DOS/DDOS attack in pacapt

[cuonglm]

Forgetting quote variables in shell script leading to many security implications. I took a look at pacapt source code and saw one issue. Currently, if you run:

PACAPT_DEBUG='/*/*/*/*/../../../../*/*/*/*/../../../../*/*/*/*' ./pacapt.dev --help

then it push server to heavy load, even if mightiest servers. Imaging some commands like this ran and what will happen?

The issue came from lib/zz_main.sh, line 17:

: ${PACAPT_DEBUG=}

: is the no-op command, but PACAPT_DEBUG still be expanded. And because it's unquoted, split and glob were invoked.

I have made a pull request to fix this, you can look here

[icy]

Fixed in #39