From 5e57887c3932ddfd951990806f6861bb5fa96805 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Thu, 28 Apr 2022 18:52:21 +0100
Subject: [PATCH] Harden sourcing vars and warn for potential problems

In 'org' mode, fields such as EASYRSA_REQ_ORG can be abused.

If the field contains single quote ('), ampersand (&), back-tick (`),
dollar sign ($) or hash (#) then the result is undefined.

Due to EasyRSA running on Linux and Windows and supporting multiple
SSL Libraries, it is not feasible to support these characters.

Add a check to determine if any unsupported characters are found in
the vars file and issue a warning if they are found.

Add a sub-shell test to source vars.  If the test fails then exit
gracefully, with a specific error message.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa      | 15 ++++++++++-----
 easyrsa3/vars.example |  9 +++++++++
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index e137012..0cd115d 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -2499,18 +2499,23 @@ recommended - please remove it from there before continuing."
 				# Sanitize vars further but ONLY if it is in PKI folder
 				if [ "$pki_vars" ]; then
 					# Warning: Single quote
-					if grep -q "'" "$vars"; then
+					if grep '^[[:blank:]]*set_var[[:blank:]]\+.*' "$vars" | \
+						grep -q -e '&' -e "'" -e '`' -e '\$' -e '#' ; then
 						warn "\
-Single quote (') has been found in the configuration file.
-This character is not supported in the configuration file.
-Sourcing the vars file will probably fail .."
+Unsupported  characters are present in the vars file.
+These characters are not supported: (') (&) (\`) (\$) (#)
+Sourcing the vars file and building certificates will probably fail .."
 					fi
 				fi
 
 				# shellcheck disable=SC2034 # EASYRSA_CALLER appears unused.
 				EASYRSA_CALLER=1
 				# shellcheck disable=1090 # can't follow non-constant source. vars
-				. "$vars"
+				( . "$vars" 2>/dev/null ) || die "\
+Failed to source the vars file, remove any unsupported characters."
+
+				# shellcheck disable=1090 # can't follow non-constant source. vars
+				. "$vars" 2>/dev/null
 				notice "Using Easy-RSA configuration from: $vars"
 				[ "$pki_vars" ] || \
 					warn "Move your vars file to your PKI folder, where it is safe!"
diff --git a/easyrsa3/vars.example b/easyrsa3/vars.example
index 61d79f5..3fd4245 100644
--- a/easyrsa3/vars.example
+++ b/easyrsa3/vars.example
@@ -92,6 +92,15 @@ fi
 # you may omit any specific field by typing the "." symbol (not valid for
 # email.)
 
+# NOTE: The following characters are not supported
+#       in these "Organizational fields" by Easy-RSA:
+#       single quote (')
+#       back-tick (`)
+#       hash (#)
+#       ampersand (&)
+#       dollar sign ($)
+# Use them at your own risk!
+
 #set_var EASYRSA_REQ_COUNTRY	"US"
 #set_var EASYRSA_REQ_PROVINCE	"California"
 #set_var EASYRSA_REQ_CITY	"San Francisco"