fix(nginx,mongodb): quote heredocs to prevent bash $VAR expansion under set -u

Two distinct bugs, same root cause: the rendered scripts run with
'set -euo pipefail', but the generator used unquoted heredoc delimiters
(<<CONF_EOF) for config files. Bash expands $vars inside unquoted heredocs;
with 'set -u' any undefined variable aborts the heredoc, and because the
heredoc sits inside 'cat > FILE <<TAG ... TAG', the file gets opened
(truncated to zero bytes) but never written.

1) nginx generator (generators/middleware.py)
   - The HTTPS server block ended with '}}\n' instead of '}\n', causing
     'nginx -t' to fail with 'unexpected "}"'.
   - Both server confs (HTTP + HTTPS) wrote $uri / $host / $scheme /
     $request_uri / $proxy_add_x_forwarded_for / $remote_addr into
     unquoted heredocs. With set -u the heredoc for harbor.yunwei.blog.conf
     aborted on $scheme (and similar), leaving the file empty.

   Fix: change both heredoc delimiters to <<'CONF_EOF' (quoted), and
   remove the trailing extra '}'. Also strip the unnecessary Python
   f-string '{{' / '}}' escapes that produced '}' in the output.

2) mongodb repo (generators/runtimes.py)
   - The yum repo file used <<REPO_EOF (unquoted) with a body containing
     '$releasever'. $releasever is yum's own variable, not bash's;
     bash expanded it to '' under set -u and left the URL broken.
     Wireguard/openvpn heredocs DO use $(...) command substitution
     intentionally (to inline keys), so those stay unquoted.

   Fix: change delimiter to <<'REPO_EOF'.

Verified:
  - Rendered nginx.sh for harbor.yunwei.blog (proxy + SSL on port 78/443)
    produces conf files with correct nginx syntax. Real 'nginx -t' on a
    minimal test config passes (configuration syntax is ok / test is
    successful).
  - Audit of all 50 generators with default params shows zero $VAR
    references inside unquoted heredocs (only intentional $(...) cmds).
  - All 50 generators still pass 'bash -n'.
This commit is contained in:
Your Name
2026-08-07 13:36:06 +08:00
parent e854137681
commit 1a328864f5
2 changed files with 12 additions and 8 deletions
+1 -1
View File
@@ -689,7 +689,7 @@ class MongoDB(Generator):
' PKG_INSTALL mongodb-org\n'
' ;;\n'
' yum|dnf)\n'
' cat > /etc/yum.repos.d/mongodb-org-' + ver + '.repo <<REPO_EOF\n'
' cat > /etc/yum.repos.d/mongodb-org-' + ver + '.repo <<\'REPO_EOF\'\n'
'[mongodb-org-' + ver + ']\n'
'name=MongoDB Repository\n'
'baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/' + ver + '/x86_64/\n'