From f45b308c78f2ecdfc07e556bbdebf229900ce0d2 Mon Sep 17 00:00:00 2001
From: Kroese <kroese@users.noreply.github.com>
Date: Fri, 3 Jul 2026 17:14:59 +0200
Subject: [PATCH] feat: Sanitize environment variables (#1192)

---
 src/disk.sh    |  9 +++++++++
 src/display.sh |  5 +++++
 src/install.sh |  2 ++
 src/network.sh |  9 +++++++++
 src/power.sh   |  2 ++
 src/proc.sh    |  4 ++++
 src/reset.sh   | 11 +++++++++--
 src/serial.sh  |  8 +++++++-
 src/server.sh  |  6 ++++++
 9 files changed, 53 insertions(+), 3 deletions(-)

diff --git a/src/disk.sh b/src/disk.sh
index 7f0cfcd..929e69c 100644
--- a/src/disk.sh
+++ b/src/disk.sh
@@ -11,6 +11,15 @@ set -Eeuo pipefail
 : "${DISK_DISCARD:="on"}"         # Controls whether unmap (TRIM) commands are passed to the host.
 : "${DISK_ROTATION:="1"}"         # Rotation rate, set to 1 for SSD storage and increase for HDD
 
+# Sanitize all variables
+DISK_IO=$(strip "$DISK_IO")
+DISK_FMT=$(strip "$DISK_FMT")
+DISK_TYPE=$(strip "$DISK_TYPE")
+DISK_FLAGS=$(strip "$DISK_FLAGS")
+DISK_CACHE=$(strip "$DISK_CACHE")
+DISK_DISCARD=$(strip "$DISK_DISCARD")
+DISK_ROTATION=$(strip "$DISK_ROTATION")
+
 BOOT="$STORAGE/$BASE.boot.img"
 SYSTEM="$STORAGE/$BASE.system.img"
 
diff --git a/src/display.sh b/src/display.sh
index b8eb145..d254146 100644
--- a/src/display.sh
+++ b/src/display.sh
@@ -8,6 +8,11 @@ set -Eeuo pipefail
 : "${DISPLAY:="none"}"  # Display type
 : "${RENDERNODE:="/dev/dri/renderD128"}"  # Render node
 
+# Sanitize variables
+VGA=$(strip "$VGA")
+DISPLAY=$(strip "$DISPLAY")
+RENDERNODE=$(strip "$RENDERNODE")
+
 CPU_VENDOR=$(lscpu | awk '/Vendor ID/{print $3}')
 
 if ! enabled "$GPU" || [[ "$CPU_VENDOR" != "GenuineIntel" || "$ARCH" != "amd64" ]]; then
diff --git a/src/install.sh b/src/install.sh
index 89ca3d0..d78429a 100644
--- a/src/install.sh
+++ b/src/install.sh
@@ -27,6 +27,8 @@ FILE=$(find / -maxdepth 1 -type f -iname "$FN" -print -quit)
 [ ! -s "$FILE" ] && FILE=$(find "$STORAGE" -maxdepth 1 -type f -iname "$FN" -print -quit)
 [ -s "$FILE" ] && BASE="DSM_VirtualDSM" && URL="file://$FILE" 
 
+URL=$(strip "$URL")
+
 if [ -n "$URL" ] && [ ! -s "$FILE" ] && [ ! -d "$DIR" ]; then
   BASE=$(basename "$URL" .pat)
   if [ ! -s "$STORAGE/$BASE.system.img" ]; then
diff --git a/src/network.sh b/src/network.sh
index f08c7a4..fa3af98 100644
--- a/src/network.sh
+++ b/src/network.sh
@@ -32,6 +32,15 @@ set -Eeuo pipefail
 : "${DNSMASQ_PID:="/var/run/dnsmasq.pid"}"
 : "${DNSMASQ_CONF_DIR:="/etc/dnsmasq.d"}"
 
+# Sanitize variables
+MAC=$(strip "$MAC")
+MTU=$(strip "$MTU")
+ADAPTER=$(strip "$ADAPTER")
+NETWORK=$(strip "$NETWORK")
+PASST_MTU=$(strip "$PASST_MTU")
+HOST_PORTS=$(strip "$HOST_PORTS")
+USER_PORTS=$(strip "$USER_PORTS")
+
 ADD_ERR="Please add the following setting to your container:"
 
 # ######################################
diff --git a/src/power.sh b/src/power.sh
index 29f54a5..4b4a815 100644
--- a/src/power.sh
+++ b/src/power.sh
@@ -109,6 +109,7 @@ graceful_shutdown() {
   # nc -q 1 -w 1 -U "$QEMU_DIR/monitor.sock" &> /dev/null <<<'system_powerdown' || :
 
   # Send shutdown command to guest agent via serial port
+  API_TIMEOUT=$(strip "$API_TIMEOUT")
   url="http://$API_HOST/read?command=$API_CMD&timeout=$API_TIMEOUT"
   response=$(curl -sk -m "$(( API_TIMEOUT+2 ))" -S "$url" 2>&1)
 
@@ -131,6 +132,7 @@ graceful_shutdown() {
   local term_grace=3      # seconds before loop ends to send SIGTERM
   local cleanup_grace=3   # seconds reserved after the loop for cleanup
 
+  TIMEOUT=$(strip "$TIMEOUT")
   if [[ ! "$TIMEOUT" =~ ^[0-9]+$ ]]; then
     TIMEOUT=115
   fi
diff --git a/src/proc.sh b/src/proc.sh
index c99cc65..79740ba 100644
--- a/src/proc.sh
+++ b/src/proc.sh
@@ -7,6 +7,10 @@ set -Eeuo pipefail
 : "${CPU_FLAGS:=""}"
 : "${CPU_MODEL:=""}"
 
+HOST_CPU=$(strip "$HOST_CPU")
+CPU_FLAGS=$(strip "$CPU_FLAGS")
+CPU_MODEL=$(strip "$CPU_MODEL")
+
 CLOCKSOURCE="tsc"
 [[ "${ARCH,,}" == "arm64" ]] && CLOCKSOURCE="arch_sys_counter"
 CLOCK="/sys/devices/system/clocksource/clocksource0/current_clocksource"
diff --git a/src/reset.sh b/src/reset.sh
index 1a6fd24..f7ce93f 100644
--- a/src/reset.sh
+++ b/src/reset.sh
@@ -21,8 +21,13 @@ enabled "${TRACE:-}" && set -o functrace && trap 'echo "# $BASH_COMMAND" >&2' DE
 : "${DISK_SIZE:="16G"}"    # Initial data disk size
 : "${STORAGE:="/storage"}" # Storage folder location
 
-# Helper variables
+# Sanitize variables
+TZ=$(strip "$TZ")
+STORAGE=$(strip "$STORAGE")
+COUNTRY=$(strip "$COUNTRY")
+DISK_SIZE=$(strip "$DISK_SIZE")
 
+# Helper variables
 ROOTLESS="N"
 PRIVILEGED="N"
 ENGINE="Docker"
@@ -78,7 +83,7 @@ if grep -qi "socket(s)" <<< "$(lscpu)"; then
   [ "$SOCKETS" -lt "1" ] && SOCKETS=1
 fi
 
-CPU_CORES="${CPU_CORES// /}"
+CPU_CORES=$(strip "$CPU_CORES")
 [ -z "$CPU_CORES" ] && CPU_CORES=2
 [[ "${CPU_CORES,,}" == "max" ]] && CPU_CORES="$CORES"
 [[ "${CPU_CORES,,}" == "half" ]] && CPU_CORES=$(( CORES / 2 ))
@@ -132,6 +137,8 @@ RAM_TOTAL=$(free -b | grep -m 1 Mem: | awk '{print $2}')
 
 RAM_SPARE=500000000
 RAM_MINIMUM=136314880
+
+RAM_SIZE=$(strip "$RAM_SIZE")
 RAM_SIZE="${RAM_SIZE// /}"
 [ -z "$RAM_SIZE" ] && RAM_SIZE="2G"
 
diff --git a/src/serial.sh b/src/serial.sh
index ac1e385..5b9cee9 100644
--- a/src/serial.sh
+++ b/src/serial.sh
@@ -5,10 +5,16 @@ set -Eeuo pipefail
 
 : "${HOST_MAC:=""}"
 : "${HOST_DEBUG:=""}"
-: "${HOST_SERIAL:=""}"
 : "${HOST_MODEL:=""}"
+: "${HOST_SERIAL:=""}"
 : "${GUEST_SERIAL:=""}"
 
+# Sanitize variables
+HOST_MAC=$(strip "$HOST_MAC")
+HOST_MODEL=$(strip "$HOST_MODEL")
+HOST_SERIAL=$(strip "$HOST_SERIAL")
+GUEST_SERIAL=$(strip "$GUEST_SERIAL")
+
 if [ -n "$HOST_MAC" ]; then
 
   HOST_MAC="${HOST_MAC//-/:}"
diff --git a/src/server.sh b/src/server.sh
index 0e5a86f..b7de263 100644
--- a/src/server.sh
+++ b/src/server.sh
@@ -6,6 +6,12 @@ set -Eeuo pipefail
 : "${CHR_PORT:="12345"}"   # Character port
 : "${WSD_PORT:="8004"}"    # Websockets port
 
+# Sanitize port variables
+COM_PORT=$(strip "$COM_PORT")
+WEB_PORT=$(strip "$WEB_PORT")
+CHR_PORT=$(strip "$CHR_PORT")
+WSD_PORT=$(strip "$WSD_PORT")
+
 WEB_PID="/run/nginx.pid"
 WSD_PID="$QEMU_DIR/websocketd.pid"