firefox-db2pem: avoid use of eval in script

This could potentially be exploited by manipulating nicknames in the
cert DB.

Reported-by: behindtheblackwall on hackerone
Closes #17766

diff --git a/scripts/firefox-db2pem.sh b/scripts/firefox-db2pem.sh
index 57252b40578e9da4de356e9bf42fbb3eaf62babc..2a4b9ceace16c263a0ba6e4be6d14bd474d74e93 100755 (executable)
--- a/scripts/firefox-db2pem.sh
+++ b/scripts/firefox-db2pem.sh
@@ -57,5 +57,5 @@ sed -e 's/ *[CcGTPpu]*,[CcGTPpu]*,[CcGTPpu]* *$//' -e 's/\(.*\)/"\1"/' | \
 sort | \
 while read -r nickname; \
  do echo "$nickname" | sed -e "s/Builtin Object Token://g"; \
-eval certutil -d "$db" -L -n "$nickname" -a ; \
+ echo "$nickname" | xargs -I{} certutil -d "$db" -L -a -n {} ; \
 done >> "$out"