Patch 0003

From 5aae118f356cba94531aa0d730cd7cc7f3f2687d Mon Sep 17 00:00:00 2001
From: "Jory A. Pratt" <geekypenguin@gmail.com>
Date: Thu, 2 Jul 2026 07:25:52 -0500
Subject: [PATCH 3/7] security: parse weather cache without sourcing it.

Load current.env through asl3-ini.sh so malicious API values cannot
execute shell code when displaying cached weather data.
---
 bin/show_weatherapi.sh | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/bin/show_weatherapi.sh b/bin/show_weatherapi.sh
index b5b9956..7cd33a0 100755
--- a/bin/show_weatherapi.sh
+++ b/bin/show_weatherapi.sh
@@ -1,11 +1,23 @@
 #!/usr/bin/env bash
 set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=bin/asl3-ini.sh
+source "$SCRIPT_DIR/asl3-ini.sh"
+
 CONFIG_FILE="/etc/asterisk/local/weatherapi.ini"
-[ -f "$CONFIG_FILE" ] && source "$CONFIG_FILE"
-CACHE_DIR="${CACHE_DIR:-/var/cache/asl3-saytime-weather}"
+CACHE_DIR="/var/cache/asl3-saytime-weather"
+
+if [ -f "$CONFIG_FILE" ]; then
+  CACHE_DIR="$(asl3_ini_get "$CONFIG_FILE" CACHE_DIR)"
+  CACHE_DIR="${CACHE_DIR:-/var/cache/asl3-saytime-weather}"
+fi
+
 ENV_FILE="$CACHE_DIR/current.env"
 [ -f "$ENV_FILE" ] || { echo "No weather cache found. Run: sudo /usr/local/sbin/asl3-weatherapi-update.sh"; exit 1; }
-source "$ENV_FILE"
+
+asl3_ini_load "$ENV_FILE"
+
 echo "Location: ${LOCATION_NAME:-unknown} ${REGION:-} ${COUNTRY:-}"
 echo "Condition: ${CONDITION:-unknown}"
 echo "Temperature: ${TEMP_F:-?} F / ${TEMP_C:-?} C"
-- 
2.47.3