From 5605629c35687b7fec811bc9d60aa76dcf8a3fdf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= <jskarvad@redhat.com>
Date: Tue, 2 Jun 2015 11:59:05 +0200
Subject: [PATCH] variables: escape support and checking for valid characters
 in variable name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

$${VAR} will be rewritten as ${VAR} and not expanded.

Only alphanumeric characters and underscores (those with matches regular
expression \w+$) are allowed in variable name.

Signed-off-by: Jaroslav Škarvada <jskarvad@redhat.com>
---
 tuned/profiles/variables.py | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/tuned/profiles/variables.py b/tuned/profiles/variables.py
index 58919e1..9ff0a84 100644
--- a/tuned/profiles/variables.py
+++ b/tuned/profiles/variables.py
@@ -22,12 +22,20 @@ class Variables():
 			return s
 		return prefix + s
 
+	def _check_var(self, variable):
+		return re.match(r'\w+$',variable)
+
 	def add_variable(self, variable, value):
 		if value is None:
 			return
 		s = str(variable)
+		if not self._check_var(variable):
+			log.error("variable definition '%s' contains unallowed characters" % variable)
+			return
 		v = self.expand(value)
-		self._lookup_re[r'\${' + re.escape(s) + r'}'] = v
+		# variables referenced by ${VAR}, $ can be escaped by two $,
+		# i.e. the following will not expand: $${VAR}
+		self._lookup_re[r'(?<!\$)\${' + re.escape(s) + r'}'] = v
 		self._lookup_env[self._add_env_prefix(s, consts.ENV_PREFIX)] = v
 
 	def add_dict(self, d):
@@ -59,7 +67,8 @@ class Variables():
 	def expand(self, value):
 		if value is None:
 			return None
-		return self._cmd.multiple_re_replace(self._lookup_re, str(value))
+		# expand variables and finally convert all $${VAR} to ${VAR} (unescape)
+		return re.sub(r'\$(\${\w+})', r'\1', self._cmd.multiple_re_replace(self._lookup_re, str(value)))
 
 	def get_env(self):
 		return self._lookup_env