Fix #387: sanity check environment variables before sourcing

This fixes an issue when finding a global environment variable with
spaces in the variable name:

    set COLORTERM=yes

Literally, 'set COLORTERM' was the name of the variable.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

src/conf.c

@@ -545,6 +545,23 @@ static void parse_env(char *line)
 			*end-- = 0;
 	}
 
+	/* strip any leading 'set ' */
+	end = key;
+	if (!strncmp(key, "set", 3))
+		end += 3;
+
+	/* check key, no spaces allowed */
+	while (*end && isspace(*end))
+		end++;
+	key = end;
+	while (*end && !isspace(*end))
+		end++;
+	if (*end != 0) {
+		warnx("'%s=%s': not a valid identifier", key, val);
+		return;	/* invalid key */
+	}
+
+	dbg("Global env '%s'='%s'", key, val);
 	setenv(key, val, 1);
 
 	node = malloc(sizeof(*node));

src/service.c

@@ -471,6 +471,22 @@ static void source_env(svc_t *svc)
 				*end-- = 0;
 		}
 
+		/* strip any leading 'set ' */
+		end = key;
+		if (!strncmp(key, "set", 3))
+			end += 3;
+
+		/* check key, no spaces allowed */
+		while (*end && isspace(*end))
+			end++;
+		key = end;
+		while (*end && !isspace(*end))
+			end++;
+		if (*end != 0) {
+			warnx("'%s=%s': not a valid identifier", key, val);
+			continue;	/* invalid key */
+		}
+
 		switch (wordexp(value, &we, 0)) {
 		case 0:
 			for (i = 0, *val = 0; i < we.we_wordc; i++) {