From 528b82c60d6d41531043b9f72f9bafdaed1451ef Mon Sep 17 00:00:00 2001
From: Kroese <kroese@users.noreply.github.com>
Date: Thu, 6 Aug 2026 12:53:33 +0200
Subject: [PATCH] fix: Prevent pathname expansion in edition matching (#2074)

---
 src/image.sh | 119 +++++++++++++++++++++++++--------------------------
 1 file changed, 59 insertions(+), 60 deletions(-)

diff --git a/src/image.sh b/src/image.sh
index 04ea0483..c62b7d2f 100644
--- a/src/image.sh
+++ b/src/image.sh
@@ -167,19 +167,53 @@ getVersions() {
   return 0
 }
 
-getCompatibleVersions() {
+getVersionPriority() {
 
-  local wanted="$1"
+  local id="${1,,}"
+  local base="${2,,}"
 
-  printf '%s\n' "$wanted"
+  local entry priority patterns pattern
+  local result="other" score best_score=-1
+  local -a order=() pattern_list=()
 
-  # Treat normal and Evaluation variants of the same edition as compatible.
-  # The exact requested variant is always checked first.
-  if [[ "${wanted,,}" == *"-eval" ]]; then
-    printf '%s\n' "${wanted%-eval}"
-  else
-    printf '%s\n' "$wanted-eval"
-  fi
+  id="${id%-eval}"
+
+  mapfile -t order < <(getEditionOrder "$base")
+
+  local edition="${id#"$base"}"
+  edition="${edition#-}"
+
+  # Use the most specific matching pattern. This prevents broad patterns
+  # such as enterprise-* from taking precedence over enterprise-iot-*.
+  for entry in "${order[@]}"; do
+    IFS='|' read -r _ priority patterns <<< "$entry"
+    read -r -a pattern_list <<< "$patterns"
+    for pattern in "${pattern_list[@]}"; do
+
+      if [ "$pattern" = "@default" ]; then
+        [ -z "$edition" ] || continue
+        score=1
+      elif [[ "$pattern" == *"*" ]]; then
+        local prefix="${pattern%\*}"
+        [[ "$edition" == "$prefix"* ]] || continue
+        score="${#pattern}"
+      elif [ "$edition" = "$pattern" ]; then
+        score="${#pattern}"
+      else
+        continue
+      fi
+
+      if (( score > best_score )); then
+        result="$priority"
+        best_score="$score"
+      fi
+
+    done
+
+  done
+
+  echo "$result"
+  return 0
 }
 
 selectVersion() {
@@ -224,6 +258,21 @@ selectVersion() {
   return 1
 }
 
+getCompatibleVersions() {
+
+  local wanted="$1"
+
+  printf '%s\n' "$wanted"
+
+  # Treat normal and Evaluation variants of the same edition as compatible.
+  # The exact requested variant is always checked first.
+  if [[ "${wanted,,}" == *"-eval" ]]; then
+    printf '%s\n' "${wanted%-eval}"
+  else
+    printf '%s\n' "$wanted-eval"
+  fi
+}
+
 selectEdition() {
 
   local versions_name="$1"
@@ -351,56 +400,6 @@ detectVersion() {
   return 0
 }
 
-getVersionPriority() {
-
-  local id="${1,,}"
-  local base="${2,,}"
-
-  local entry priority patterns pattern
-  local result="other" score best_score=-1
-  local -a order=()
-
-  id="${id%-eval}"
-
-  mapfile -t order < <(getEditionOrder "$base")
-
-  local edition="${id#"$base"}"
-  edition="${edition#-}"
-
-  # Use the most specific matching pattern. This prevents broad patterns
-  # such as enterprise-* from taking precedence over enterprise-iot-*.
-  for entry in "${order[@]}"; do
-
-    IFS='|' read -r _ priority patterns <<< "$entry"
-
-    for pattern in $patterns; do
-
-      if [ "$pattern" = "@default" ]; then
-        [ -z "$edition" ] || continue
-        score=1
-      elif [[ "$pattern" == *"*" ]]; then
-        local prefix="${pattern%\*}"
-        [[ "$edition" == "$prefix"* ]] || continue
-        score="${#pattern}"
-      elif [ "$edition" = "$pattern" ]; then
-        score="${#pattern}"
-      else
-        continue
-      fi
-
-      if (( score > best_score )); then
-        result="$priority"
-        best_score="$score"
-      fi
-
-    done
-
-  done
-
-  echo "$result"
-  return 0
-}
-
 detectLanguage() {
 
   local xml="$1"