ob_substvars(): Validate variable names

1 files changed, 11 insertions, 0 deletions

diff --git a/lib/control.sh b/lib/control.sh
index 439f52a..5be3fbe 100644
--- a/lib/control.sh
+++ b/lib/control.sh
@@ -273,6 +273,17 @@ ob_substvars()
 		fi
 		old_rhs="${rhs}"
 
+		# Validate the variable name.
+		case "${name}" in *[!A-Za-z0-9-]* | '')
+			_ob_warn_msg 'substvar_invalid' "${name}"
+			# Remove the variable expansion altogether.  We can't
+			# just leave the variable unexpanded, because the
+			# presence of the "${" characters would cause this
+			# parser to loop infinitely.
+			string="${lhs}${rhs}"
+			continue
+		esac
+
 		# Perform the substitution.
 		name="$(echo "${name}" | tr 'a-z-' 'A-Z_')"
 		value="$(eval echo \"\$\{"_OB_SUBSTVAR_${name}"\}\")"