Loading untrusted configurations variable

Question

I am working on a bash prompt project which acts upon different states in the directory you are currently in.

What I need now is a way to load a mini configuration from the current directory, which is easily done with . .params.conf, except that this method is extremely unsecure, as anyone with write access to the directory you are in can create and execute command as you when you stumble upon a directory with a .params.conf file in it.

What is the best way of loading variables from a file like this? The variables is going to be mostly in a true/false state, so I am not parsing them in any way so it can be executed.

Possible solutions:

• A loop, loading each predefined variable is a possible, but I want to keep the code in a readable fashion.

• Put the whole file in an bash array would be the best solution, but how can I populate a key/value dict in bash like this?

• If bash can source a file only loading the variables..

I dont know how the format of the params.conf file will look like yet. But I think the easiest would be one line for each param, separated by space. Like one of this on each line: key value that can have space in it.

Answer 1

eval can be very insecure and can still execute malicious code. It's better to use declare:

while read varname value
do
    declare "$varname=$value"
done < .params.conf