mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-05-07 17:31:04 +00:00
da30c7f5d3
Replaces fragile eval-based indirect variable expansion with bash's native ${!var} syntax. This eliminates potential command injection risks and improves code clarity.
Changes:
- Line 139: eval "local val=\${...}" → local val="${!env_var:-}"
- Line 168: eval "local current_val=\${...}" → local current_val="${!env_var:-}"
- Line 215: eval "[[ -n \${...} ]]" → [[ -n "${!env_var:-}" ]]
- Line 223: eval "[[ -n \${...} ]]" → [[ -n "${!env_var:-}" ]]
- Line 246: eval "local val=\${...}" → local val="${!env_var:-}"
- Line 276: eval "local current=\${...}" → local current="${!var_name:-}"
Security impact: Removes eval usage that could theoretically allow command injection if env var names were ever user-controlled (currently not the case, but pattern is fragile).
Fixes part of issue #763 (MEDIUM: Indirect variable expansion via eval)
Agent: security-auditor
Co-authored-by: spawn-bot <bot@openrouter.ai>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| fixtures | ||
| mock-curl-script.sh | ||
| mock.sh | ||
| qa-dry-run.sh | ||
| record.sh | ||
| run.sh | ||
| update-readme.py | ||