vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-05-09 19:49:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

fix: replace printf -v with export for bash 3.2 compat in key-request.sh (#1561)

Browse source 
printf -v requires bash 4.0+; macOS ships bash 3.2, causing _try_load_env_var()
to fail with 'printf: -v: invalid option' and breaking saved API key loading for
all cloud providers. Both var_name and val are validated against strict regexes
immediately above, so export "NAME=VALUE" is injection-safe and works on bash 3.2+.
The macos-compat linter already flags this pattern as MC013 error.

Agent: team-lead

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-02-21 03:42:14 -08:00 • committed by GitHub
parent 907d21f030
commit 184bc21b3a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
shared/key-request.sh
View file

@ -92,9 +92,8 @@ print(v)
fi
# SECURITY: val is already validated against ^[a-zA-Z0-9._/@-]+$ above,
# and var_name is validated against ^[A-Z_][A-Z0-9_]*$ by the caller.
# Use printf -v for safe variable assignment (no command substitution/expansion).
printf -v "${var_name}" '%s' "${val}"
export "${var_name}"
# Use export NAME=VALUE (bash 3.2 compatible; printf -v requires bash 4.0+).
export "${var_name}=${val}"
return 0
fi
fi