From 9cb0a81679c321ed36abf01d156663c231732dfd Mon Sep 17 00:00:00 2001
From: TsT <tst2005@gmail.com>
Date: Sat, 13 Jun 2026 20:13:15 +0200
Subject: [PATCH] avoid potential arbitrary code execution from package.sh

---
 libexec/basher-_deps               | 9 ++++++++-
 libexec/basher-_link-bins          | 9 ++++++++-
 libexec/basher-_link-completions   | 9 ++++++++-
 libexec/basher-_unlink-bins        | 9 ++++++++-
 libexec/basher-_unlink-completions | 9 ++++++++-
 libexec/basher-list                | 9 ++++++++-
 6 files changed, 48 insertions(+), 6 deletions(-)

diff --git a/libexec/basher-_deps b/libexec/basher-_deps
index 0317738..e0cd801 100755
--- a/libexec/basher-_deps
+++ b/libexec/basher-_deps
@@ -10,6 +10,13 @@
 
 set -e
 
+get_vars_from_file() {
+  local names_pattern="$1";shift
+  local content_pattern='[a-zA-Z0-9.:/_-]*'
+  local value_pattern='('"$content_pattern"'|'\'"$content_pattern"\''|"'"$content_pattern"'")'
+  grep -E '^'"$names_pattern"'='"$value_pattern"'$' "$@"
+}
+
 if [ "$#" -ne 1 ]; then
   basher-help _deps
   exit 1
@@ -23,7 +30,7 @@ fi
 
 shopt -s nullglob
 
-source "$BASHER_PACKAGES_PATH/$package/package.sh"
+eval "$(get_vars_from_file 'DEPS' "$BASHER_PACKAGES_PATH/$package/package.sh")"
 IFS=: read -ra deps <<< "$DEPS"
 
 for dep in "${deps[@]}"
diff --git a/libexec/basher-_link-bins b/libexec/basher-_link-bins
index a4dedce..a77ad02 100755
--- a/libexec/basher-_link-bins
+++ b/libexec/basher-_link-bins
@@ -2,10 +2,17 @@
 
 package="$1"
 
+get_vars_from_file() {
+  local names_pattern="$1";shift
+  local content_pattern='[a-zA-Z0-9.:/_-]*'
+  local value_pattern='('"$content_pattern"'|'\'"$content_pattern"\''|"'"$content_pattern"'")'
+  grep -E '^'"$names_pattern"'='"$value_pattern"'$' "$@"
+}
+
 shopt -s nullglob
 
 if [ -e "$BASHER_PACKAGES_PATH/$package/package.sh" ]; then
-  source "$BASHER_PACKAGES_PATH/$package/package.sh"
+  eval "$(get_vars_from_file 'BINS' "$BASHER_PACKAGES_PATH/$package/package.sh")"
   IFS=: read -ra bins <<< "$BINS"
 fi
 
diff --git a/libexec/basher-_link-completions b/libexec/basher-_link-completions
index 63f398a..e032991 100755
--- a/libexec/basher-_link-completions
+++ b/libexec/basher-_link-completions
@@ -2,13 +2,20 @@
 
 package="$1"
 
+get_vars_from_file() {
+  local names_pattern="$1";shift
+  local content_pattern='[a-zA-Z0-9.:/_-]*'
+  local value_pattern='('"$content_pattern"'|'\'"$content_pattern"\''|"'"$content_pattern"'")'
+  grep -E '^'"$names_pattern"'='"$value_pattern"'$' "$@"
+}
+
 if [ ! -e "$BASHER_PACKAGES_PATH/$package/package.sh" ]; then
   exit
 fi
 
 shopt -s nullglob
 
-source "$BASHER_PACKAGES_PATH/$package/package.sh" # TODO: make this secure?
+eval "$(get_vars_from_file '(BASH_COMPLETIONS|ZSH_COMPLETIONS)' "$BASHER_PACKAGES_PATH/$package/package.sh")"
 IFS=: read -ra bash_completions <<< "$BASH_COMPLETIONS"
 IFS=: read -ra zsh_completions <<< "$ZSH_COMPLETIONS"
 
diff --git a/libexec/basher-_unlink-bins b/libexec/basher-_unlink-bins
index 1e15232..0cc2c2b 100755
--- a/libexec/basher-_unlink-bins
+++ b/libexec/basher-_unlink-bins
@@ -2,8 +2,15 @@
 
 package="$1"
 
+get_vars_from_file() {
+  local names_pattern="$1";shift
+  local content_pattern='[a-zA-Z0-9.:/_-]*'
+  local value_pattern='('"$content_pattern"'|'\'"$content_pattern"\''|"'"$content_pattern"'")'
+  grep -E '^'"$names_pattern"'='"$value_pattern"'$' "$@"
+}
+
 if [ -e "$BASHER_PACKAGES_PATH/$package/package.sh" ]; then
-  source "$BASHER_PACKAGES_PATH/$package/package.sh"
+  eval "$(get_vars_from_file 'BINS' "$BASHER_PACKAGES_PATH/$package/package.sh")"
   IFS=: read -ra bins <<< "$BINS"
 fi
 
diff --git a/libexec/basher-_unlink-completions b/libexec/basher-_unlink-completions
index 3502ea7..5151b3d 100755
--- a/libexec/basher-_unlink-completions
+++ b/libexec/basher-_unlink-completions
@@ -2,13 +2,20 @@
 
 package="$1"
 
+get_vars_from_file() {
+  local names_pattern="$1";shift
+  local content_pattern='[a-zA-Z0-9.:/_-]*'
+  local value_pattern='('"$content_pattern"'|'\'"$content_pattern"\''|"'"$content_pattern"'")'
+  grep -E '^'"$names_pattern"'='"$value_pattern"'$' "$@"
+}
+
 if [ ! -e "$BASHER_PACKAGES_PATH/$package/package.sh" ]; then
   exit
 fi
 
 shopt -s nullglob
 
-source "$BASHER_PACKAGES_PATH/$package/package.sh" # TODO: make this secure?
+eval "$(get_vars_from_file '(BASH_COMPLETIONS|ZSH_COMPLETIONS)' "$BASHER_PACKAGES_PATH/$package/package.sh")"
 IFS=: read -ra bash_completions <<< "$BASH_COMPLETIONS"
 IFS=: read -ra zsh_completions <<< "$ZSH_COMPLETIONS"
 
diff --git a/libexec/basher-list b/libexec/basher-list
index 64f37e5..d915ed3 100755
--- a/libexec/basher-list
+++ b/libexec/basher-list
@@ -5,6 +5,13 @@
 
 set -e
 
+get_vars_from_file() {
+  local names_pattern="$1";shift
+  local content_pattern='[a-zA-Z0-9.:/_-]*'
+  local value_pattern='('"$content_pattern"'|'\'"$content_pattern"\''|"'"$content_pattern"'")'
+  grep -E '^'"$names_pattern"'='"$value_pattern"'$' "$@"
+}
+
 case $1 in
   -v)
     verbose="true"
@@ -35,7 +42,7 @@ do
     
     # Check for package.sh file with custom BINS
     if [ -e "$BASHER_PACKAGES_PATH/$package_full/package.sh" ]; then
-      source "$BASHER_PACKAGES_PATH/$package_full/package.sh"
+      eval "$(get_vars_from_file 'BINS' "$BASHER_PACKAGES_PATH/$package_full/package.sh")"
       IFS=: read -ra bins <<< "$BINS"
     fi