Parameter_Expansions
https://mywiki.wooledge.org/BashFAQ/006#Indirection
Issue-ID: OOM-264
Signed-off-by: Guillaume Lambert <guillaume.lambert@orange.com>
Change-Id: Id27f3ffd1ddb092a9c038d3a45d9e3278720eb62
Diffstat (limited to 'kubernetes/portal')
| -rw-r--r-- | kubernetes/portal/components/portal-mariadb/resources/config/mariadb/docker-entrypoint.sh | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/kubernetes/portal/components/portal-mariadb/resources/config/mariadb/docker-entrypoint.sh b/kubernetes/portal/components/portal-mariadb/resources/config/mariadb/docker-entrypoint.sh index c4a21b927f..41069bd927 100644 --- a/kubernetes/portal/components/portal-mariadb/resources/config/mariadb/docker-entrypoint.sh +++ b/kubernetes/portal/components/portal-mariadb/resources/config/mariadb/docker-entrypoint.sh @@ -1,4 +1,5 @@ #!/bin/bash + set -eo pipefail shopt -s nullglob @@ -30,10 +31,15 @@ file_env() { mysql_error "Both $var and $fileVar are set (but are exclusive)" fi local val="$def" + # val="${!var}" + # val="$(< "${!fileVar}")" + # eval replacement of the bashism equivalents above presents no security issue here + # since var and fileVar variables contents are derived from the file_env() function arguments. + # This method is only called inside this script with a limited number of possible values. if [ "${!var:-}" ]; then - val="${!var}" + eval val=\$$var elif [ "${!fileVar:-}" ]; then - val="$(< "${!fileVar}")" + val="$(< "$(eval echo "\$$fileVar")")" fi export "$var"="$val" unset "$fileVar" |