{"action":"created","issue":{"url":"https://api.github.com/repos/rcaloras/bashhub-client/issues/11","labels_url":"https://api.github.com/repos/rcaloras/bashhub-client/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/rcaloras/bashhub-client/issues/11/comments","events_url":"https://api.github.com/repos/rcaloras/bashhub-client/issues/11/events","html_url":"https://github.com/rcaloras/bashhub-client/pull/11","id":120952619,"number":11,"title":"Fix missing double quotes shell variables","user":{"login":"Gnouc","id":4304764,"avatar_url":"https://avatars.githubusercontent.com/u/4304764?v=3","gravatar_id":"","url":"https://api.github.com/users/Gnouc","html_url":"https://github.com/Gnouc","followers_url":"https://api.github.com/users/Gnouc/followers","following_url":"https://api.github.com/users/Gnouc/following{/other_user}","gists_url":"https://api.github.com/users/Gnouc/gists{/gist_id}","starred_url":"https://api.github.com/users/Gnouc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gnouc/subscriptions","organizations_url":"https://api.github.com/users/Gnouc/orgs","repos_url":"https://api.github.com/users/Gnouc/repos","events_url":"https://api.github.com/users/Gnouc/events{/privacy}","received_events_url":"https://api.github.com/users/Gnouc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-08T07:45:27Z","updated_at":"2015-12-08T08:06:42Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rcaloras/bashhub-client/pulls/11","html_url":"https://github.com/rcaloras/bashhub-client/pull/11","diff_url":"https://github.com/rcaloras/bashhub-client/pull/11.diff","patch_url":"https://github.com/rcaloras/bashhub-client/pull/11.patch"},"body":"Missing double quotes shell variable in scalar context can lead to many security implication.\r\n\r\nIn `bashhub.sh`, bashhub got the `BH_DEPS_DIRECTORY` from shell environment:\r\n```\r\nBH_DEPS_DIRECTORY=${BH_DEPS_DIRECTORY:=$BH_HOME_DIRECTORY/deps}\r\n```\r\n\r\nThen many places use it without double quote. At least it made the user can not use directory with space in name as `BH_DEPS_DIRECTORY`.\r\n\r\nA more dangerous example:\r\n```\r\n$ cp -r .bashhub/deps /tmp/'dir with space'\r\n$ echo 'echo QWERT' > /tmp/dir\r\n```\r\nNow if user set:\r\n```\r\nexport BH_DEPS_DIRECTORY=/tmp/dir\\ with\\ space/\r\n### Bashhub.com Installation.\r\n### This Should be at the EOF. https://bashhub.com/docs\r\nif [ -f ~/.bashhub/bashhub.sh ]; then\r\n    source ~/.bashhub/bashhub.sh\r\nfi\r\n```\r\n\r\nAnyone in system can made the user `source` the file they want by creating file named `/tmp/dir`."},"comment":{"url":"https://api.github.com/repos/rcaloras/bashhub-client/issues/comments/162808666","html_url":"https://github.com/rcaloras/bashhub-client/pull/11#issuecomment-162808666","issue_url":"https://api.github.com/repos/rcaloras/bashhub-client/issues/11","id":162808666,"user":{"login":"rcaloras","id":149818,"avatar_url":"https://avatars.githubusercontent.com/u/149818?v=3","gravatar_id":"","url":"https://api.github.com/users/rcaloras","html_url":"https://github.com/rcaloras","followers_url":"https://api.github.com/users/rcaloras/followers","following_url":"https://api.github.com/users/rcaloras/following{/other_user}","gists_url":"https://api.github.com/users/rcaloras/gists{/gist_id}","starred_url":"https://api.github.com/users/rcaloras/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rcaloras/subscriptions","organizations_url":"https://api.github.com/users/rcaloras/orgs","repos_url":"https://api.github.com/users/rcaloras/repos","events_url":"https://api.github.com/users/rcaloras/events{/privacy}","received_events_url":"https://api.github.com/users/rcaloras/received_events","type":"User","site_admin":false},"created_at":"2015-12-08T08:06:42Z","updated_at":"2015-12-08T08:06:42Z","body":"@Gnouc Thanks for the PR! LGTM :+1:"}}