stornic56/debianito-post-install
1
0
Fork 0
mirror of https://github.com/stornic56/debianito-post-install.git synced 2026-10-31 13:08:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Security Patches & Architecture Refactoring

Browse Source 
- Extracted hardware detection logic from firmware.sh into new modules/hw_detect.sh. Declares shared arrays (PCI_NET_DEVS, USB_WIFI_DEVS, etc) and _detect_all_network_devices() function. The main script now sources hw_detect.sh immediately after utils.sh. firmware.sh retains only _DETECTED_FW_PKGS and _FW_PLAN_PKG_LINES plus installation logic — the detection loop is fully removed, eliminating the circular dependency with bluetooth.sh.
- Fixed interrupt safety in main script: removed pkill -f "apt.*install" and pkill -f "dpkg.*configure" from _on_interrupt(); updated exit message to "Temp files cleaned." Only the signal handler (trap _on_interrupt INT TERM) remains.
- Added strict URL validation to modules/gaming/heroic.sh and modules/gaming/tools.sh using regex ^https://[A-Za-z0-9./_-]+\.deb$ before passing $deb_url to _run_cmd. Blocks command substitution, non-https URLs, and path traversal attempts that could bypass shell quoting.
- Implemented real Bullseye Archive rewrite in modules/bullseye/legacy.sh: adds idempotency check (grep -q archive.debian.org && return 0), creates timestamped backup of /etc/apt/sources.list with sudo cp, writes exact archive Debian sources via sudo tee heredoc, and runs sudo apt-get update || true on failure.
- Added local scope to modules/bluetooth.sh variable service_enable_only=false before the conditional assignment, preventing state bleed from the previous global-only declaration.
- Applied safe array pattern (while IFS= read -r _pkg; do ...) across 32+ files in modules/extras/* and modules/bullseye/legacy.sh, replacing all vulnerable for pkg in $cleaned / for pkg in $install_list loops. Eliminates word-splitting and command-injection risks.
This commit is contained in:
stornic56
2026-10-03 00:04:30 -05:00
committed by GitHub
parent ab665d0bc8
commit 454207209a
29 changed files with 331 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/bullseye/extras.sh
+78 -13
View File
@@ -96,7 +96,12 @@ _cat_themes_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
! is_installed "$pkg" && _run_install "$pkg" || echo "$pkg already installed."
done
echo -e "${GREEN}Desktop themes installed.${NC}"
@@ -123,7 +128,12 @@ _cat_icons_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
! is_installed "$pkg" && _run_install "$pkg" || echo "$pkg already installed."
done
echo -e "${GREEN}Icon themes installed.${NC}"
@@ -145,7 +155,12 @@ _cat_cursors_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
! is_installed "$pkg" && _run_install "$pkg" || echo "$pkg already installed."
done
echo -e "${GREEN}Cursor themes installed.${NC}"
@@ -166,7 +181,12 @@ _cat_fonts_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
! is_installed "$pkg" && _run_install "$pkg" || echo "$pkg already installed."
done
echo -e "${GREEN}Fonts installed.${NC}"
@@ -206,7 +226,12 @@ _cat_download_bullseye() {
return
}
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
if ! is_installed "$pkg"; then
_run_install "$pkg"
else
@@ -238,7 +263,12 @@ _cat_internet_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
case $pkg in
w3m)
local need=()
@@ -273,7 +303,12 @@ _cat_players_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
if ! is_installed "$pkg"; then
_run_install "$pkg"
else
@@ -307,7 +342,12 @@ _cat_design_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
if ! is_installed "$pkg"; then
_run_install "$pkg"
else
@@ -337,7 +377,12 @@ _cat_programming_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
if ! is_installed "$pkg"; then
_run_install "$pkg"
else
@@ -372,7 +417,12 @@ _cat_dev_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
case $pkg in
docker)
local need=()
@@ -429,7 +479,12 @@ _cat_security_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
case $pkg in
clamav)
_install_clamav
@@ -479,7 +534,12 @@ _cat_general_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
case $pkg in
compress)
local need=()
@@ -571,7 +631,12 @@ _cat_fetch_bullseye() {
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
# BH-004: Convert to array to avoid word splitting and injection.
local -a _pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && _pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for pkg in "${_pkgs[@]}"; do
if ! is_installed "$pkg"; then
_run_install "$pkg"
else