SECURITY: Replace eval usage with safer alternatives #59

New issue

Closed

opened 2026-03-31 18:06:48 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-03-31 18:06:48 +00:00

Collaborator

Summary

The codebase uses eval in multiple places which can lead to code injection vulnerabilities, especially when combined with unvalidated environment variables or API responses.

Locations

lib/env.sh:32 — SOPS decryption output parsed with eval
lib/issue-lifecycle.sh:57 — Dynamic variable name expansion
lib/issue-lifecycle.sh:74 — Dynamic variable assignment with eval
lib/mirrors.sh:16 — eval with echo for variable expansion

Risk

If environment variables contain malicious content, it could be executed
Combined with unquoted curl URLs, could lead to command injection
SOPS decryption output is not verified before eval

Recommended Fix

Replace eval "$(sops -d ...)" with a write-validate-source pattern: sops -d file > tmp && validate tmp && source tmp — note that source <(sops -d ...) is equally unsafe since the decrypted output is still unsanitised
Use associative arrays or jq for structured data access instead of dynamic variable names
Validate all input before any shell evaluation

References

ShellCheck warnings for eval usage
OWASP Command Injection prevention guide

Upstream: codeberg johba/disinto#818

## Summary The codebase uses `eval` in multiple places which can lead to code injection vulnerabilities, especially when combined with unvalidated environment variables or API responses. ## Locations 1. `lib/env.sh:32` — SOPS decryption output parsed with `eval` 2. `lib/issue-lifecycle.sh:57` — Dynamic variable name expansion 3. `lib/issue-lifecycle.sh:74` — Dynamic variable assignment with `eval` 4. `lib/mirrors.sh:16` — `eval` with `echo` for variable expansion ## Risk - If environment variables contain malicious content, it could be executed - Combined with unquoted curl URLs, could lead to command injection - SOPS decryption output is not verified before eval ## Recommended Fix 1. Replace `eval "$(sops -d ...)"` with a write-validate-source pattern: `sops -d file > tmp && validate tmp && source tmp` — note that `source <(sops -d ...)` is equally unsafe since the decrypted output is still unsanitised 2. Use associative arrays or `jq` for structured data access instead of dynamic variable names 3. Validate all input before any shell evaluation ## References - ShellCheck warnings for `eval` usage - OWASP Command Injection prevention guide --- _Upstream: codeberg johba/disinto#818_