fix: security fixes - quote variables and declare locals in shell scripts

common/common-create-folder.sh

@@ -42,13 +42,13 @@ common_create_folder()
     [[ "$DEBUG" == true ]] && echo "Creating folder '$LOCAL_FOLDER'"
 
     # Allows 'sudo' to run this function if destination path it's not owned by the current user
-    [[ "$LOCAL_ALLOW_RUN_WITH_SUDO" == true ]] && ! system_check_user_folder_owner ${LOCAL_FOLDER%/*} && LOCAL_RUN_WITH_SUDO=sudo
+    [[ "$LOCAL_ALLOW_RUN_WITH_SUDO" == true ]] && ! system_check_user_folder_owner "${LOCAL_FOLDER%/*}" && LOCAL_RUN_WITH_SUDO=sudo
 
-    $LOCAL_RUN_WITH_SUDO mkdir -p $LOCAL_FOLDER > /dev/null 2>&1
+    $LOCAL_RUN_WITH_SUDO mkdir -p "$LOCAL_FOLDER" > /dev/null 2>&1
 
     [[ ! -d "$LOCAL_FOLDER" ]] && [[ "$LOCAL_STOP_EXECUTION_ON_ERROR" == true ]] && echoerror "The folder '$LOCAL_FOLDER' could not be created. \nCheck folder permissions."
 
-    [[ ! -d "$LOCAL_FOLDER" ]] && COMMON_CREATE_FOLDER_ERROR = true
+    [[ ! -d "$LOCAL_FOLDER" ]] && COMMON_CREATE_FOLDER_ERROR=true
 
     return 0
 }

file/file-delete-local-file.sh

@@ -40,7 +40,7 @@ file_delete_local_file()
     [[ "$DEBUG" == true ]] && echo "Deleting file '$LOCAL_FILE'"
 
     # Checkinf the file (-f) validates if trying to delete a folder
-    [[ -f $LOCAL_FILE ]] && rm -f $LOCAL_FILE
+    [[ -f "$LOCAL_FILE" ]] && rm -f "$LOCAL_FILE"
 
     return 0
 }

file/file-update-file.sh

@@ -51,10 +51,10 @@ file_update_file()
     [[ $LOCAL_TO_STRING == "" || $LOCAL_TO_STRING == null ]] && echoerror "You must inform the required argument(s) to the function: '${FUNCNAME[0]}'"
 
     # Check if file exists | exit if 4th parameter is set to 'true'
-    [[ ! -f $LOCAL_FULL_FILE_PATH ]] && [[ "$LOCAL_STOP_EXECUTION_ON_ERROR" == true ]] && echoerror "We could not find the file '$LOCAL_FULL_FILE_PATH' in your local folder. \n Please inform the correct location and try again (function: ${FUNCNAME[0]})."
+    [[ ! -f "$LOCAL_FULL_FILE_PATH" ]] && [[ "$LOCAL_STOP_EXECUTION_ON_ERROR" == true ]] && echoerror "We could not find the file '$LOCAL_FULL_FILE_PATH' in your local folder. \n Please inform the correct location and try again (function: ${FUNCNAME[0]})."
 
     # Stop execution and return error if "$LOCAL_STOP_EXECUTION_ON_ERROR" is false
-    if [[ ! -f $LOCAL_FULL_FILE_PATH ]]; then
+    if [[ ! -f "$LOCAL_FULL_FILE_PATH" ]]; then
         echoerror "We could not find the file '$LOCAL_FULL_FILE_PATH' in your local folder. \n Please inform the correct location and try again (function: ${FUNCNAME[0]})." false
         FILE_UPDATE_FILE_ERROR=true
         return 0
@@ -64,15 +64,19 @@ file_update_file()
     [[ "$DEBUG" == true ]] && echoline "Replace '$LOCAL_FROM_STRING' to '$LOCAL_TO_STRING' in '$LOCAL_FULL_FILE_PATH'."
 
     # Allows 'sudo' to run this function if destination path it's not owned by the current user
-    [[ "$LOCAL_ALLOW_RUN_WITH_SUDO" == true ]] && ! system_check_user_folder_owner ${LOCAL_FULL_FILE_PATH%/*} && LOCAL_RUN_WITH_SUDO=sudo
+    [[ "$LOCAL_ALLOW_RUN_WITH_SUDO" == true ]] && ! system_check_user_folder_owner "${LOCAL_FULL_FILE_PATH%/*}" && LOCAL_RUN_WITH_SUDO=sudo
 
-    cd $(dirname $LOCAL_FULL_FILE_PATH) >/dev/null 2>&1
+    local LOCAL_FROM_ESCAPED LOCAL_TO_ESCAPED
+    LOCAL_FROM_ESCAPED=$(printf '%s\n' "$LOCAL_FROM_STRING" | sed 's/[[\.*^$()+?{|]/\\&/g')
+    LOCAL_TO_ESCAPED=$(printf '%s\n' "$LOCAL_TO_STRING" | sed 's/[/&]/\\&/g')
+
+    cd "$(dirname "$LOCAL_FULL_FILE_PATH")" >/dev/null 2>&1
     if [[ "$LOCAL_UPDATE_VARIABLE_VALUE" == true ]]; then
         # To remove dots (.) use the line below
-#        $LOCAL_RUN_WITH_SUDO sed -i "/$LOCAL_FROM_STRING=/c\\$LOCAL_FROM_STRING=${LOCAL_TO_STRING//.}" $LOCAL_FULL_FILE_PATH
-        $LOCAL_RUN_WITH_SUDO sed -i "/$LOCAL_FROM_STRING=/c\\$LOCAL_FROM_STRING=$LOCAL_TO_STRING" $LOCAL_FULL_FILE_PATH
+#        $LOCAL_RUN_WITH_SUDO sed -i "/$LOCAL_FROM_ESCAPED=/c\\$LOCAL_FROM_ESCAPED=${LOCAL_TO_ESCAPED//.}" $LOCAL_FULL_FILE_PATH
+        $LOCAL_RUN_WITH_SUDO sed -i "/$LOCAL_FROM_ESCAPED=/c\\$LOCAL_FROM_ESCAPED=$LOCAL_TO_ESCAPED" "$LOCAL_FULL_FILE_PATH"
     else
-        $LOCAL_RUN_WITH_SUDO sed -i -e "s/$LOCAL_FROM_STRING/$LOCAL_TO_STRING/g" $LOCAL_FULL_FILE_PATH
+        $LOCAL_RUN_WITH_SUDO sed -i -e "s/$LOCAL_FROM_ESCAPED/$LOCAL_TO_ESCAPED/g" "$LOCAL_FULL_FILE_PATH"
     fi
     cd - > /dev/null 2>&1
 }

system/system-safe-delete-folder.sh

@@ -40,7 +40,7 @@
 # ----------------------------------------------------------------------
 system_safe_delete_folder()
 {
-    local LOCAL_SAFE_DELETE_FOLDER LOCAL_ALLOWED_DELETE_BASE_PATH LOCAL_SAFE_DELETE_FOLDER_BASE_PATH
+    local LOCAL_SAFE_DELETE_FOLDER LOCAL_ALLOWED_DELETE_BASE_PATH LOCAL_SAFE_DELETE_FOLDER_BASE_PATH DELETE_USING_SUDO SKIP_ALL_VALIDATION
 
     LOCAL_SAFE_DELETE_FOLDER=${1%/}
     LOCAL_ALLOWED_DELETE_BASE_PATH=${2:-server}
@@ -63,9 +63,9 @@ system_safe_delete_folder()
     [[ "$DEBUG" == true ]] && echowarning "Deleting folder '$LOCAL_SAFE_DELETE_FOLDER'"
 
     if [[ "$DELETE_USING_SUDO" == true ]]; then
-        sudo rm -rf $LOCAL_SAFE_DELETE_FOLDER
+        sudo rm -rf "$LOCAL_SAFE_DELETE_FOLDER"
     else
-        rm -rf $LOCAL_SAFE_DELETE_FOLDER
+        rm -rf "$LOCAL_SAFE_DELETE_FOLDER"
     fi
 
     return 0