@@ -630,25 +630,31 @@ shellspec_list_envkeys_parse() {
630630 shellspec_list_envkeys_callback " ${1%% [=]* } "
631631}
632632
633- # Sanitize to reduce security risk when environment variable name
633+ # Sanitize to avoid security risk when environment variable name
634634# contains meta characters
635635#
636636# e.g.
637637# $ env 'FOO; echo bad; # =aaa' ksh -c 'export -p | grep FOO'
638638# export FOO; echo bad; # =aaa
639639shellspec_list_envkeys_sanitize () {
640- set -- " $1 " " $2 ;" " "
641- while [ " $2 " ]; do
642- set -- " $1 " " ${2#* [;!#~<>[*?&]} " " ${3}${2%% [;!#~<>[*?&]* } _"
643- done
644- eval " $1 =\$ {3%_}"
640+ eval " $1 =\$ 2"
641+ shellspec_replace_all " $1 " ' !' ' _'
642+ shellspec_replace_all " $1 " ' #' ' _'
643+ shellspec_replace_all " $1 " ' &' ' _'
645644 shellspec_replace_all " $1 " ' (' ' _'
646645 shellspec_replace_all " $1 " ' )' ' _'
647- shellspec_replace_all " $1 " ' `' ' _'
648- shellspec_replace_all " $1 " ' |' ' _'
646+ shellspec_replace_all " $1 " ' *' ' _'
647+ shellspec_replace_all " $1 " ' ;' ' _'
648+ shellspec_replace_all " $1 " ' <' ' _'
649+ shellspec_replace_all " $1 " ' >' ' _'
650+ shellspec_replace_all " $1 " ' ?' ' _'
651+ shellspec_replace_all " $1 " ' [' ' _'
649652 shellspec_replace_all " $1 " ' ]' ' _'
653+ shellspec_replace_all " $1 " ' `' ' _'
650654 shellspec_replace_all " $1 " ' {' ' _'
655+ shellspec_replace_all " $1 " ' |' ' _'
651656 shellspec_replace_all " $1 " ' }' ' _'
657+ shellspec_replace_all " $1 " ' ~' ' _'
652658}
653659
654660shellspec_exists_envkey () {
0 commit comments