MDEV-39413 wsrep unsafe handling of parameters

introduce safe() wrapper for parameters that can later be interpolated into command line. Use as - var="foo$BAR" + var="foo$(safe BAR)" A parameter is safe, if it contains no spaces, single quotes or backticks
2026-10-23 18:49:29 +03:00 · 2026-04-22 22:21:23 +02:00
parent 12bb87f4a9
commit 3e3c5d72c8
7 changed files with 236 additions and 173 deletions
--- a/mysql-test/lib/generate-ssl-certs.sh
+++ b/mysql-test/lib/generate-ssl-certs.sh
@@ -27,8 +27,8 @@ openssl rsa -in server-key.pem -out server-key.pem
 # sign the server certificate with CA certificate
 openssl ca -keyfile cakey.pem -days 7300 -batch -cert cacert.pem -policy policy_anything -out server-cert.pem -in demoCA/server-req.pem

-# server certificate with different validity period (MDEV-7598)
-openssl req -newkey rsa:4096 -keyout server-new-key.pem -out demoCA/server-new-req.pem -days 7301 -nodes -subj '/CN=server-new/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB'
+# server certificate with different validity period (MDEV-7598) and unsafe for shell interpolation (MDEV-39413)
+openssl req -newkey rsa:4096 -keyout server-new-key.pem -out demoCA/server-new-req.pem -days 7301 -nodes -subj /CN="'\`touch A\`'"'-"`touch B`"/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB'
 openssl rsa -in server-new-key.pem -out server-new-key.pem
 openssl ca -keyfile cakey.pem -days 7301 -batch -cert cacert.pem -policy policy_anything -out server-new-cert.pem -in demoCA/server-new-req.pem

--- a/mysql-test/std_data/server-new-cert.pem
+++ b/mysql-test/std_data/server-new-cert.pem
@@ -1,123 +1,120 @@
 Certificate:
    Data:
        Version: 3 (0x2)
-        Serial Number: 2 (0x2)
+        Serial Number: 3 (0x3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=cacert, C=FI, ST=Helsinki, L=Helsinki, O=MariaDB
        Validity
-            Not Before: Mar  3 03:03:03 2020 GMT
-            Not After : Feb 28 03:03:03 2040 GMT
-        Subject: C=FI, ST=Helsinki, L=Helsinki, O=MariaDB, CN=server-new
+            Not Before: Apr 22 18:06:08 2026 GMT
+            Not After : Apr 18 18:06:08 2046 GMT
+        Subject: C=FI, ST=Helsinki, L=Helsinki, O=MariaDB, CN='`touch A`'-"`touch B`"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
-                RSA Public-Key: (4096 bit)
+                Public-Key: (4096 bit)
                Modulus:
-                    00:bb:a2:d6:cc:2d:ff:d1:91:03:41:0a:d9:e8:78:
-                    cd:f7:6c:b7:8a:b0:37:e7:a2:79:c3:4e:08:da:f2:
-                    ec:bd:ba:83:e8:e9:3d:56:56:8e:d3:b8:d7:f2:b4:
-                    95:99:39:26:a5:b2:92:b0:09:5d:42:ee:61:06:45:
-                    9c:e6:c6:f4:7a:ee:45:5f:bb:4b:29:1d:f2:1d:4b:
-                    64:16:ca:c3:0c:58:95:1a:db:d4:54:f4:2d:d7:84:
-                    76:69:75:cc:b1:a4:0b:4c:83:d5:ba:9f:f5:d0:d7:
-                    58:b9:ed:35:da:b5:d1:88:1e:85:db:94:b7:2b:f3:
-                    b7:a1:85:73:dc:92:b8:bb:80:79:85:e2:7e:d6:f6:
-                    bb:72:fe:8c:65:64:35:99:8a:d9:74:c6:86:ef:ad:
-                    61:cb:50:ff:1c:44:72:a0:42:c6:8f:19:60:ab:8f:
-                    00:3b:6f:94:ae:be:88:70:72:61:80:4d:68:4f:c6:
-                    54:9c:d6:a4:e3:85:a8:51:4f:76:dc:b1:5b:4b:c2:
-                    ac:07:ec:12:4d:c8:ba:c7:b0:80:ef:57:00:75:4f:
-                    b0:fa:c2:a1:70:4d:0d:75:c6:a9:3d:b8:1f:5b:fd:
-                    0c:34:84:5c:4f:10:35:62:90:7b:d5:6b:b7:78:cd:
-                    54:e2:13:ba:9f:81:c2:f1:84:e3:74:b3:27:46:4a:
-                    ef:48:59:75:58:53:a9:92:e0:c8:3e:44:86:72:f0:
-                    67:64:1a:72:db:33:68:bb:51:a4:39:9c:30:f4:38:
-                    9f:c1:74:ab:57:6b:99:3b:e7:19:34:96:44:2b:f3:
-                    7b:58:82:b7:eb:eb:74:5a:66:8e:be:68:2b:71:85:
-                    01:b4:d5:0d:e0:1e:17:5f:e1:12:72:f3:71:d8:41:
-                    9a:4e:be:a4:2c:bb:80:48:e9:2d:74:1e:57:12:d0:
-                    90:c2:66:2d:1c:d1:7c:c7:e0:5d:7f:a0:a7:46:fb:
-                    31:a7:37:c7:19:22:4f:f6:7f:8d:b8:d4:9b:f7:b1:
-                    fa:6f:77:68:b2:e2:a1:e4:05:e9:22:79:09:f0:59:
-                    21:c0:49:0e:1c:31:0e:3d:f4:1d:4e:d5:51:8f:e4:
-                    40:66:a6:a0:63:0c:dc:66:5b:08:d6:6c:ee:2b:08:
-                    7f:1e:a8:ac:10:69:8f:78:49:5e:8e:20:f1:81:c8:
-                    b2:6a:36:4a:43:e2:0f:47:7b:8f:ba:06:52:2a:2d:
-                    05:c0:03:f7:11:ed:ed:c1:e8:48:9c:3f:c1:cf:2c:
-                    88:c8:57:de:81:e3:59:2e:db:51:6e:23:0d:7e:a8:
-                    75:a4:6d:cd:9e:56:7f:19:f9:43:ee:2b:3a:dd:c5:
-                    af:e9:1a:3e:1d:dc:57:a3:dd:56:14:ed:ff:33:40:
-                    0f:c3:e9
+                    00:b0:bd:aa:b2:7b:3a:b8:98:2b:48:36:c0:f2:c9:
+                    90:b1:88:39:1d:58:e3:0b:1c:b3:73:ae:8c:b1:db:
+                    9b:93:40:d8:4e:2a:bb:3c:65:a5:02:78:fd:1d:04:
+                    24:c6:8b:b6:5e:21:13:bb:cf:20:5c:d6:d2:fb:3b:
+                    2b:03:cc:4d:e7:e6:06:8c:2f:10:9c:d2:77:af:1c:
+                    1d:d3:d0:02:88:f0:17:3f:79:4c:bf:c6:95:63:05:
+                    04:02:1d:a2:ba:eb:e8:6a:e4:8b:80:48:b4:28:8d:
+                    ed:46:28:79:87:e3:58:42:65:3f:20:14:c9:16:93:
+                    9d:14:86:b3:4e:b5:30:98:9d:83:00:a1:30:56:38:
+                    1d:67:f3:ff:3e:39:d9:c4:30:0a:4b:b1:6d:a1:17:
+                    0b:9e:a0:0b:c2:16:fd:7f:72:ba:f9:3c:00:58:87:
+                    8d:3c:16:a6:1e:00:ae:33:9c:aa:a2:d7:37:c7:1c:
+                    66:2a:c4:cf:32:9d:02:08:6b:3f:2b:c8:9c:26:3c:
+                    53:57:69:73:f6:83:84:cd:fc:42:ad:a9:9f:37:ef:
+                    c2:f0:72:0a:84:52:92:f8:d8:cf:10:54:02:24:93:
+                    a4:b1:48:1c:34:74:1e:1c:3e:61:46:93:6c:b5:5b:
+                    a5:fc:a7:9d:4e:76:72:e6:85:b4:57:5f:c8:da:7a:
+                    fd:71:98:ca:70:2e:92:3a:83:d9:6a:54:d6:d0:31:
+                    ae:dc:ad:49:f4:76:f7:d4:f4:79:a6:b5:a2:5f:da:
+                    d3:ed:f2:cf:4e:55:e1:f2:64:9e:9f:b4:a8:df:f6:
+                    53:21:15:b4:fe:f8:72:c4:d0:1d:b5:35:b8:ca:c7:
+                    65:ae:b6:24:24:a8:a6:e7:5b:d1:de:e7:c4:53:21:
+                    13:64:ff:89:d4:4f:79:03:6a:37:cf:d9:ef:0c:ce:
+                    6f:92:ae:fb:0b:d9:a8:3e:67:0f:b7:71:88:dc:ba:
+                    a8:b1:8d:fa:fa:2e:53:54:80:c4:a2:a4:26:a5:c9:
+                    66:5e:75:d5:1f:99:d9:90:c2:77:89:60:13:f1:71:
+                    e8:a2:f5:4a:62:b2:3c:8d:e1:22:75:b0:bb:29:83:
+                    bb:69:b2:ab:08:28:0d:63:70:12:4c:ec:fe:08:e4:
+                    d2:ca:21:48:3c:f4:3c:e6:14:e9:3e:5a:50:89:3d:
+                    0d:4d:93:73:7f:ff:3d:13:2c:b1:fb:81:a0:24:7a:
+                    e7:66:43:40:47:24:e2:c5:ca:7d:8b:af:70:8d:63:
+                    2d:f8:f7:70:99:46:ba:48:7c:d1:08:3b:7b:78:05:
+                    fe:bc:0c:09:ab:7d:43:ba:b1:a9:fd:62:be:2c:8c:
+                    9d:68:b6:43:4a:cc:40:25:3a:62:e2:52:95:e8:3d:
+                    6f:34:19
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
-            Netscape Comment: 
-                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
-                41:73:D1:5E:AA:7D:59:3C:6F:4D:43:E8:20:AE:A1:D3:9C:26:B1:C4
+                15:B2:A0:7E:13:1F:B0:88:CE:E5:E0:FF:D6:8F:8A:D1:01:B6:F2:00
            X509v3 Authority Key Identifier: 
-                keyid:4D:FC:7A:19:F3:2B:0C:7D:F6:C0:7C:4D:F8:72:34:4C:8C:35:52:74
-
+                4D:FC:7A:19:F3:2B:0C:7D:F6:C0:7C:4D:F8:72:34:4C:8C:35:52:74
    Signature Algorithm: sha256WithRSAEncryption
-         49:7c:18:c2:1b:5b:de:5e:15:84:18:f6:6b:1c:03:d6:8e:75:
-         34:f6:6c:0c:e3:64:60:65:6e:19:1d:26:3b:c8:ed:96:99:30:
-         19:7e:3d:d9:c5:a1:19:8e:c6:15:c1:60:74:7e:b6:8b:78:d8:
-         46:43:f7:ad:b0:96:fa:51:4e:52:c2:67:da:da:a8:70:f3:40:
-         c5:80:b4:cc:36:18:81:98:d2:af:94:bc:82:ba:4a:7e:e6:d6:
-         a3:4b:2b:6f:f6:45:b3:82:07:2b:32:68:7a:d5:fc:7d:70:75:
-         7b:4e:b6:33:4c:3d:c2:46:3b:89:c8:77:d8:8d:da:20:88:1d:
-         0c:76:2a:79:92:9c:91:44:44:c8:c7:5e:53:8c:d3:29:f6:e9:
-         3e:26:9f:47:ac:ca:03:4a:90:ba:c7:ba:0e:31:61:fe:89:af:
-         2b:eb:07:aa:7d:10:fd:f5:f0:ba:09:f0:58:1b:86:9b:d2:0b:
-         b8:c8:db:f4:be:6c:ba:96:dd:3c:5d:7f:ec:4b:8e:93:46:b4:
-         78:d2:c7:02:c7:26:e5:d9:ba:3d:93:3f:85:ea:bc:3a:ab:54:
-         bf:d5:2c:6a:49:f4:d7:d4:72:cd:5d:33:d2:cf:c8:c6:98:1e:
-         d2:de:72:53:8c:c3:47:f7:43:aa:ca:0f:ca:0f:24:d0:7a:0f:
-         43:fa:9c:cc:2a:39:2b:0f:ee:89:91:91:6b:e7:89:80:fd:bf:
-         87:c2:9f:0a:7d:f5:e1:33:72:8e:02:35:d4:c6:ec:1d:e7:e0:
-         f2:9b:ff:c3:d0:f2:ae:52:9a:41:87:65:24:d4:2e:3d:61:fb:
-         ef:6d:9a:e9:b2:09:af:6b:d9:72:1a:c5:e7:45:1f:4d:bb:2a:
-         9e:af:25:b8:cd:d0:fc:43:70:45:55:a0:23:4e:23:00:de:65:
-         dc:f6:bb:d9:a3:b3:61:28:5c:10:09:c1:ca:d5:63:4d:cb:e0:
-         1b:36:e1:e6:4c:25:1f:c2:00:d2:93:1f:c4:c9:64:b0:0d:dd:
-         fb:dd:b4:0a:57:24:8a:d5:20:c3:d2:54:a3:c3:8e:c1:e7:c4:
-         fe:30:14:dc:f2:69:6c:8b:67:1f:2b:a7:90:bb:da:f7:81:0d:
-         33:24:3a:21:d6:5d:7f:ed:9a:b1:99:47:8e:42:53:f4:e1:86:
-         da:15:c3:88:bf:e6:4e:29:48:b3:bf:2e:ac:ef:b9:04:74:2f:
-         48:b7:13:ef:fa:92:a5:93:99:e1:0e:3b:86:d1:3b:f9:49:b0:
-         ad:b9:e4:88:e6:db:10:58:5e:b3:61:bf:5c:74:ef:a0:76:99:
-         2e:0f:b8:68:01:9e:32:ae:af:cf:14:45:af:45:0a:f0:b7:f9:
-         41:3b:45:52:7b:a0:44:eb
+    Signature Value:
+        4a:4b:4b:69:2e:c9:d7:c1:ce:63:e2:76:9b:3d:09:76:98:1c:
+        73:cc:38:c2:e7:be:d6:14:de:38:97:e5:ed:53:e2:60:e2:1b:
+        7f:6c:68:1c:f8:90:6c:0d:fc:1e:1a:ee:b6:53:77:5f:71:66:
+        9d:81:a5:ba:c2:92:c7:77:eb:a7:f1:2f:8f:b0:37:68:97:25:
+        18:a7:88:6a:b0:b6:26:32:a7:dc:55:e1:e2:7e:12:03:70:c5:
+        28:c3:4d:32:d7:d8:b6:21:a3:8a:34:b6:6e:2b:b4:43:31:48:
+        82:1b:84:4d:28:39:1c:e2:f1:70:eb:7b:2f:1b:7b:d7:6e:2a:
+        eb:76:15:5c:71:0b:e6:ff:66:4c:ad:92:da:06:f7:fe:28:99:
+        00:ce:3c:e9:20:c1:e2:bd:f8:2b:cb:35:3a:5a:74:01:91:a6:
+        86:e4:c3:8c:5b:ab:c8:5d:f3:0f:d7:fe:0e:02:e4:70:08:f8:
+        0a:15:87:26:24:62:77:5b:51:97:3c:37:71:fe:5b:2c:5d:66:
+        79:78:ee:42:59:9e:03:a7:05:83:f5:89:12:fe:ce:53:f5:68:
+        45:aa:7a:6d:ac:44:84:a2:42:e3:5f:8e:e5:00:23:fe:55:0f:
+        2a:5f:43:8b:34:bf:29:fe:48:57:00:f0:8a:13:f9:21:e5:ec:
+        2c:d0:22:48:5d:b1:7e:b7:13:e1:e1:05:9a:8c:8c:fb:76:a0:
+        42:51:98:24:7e:03:46:5a:de:c7:f9:72:6a:87:02:a7:72:b9:
+        6c:71:08:ff:20:e2:77:c1:5e:42:54:06:bd:d7:21:05:a6:aa:
+        89:3b:a6:cc:41:27:02:88:9a:83:39:38:85:1f:f4:76:7a:cd:
+        90:c4:7a:12:1e:92:6e:8a:b0:be:c4:d3:2f:5e:8d:bb:86:bc:
+        31:39:d0:3d:65:6b:90:af:3d:b3:c6:69:b5:ce:55:f1:d7:e5:
+        a2:8b:f1:6f:51:71:f9:17:aa:ce:a2:8a:a9:9a:a5:aa:6c:22:
+        72:d6:d9:7e:a8:0d:b5:c3:34:ef:1a:95:24:0b:a9:4e:bc:b1:
+        60:08:b8:c7:b4:2c:79:93:49:5e:ec:df:8c:28:da:cb:c0:59:
+        f2:28:58:e6:54:17:b4:c1:6a:ea:a3:7b:e3:95:1e:04:a6:7e:
+        bf:50:2b:27:94:83:3e:42:7e:8e:c1:db:92:48:41:19:b0:82:
+        96:fa:f5:67:3c:24:8b:e8:4b:a9:09:5c:61:75:55:ed:74:23:
+        8d:ac:67:d8:41:44:67:41:81:2f:ec:44:18:f5:93:49:88:e1:
+        31:4a:0c:a4:e0:2c:ef:f6:4c:8c:95:be:49:5c:1b:d2:f8:5b:
+        c6:8e:ce:08:a1:4b:be:b3
 -----BEGIN CERTIFICATE-----
-MIIFpjCCA46gAwIBAgIBAjANBgkqhkiG9w0BAQsFADBWMQ8wDQYDVQQDDAZjYWNl
+MIIFhTCCA22gAwIBAgIBAzANBgkqhkiG9w0BAQsFADBWMQ8wDQYDVQQDDAZjYWNl
 cnQxCzAJBgNVBAYTAkZJMREwDwYDVQQIDAhIZWxzaW5raTERMA8GA1UEBwwISGVs
-c2lua2kxEDAOBgNVBAoMB01hcmlhREIwHhcNMjAwMzAzMDMwMzAzWhcNNDAwMjI4
-MDMwMzAzWjBaMQswCQYDVQQGEwJGSTERMA8GA1UECAwISGVsc2lua2kxETAPBgNV
-BAcMCEhlbHNpbmtpMRAwDgYDVQQKDAdNYXJpYURCMRMwEQYDVQQDDApzZXJ2ZXIt
-bmV3MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAu6LWzC3/0ZEDQQrZ
-6HjN92y3irA356J5w04I2vLsvbqD6Ok9VlaO07jX8rSVmTkmpbKSsAldQu5hBkWc
-5sb0eu5FX7tLKR3yHUtkFsrDDFiVGtvUVPQt14R2aXXMsaQLTIPVup/10NdYue01
-2rXRiB6F25S3K/O3oYVz3JK4u4B5heJ+1va7cv6MZWQ1mYrZdMaG761hy1D/HERy
-oELGjxlgq48AO2+Urr6IcHJhgE1oT8ZUnNak44WoUU923LFbS8KsB+wSTci6x7CA
-71cAdU+w+sKhcE0NdcapPbgfW/0MNIRcTxA1YpB71Wu3eM1U4hO6n4HC8YTjdLMn
-RkrvSFl1WFOpkuDIPkSGcvBnZBpy2zNou1GkOZww9DifwXSrV2uZO+cZNJZEK/N7
-WIK36+t0WmaOvmgrcYUBtNUN4B4XX+EScvNx2EGaTr6kLLuASOktdB5XEtCQwmYt
-HNF8x+Bdf6CnRvsxpzfHGSJP9n+NuNSb97H6b3dosuKh5AXpInkJ8FkhwEkOHDEO
-PfQdTtVRj+RAZqagYwzcZlsI1mzuKwh/HqisEGmPeElejiDxgciyajZKQ+IPR3uP
-ugZSKi0FwAP3Ee3twehInD/BzyyIyFfegeNZLttRbiMNfqh1pG3NnlZ/GflD7is6
-3cWv6Ro+HdxXo91WFO3/M0APw+kCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgB
-hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE
-FEFz0V6qfVk8b01D6CCuodOcJrHEMB8GA1UdIwQYMBaAFE38ehnzKwx99sB8Tfhy
-NEyMNVJ0MA0GCSqGSIb3DQEBCwUAA4ICAQBJfBjCG1veXhWEGPZrHAPWjnU09mwM
-42RgZW4ZHSY7yO2WmTAZfj3ZxaEZjsYVwWB0fraLeNhGQ/etsJb6UU5Swmfa2qhw
-80DFgLTMNhiBmNKvlLyCukp+5tajSytv9kWzggcrMmh61fx9cHV7TrYzTD3CRjuJ
-yHfYjdogiB0Mdip5kpyRRETIx15TjNMp9uk+Jp9HrMoDSpC6x7oOMWH+ia8r6weq
-fRD99fC6CfBYG4ab0gu4yNv0vmy6lt08XX/sS46TRrR40scCxybl2bo9kz+F6rw6
-q1S/1SxqSfTX1HLNXTPSz8jGmB7S3nJTjMNH90Oqyg/KDyTQeg9D+pzMKjkrD+6J
-kZFr54mA/b+Hwp8KffXhM3KOAjXUxuwd5+Dym//D0PKuUppBh2Uk1C49YfvvbZrp
-sgmva9lyGsXnRR9NuyqeryW4zdD8Q3BFVaAjTiMA3mXc9rvZo7NhKFwQCcHK1WNN
-y+AbNuHmTCUfwgDSkx/EyWSwDd373bQKVySK1SDD0lSjw47B58T+MBTc8mlsi2cf
-K6eQu9r3gQ0zJDoh1l1/7ZqxmUeOQlP04YbaFcOIv+ZOKUizvy6s77kEdC9ItxPv
-+pKlk5nhDjuG0Tv5SbCtueSI5tsQWF6zYb9cdO+gdpkuD7hoAZ4yrq/PFEWvRQrw
-t/lBO0VSe6BE6w==
+c2lua2kxEDAOBgNVBAoMB01hcmlhREIwHhcNMjYwNDIyMTgwNjA4WhcNNDYwNDE4
+MTgwNjA4WjBnMQswCQYDVQQGEwJGSTERMA8GA1UECAwISGVsc2lua2kxETAPBgNV
+BAcMCEhlbHNpbmtpMRAwDgYDVQQKDAdNYXJpYURCMSAwHgYDVQQDDBcnYHRvdWNo
+IEFgJy0iYHRvdWNoIEJgIjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
+ALC9qrJ7OriYK0g2wPLJkLGIOR1Y4wscs3OujLHbm5NA2E4quzxlpQJ4/R0EJMaL
+tl4hE7vPIFzW0vs7KwPMTefmBowvEJzSd68cHdPQAojwFz95TL/GlWMFBAIdorrr
+6Grki4BItCiN7UYoeYfjWEJlPyAUyRaTnRSGs061MJidgwChMFY4HWfz/z452cQw
+CkuxbaEXC56gC8IW/X9yuvk8AFiHjTwWph4ArjOcqqLXN8ccZirEzzKdAghrPyvI
+nCY8U1dpc/aDhM38Qq2pnzfvwvByCoRSkvjYzxBUAiSTpLFIHDR0Hhw+YUaTbLVb
+pfynnU52cuaFtFdfyNp6/XGYynAukjqD2WpU1tAxrtytSfR299T0eaa1ol/a0+3y
+z05V4fJknp+0qN/2UyEVtP74csTQHbU1uMrHZa62JCSopudb0d7nxFMhE2T/idRP
+eQNqN8/Z7wzOb5Ku+wvZqD5nD7dxiNy6qLGN+vouU1SAxKKkJqXJZl511R+Z2ZDC
+d4lgE/Fx6KL1SmKyPI3hInWwuymDu2myqwgoDWNwEkzs/gjk0sohSDz0POYU6T5a
+UIk9DU2Tc3//PRMssfuBoCR652ZDQEck4sXKfYuvcI1jLfj3cJlGukh80Qg7e3gF
+/rwMCat9Q7qxqf1iviyMnWi2Q0rMQCU6YuJSleg9bzQZAgMBAAGjTTBLMAkGA1Ud
+EwQCMAAwHQYDVR0OBBYEFBWyoH4TH7CIzuXg/9aPitEBtvIAMB8GA1UdIwQYMBaA
+FE38ehnzKwx99sB8TfhyNEyMNVJ0MA0GCSqGSIb3DQEBCwUAA4ICAQBKS0tpLsnX
+wc5j4nabPQl2mBxzzDjC577WFN44l+XtU+Jg4ht/bGgc+JBsDfweGu62U3dfcWad
+gaW6wpLHd+un8S+PsDdolyUYp4hqsLYmMqfcVeHifhIDcMUow00y19i2IaOKNLZu
+K7RDMUiCG4RNKDkc4vFw63svG3vXbirrdhVccQvm/2ZMrZLaBvf+KJkAzjzpIMHi
+vfgryzU6WnQBkaaG5MOMW6vIXfMP1/4OAuRwCPgKFYcmJGJ3W1GXPDdx/lssXWZ5
+eO5CWZ4DpwWD9YkS/s5T9WhFqnptrESEokLjX47lACP+VQ8qX0OLNL8p/khXAPCK
+E/kh5ews0CJIXbF+txPh4QWajIz7dqBCUZgkfgNGWt7H+XJqhwKncrlscQj/IOJ3
+wV5CVAa91yEFpqqJO6bMQScCiJqDOTiFH/R2es2QxHoSHpJuirC+xNMvXo27hrwx
+OdA9ZWuQrz2zxmm1zlXx1+Wii/FvUXH5F6rOooqpmqWqbCJy1tl+qA21wzTvGpUk
+C6lOvLFgCLjHtCx5k0le7N+MKNrLwFnyKFjmVBe0wWrqo3vjlR4Epn6/UCsnlIM+
+Qn6OwduSSEEZsIKW+vVnPCSL6EupCVxhdVXtdCONrGfYQURnQYEv7EQY9ZNJiOEx
+Sgyk4Czv9kyMlb5JXBvS+FvGjs4IoUu+sw==
 -----END CERTIFICATE-----
--- a/mysql-test/std_data/server-new-key.pem
+++ b/mysql-test/std_data/server-new-key.pem
@@ -1,51 +1,52 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIJKgIBAAKCAgEAu6LWzC3/0ZEDQQrZ6HjN92y3irA356J5w04I2vLsvbqD6Ok9
-VlaO07jX8rSVmTkmpbKSsAldQu5hBkWc5sb0eu5FX7tLKR3yHUtkFsrDDFiVGtvU
-VPQt14R2aXXMsaQLTIPVup/10NdYue012rXRiB6F25S3K/O3oYVz3JK4u4B5heJ+
-1va7cv6MZWQ1mYrZdMaG761hy1D/HERyoELGjxlgq48AO2+Urr6IcHJhgE1oT8ZU
-nNak44WoUU923LFbS8KsB+wSTci6x7CA71cAdU+w+sKhcE0NdcapPbgfW/0MNIRc
-TxA1YpB71Wu3eM1U4hO6n4HC8YTjdLMnRkrvSFl1WFOpkuDIPkSGcvBnZBpy2zNo
-u1GkOZww9DifwXSrV2uZO+cZNJZEK/N7WIK36+t0WmaOvmgrcYUBtNUN4B4XX+ES
-cvNx2EGaTr6kLLuASOktdB5XEtCQwmYtHNF8x+Bdf6CnRvsxpzfHGSJP9n+NuNSb
-97H6b3dosuKh5AXpInkJ8FkhwEkOHDEOPfQdTtVRj+RAZqagYwzcZlsI1mzuKwh/
-HqisEGmPeElejiDxgciyajZKQ+IPR3uPugZSKi0FwAP3Ee3twehInD/BzyyIyFfe
-geNZLttRbiMNfqh1pG3NnlZ/GflD7is63cWv6Ro+HdxXo91WFO3/M0APw+kCAwEA
-AQKCAgEAthrLZyx5rHWV9+lFJYchNrIvzA1MpKWekTtKAt1jgJvlbAX5/rJROhCa
-nTZAPo4mAQi3rtvXxJ7AUar8JUoQesKHV+rZflVO5rmFsU0mUfQi+gdCIxU87H7l
-wWKPwBRa1u7YXqDinMZzmTcsXlC5w+cDuOGziJenr75qfTd0zJ1a0+LHgW/C6087
-CShhkNweQmRvD2xxjjbU8SVJLlrAhJ93n+lQq16WqaXHm4KXOENoKoxtEC6NpzfP
-7OI3lOcYmQWdmq618QIQrL+T0zXX/wLR2/1LW0ec+aJOHNV2sft8ffe78wvjE/7w
-AGjjjv2RFT1akXYJsgdsDZXWVzVg1mfou1f0/ywmFNqtB2lKGnpte+3nre4ip7nw
-lB8STjdByPhPNPb0xeMYlPmG05LY/nGJsExiTt9PHPj6+e2z0y3jZprbklsm/3od
-FuzQ88kLeme2tuMDqedzTD38oaj39CnKjxoAXqQezc46LytDDpwgU/Or5Xu6UFV0
-lS0Pv0ua79zo+1to+DX0+V9vuwnXJmo7YFrGtZmpmRFG1r9Eakz0IbH9E8Pwd5FI
-7oVF007ooNyAR7yC4VlK2u7V0i0ZdJGNhIvE6P0/NxKyoxNdrfhoyNA3AFtFCA42
-FNb7I6LgxPa9CR8zTjDmwe4AWcdEO2vIX/sihYsuHOZLaveNCYECggEBAOa2Vmzo
-xg7BX5iS94RSN1ApFMlUibnc04hIaU7046N7kOF9FfFmc5gdXjRpNc2b7S3dmcWf
-MycgBTCZeVq25zOA3NlD61BT1w/4u7dpCDuDK1zh/0xjkmHJ3KWxtOdStn0uU7Yx
-pqhngHF+XnGwqhOCdC3wEHwLua7NtfoSwO2XyyRRsTomT/MhPZFNLRB2CvO6IU/F
-xog4MC4aGBv1blYV2aBkXvyUzdQBxZQfcCSzAG56YvwBZ/1bORmGTHdfnirzGt8x
-MRV+yp8JOUz33JRgOzkWANQxc4nZuvZD4TnZokTJaHLc7XWNZwKgiGo9XqlY9Bao
-MgpRGu9GelQeBpkCggEBANAzzqqZuv1iqxo1Q4YgGWyuv7MJ60FpWMkMk6f332Jy
-eGOG8TrLM45uo4Z9jNTtbjbmrKQYyA0D+++HXF7EPDNmJLH6950GtNN607hK1UA3
-1P7XW30mS6aHOckPO1Aing6Asvu1QqviwW/d5XTCiFGpU88BSh9l8A1ao+ePr+Lz
-kYnuyT5yc2tBlUknv/SZ6eqbptKP2dh3cR5sn+8jRjXuXhONMjDisZH3IjMEdO5W
-re1Qa/2LEnpB71g5qmb4Xj/o/uJlwQZAXXUBwEKid3Q5wa03DFFOUQmNGYrhYAl9
-4AYENQC2FESdo5dPGyOx/mBgx3B0Cg2S/ytX/P95CdECggEAaqmj/UgEwS+fna9c
-pZ1JG1NS292sqvQwC9LGdQ187Mkk60rkSS2/hXUWZ464pC1RkyHfhOEcShtgqt5Z
-n5nt+/64m+3trb6FMEojpyD1AGadNpz5Zfym4XTtAOHOrB+uZON1Kkd8MGFhnZb5
-3P/7MXffdJmHVYIqP2m1lz7yWSYTceAe2q55ygL1LucKTZD1cUb9PZ9HMRUhGT9R
-JCPs9fm2GpQs4gN9wWVsThXWx/DF403L04xm4lg5ZtaTJaFcQ6kPJF7evXxX+vzN
-tArnvOVcnADTM0cFjpbN/CrXxuIaRkkDdA817WIJXMqRJuTmjc6lUpBCSkjC9hqU
-Va1oCQKCAQEAvJkRboyPTBRi9fylzAurvD2XvTERAFHTcVuJLbBllCIpV87XGfEU
-JMOoMZ3tQrxJCEZwwL0KCnA/eTzeuaF8/vpZ5zd1sbJvftpWiyyOe/uXX7npUDau
-dI0uFSlNC0wwbOa8OzJ40Ic5voH85oWJQp/mITAD2ulWSGKA8rPAGg+VGKNLfNvk
-HZZtCrWNNp9tu21/8mEIbwPTXkH7pn4Hjbb9VSyj+JCBVb3OJvS0j2nJZ51gFW4z
-MLglfX/PEjON/MqsiJyv+1+2yNTrOfE9z/S5spSY/dW5prNAHgQGINL7abfJ43kM
-ZxN9KwUninAkA13ni8AxkxZDOxobPbiA4QKCAQEAwMLRfOulmo6psfMW7JhlRdZa
-aAo8loLuK4S0nn4B3alUqjinVZPmgDRUu1XjtwbJ4mvbWjMxOQrYlRkp+RsxYZOy
-hiTWkUgMNFLbMBuwsS4+pBiYrkcbyNAxg8TjlTIp1XMUdCsOd2JrSWG6eAekIv9e
-9yOW7eOt8epnoAnCFpFBfdJvjCvWyKY/Sxk1ISskpVZoxFHk9Dc+38Rmy13hLyE0
-UyJnSX3x4Dw83cyV6/KqJWDkQlvVGoXG56gM2VZwLqvHHYDVOV/1u8k0KtZdxJFe
-FANJfgYUb6c8SFYVbwc4Rjeb2nq/fnbUyUQpbZ278Xf5Oe594KBdYj9qltlGbA==
-----END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCwvaqyezq4mCtI
+NsDyyZCxiDkdWOMLHLNzroyx25uTQNhOKrs8ZaUCeP0dBCTGi7ZeIRO7zyBc1tL7
+OysDzE3n5gaMLxCc0nevHB3T0AKI8Bc/eUy/xpVjBQQCHaK66+hq5IuASLQoje1G
+KHmH41hCZT8gFMkWk50UhrNOtTCYnYMAoTBWOB1n8/8+OdnEMApLsW2hFwueoAvC
+Fv1/crr5PABYh408FqYeAK4znKqi1zfHHGYqxM8ynQIIaz8ryJwmPFNXaXP2g4TN
+/EKtqZ8378LwcgqEUpL42M8QVAIkk6SxSBw0dB4cPmFGk2y1W6X8p51OdnLmhbRX
+X8jaev1xmMpwLpI6g9lqVNbQMa7crUn0dvfU9HmmtaJf2tPt8s9OVeHyZJ6ftKjf
+9lMhFbT++HLE0B21NbjKx2WutiQkqKbnW9He58RTIRNk/4nUT3kDajfP2e8Mzm+S
+rvsL2ag+Zw+3cYjcuqixjfr6LlNUgMSipCalyWZeddUfmdmQwneJYBPxceii9Upi
+sjyN4SJ1sLspg7tpsqsIKA1jcBJM7P4I5NLKIUg89DzmFOk+WlCJPQ1Nk3N//z0T
+LLH7gaAkeudmQ0BHJOLFyn2Lr3CNYy3493CZRrpIfNEIO3t4Bf68DAmrfUO6san9
+Yr4sjJ1otkNKzEAlOmLiUpXoPW80GQIDAQABAoICABQRmrC6QMMLNwbz01mo56Qx
+Cq3kFPaDDiFu9Yzl7zbQ9dQnvVZbWFmn3AiPxY6XTgrxiJMahDCROCh3jH0u6r26
+pzhYc8jK4Uo3UBpoE+bxaZe3MgQots0lRFI/2Trjug1r4XycmiXCD+pCgveaKhXH
+91tbi4XjwcITQDMKF02NEn4KJOSgFJQO5wcYJzvEFLc0RiA0713WCzUWdTcj6PU6
+CfQDgwG1X1bSzvUPWhTe3qIzqFTnlNDIy/Khcu00J1RJefvX/pHvAdp98CMAur1C
+8rNoz6bngBwqSkDZY9uRZEcOdXLDU1PzsAoFMs0ubfJQJL2ZwkGeIbSLgibE28L5
+5b1V1QpzPaMHeXvHwkfSAMJKi4DJjmcf3psbDi3YeOZlsmGbpMPY/PyC6qkz7IFu
+e54o/8G2/chY6m3GgqxnHH6QAqdjwTC/2awM2FRrbfawP6TSwFDYSGb/wZLhsnU4
+plLms2OIt5Dy5vKvPsTXzbF9fHEqMhKgDDliOBfbI6oUldItMQ7VUF05G6/Z2sos
+tKg6Ih4qZpTAHKyYfshsQnJoZ8N+kdsEzN6P4WWD2ccWBZZqKf15ZS5/1wvKOgoi
+CAouSEKSgoCobQkbjI5mu6dwox0hCbd+8lF+brQLgJw1A3ZFsoDdGJzEhDZI+zWM
+mrATaRqeRhcri4Bhmas9AoIBAQD2IAo2C+WJd01CQLLTvQiN5Kk5C3wezSLIzTMe
+Lzj5qeeM7YXOC8PLgNdQyBcItDUXJok80TAlUcexsM2x8GoicyyEfzFttdlQfFra
+eDhbjwa22ytG14qrDY3/9nPgsxY7AglymOgqdNqGfLvnYElJpoTlaWiKOOagpyGI
+59//9doyU0iOYqpP8XoTaNPHM//592oG8JDrf+sK4nszjQhz9TWOsop7ErJPSGZI
+y8DncNQGGF3yRIqyJ4ee/s1g5f8X7nJBxwB3gZwWGWpjI0ez9JXPXAWGeTl9P035
+0UIox6akg65KCJUkDER4MaBXMamRikOq1972O+iB4QVoNz6zAoIBAQC31PqHUkYP
+soWosbrYjw4fz747zxVWi2jjW9rop7/DoIbcSMPCWmnG7uZOchJSQCpurBvcBndq
+Y7WZ9ngbc/4SclPoYNwn/Y5imIikXKmv4PhTDQZ3R5d99qHGkBcb39TH1hpwJvRL
+wLM/aNwxjEMqdmy2Ppk/S6qyMAqqI0hSd8fettRKcVdidxUtH6yQKCM86TZ/tF9q
+r0D7UGE64RYWY36rYIBhWXV0Kr+Yvp8nMXshQtPdfFmINU0AHxjY5Hg+lPQzejub
+rAZjjFCdE0M1iOqPWCMYJGsubf4pNeVhwyDQxGHotBeoVEf2UJgAZGDJyBVha9QH
+4WP3TeF/zKgDAoIBAQCVp0uuKzOpj1H5y+8wUgumg3flyLby35ab9DF11A7Xt9ik
+VzR54atuzOufIdrnnvN9HSBrS2Lz/jLnN3MLE/zk75UNB23doKn/h22S03CpM2FI
+xCEfVSXq9jX2gjtZUGte+9EUzia00hKhnax/dot5bff2qk43ZXvOCXGZliwcrbe7
+y+odMZ8PNuwcaywCPvsRWcAtcg8cMs6O8sEoykNuhpXHK4aKaQbksEgJUWL9FxzE
+jAJrsgOHagPLyHDGz3J5cbIljsQY5kUrJs8KcsRBhqGk0PZHGuS65Egcc4G/3A3W
+kH7kYy2UGqVzU/GDsx3A8gpNEi9vF2Q7vMAV6ymDAoIBADpsOWKgRxveBJRkR5lj
+fX2mrDKd0Y47qA35t0yRY2Rss+92QKCX014htpffsOrq8ZFSqVf3xiPNpH1V0z4G
+UwzRwNDtV4puDr5O874opNT8jm72iMOHwSGLLEbKrE1ziVApPyW9e45Ho6/XR4OH
+rCDmmg4hPtra1Vjj47/GjsmGv8KMIFO4SalFZzl8A3+dAfXtuCBF1r01DVXRadUo
+i7h5zlvww1ws7iMJIvMMQdBW7WbYsjSFvH6JUftj5qWnln9tH17szdzfgvhIM6Z3
+5Lgy1zjPLfgSOu36jvfR5SB4vwkaIHOwKISapHQnkOcu/4OhTwozFqOaggaqfav8
+ArkCggEBAM+Rx6FPe+QR9wRWFrrpum9VAJcE0+XrHGgCFl3QXjlAfMRIsCzH0jNC
+ll54kFUZI9ircEvXfJd5sd8EBITwsV6aFzV1UIIX/Wp1qzdR7u/AzmvG/8R7hCD6
+SiZCgK5nye5x9eM7oC71InyYYtqXErQMUUvCKBx8F14i0pqbQk6s6cjnZqAXHaoa
+vC8Vu7ODqy5CnezrBatcOXdCpqLhStZPgSHlmYWGUZKZPtxPiAIU5lB2iq1YDLsh
+rTAv/V8tfYxjm02psk+0SE5+FTgiITO3n8ZQOQ7/clA4asztwUbenyGv+qX+RAlp
+GRuROj++HIUxkCf8fgVsxrWSmMDc8oc=
+-----END PRIVATE KEY-----
--- a/mysql-test/suite/galera/r/galera_sst_mariabackup_encrypt_with_key_server.result
+++ b/mysql-test/suite/galera/r/galera_sst_mariabackup_encrypt_with_key_server.result
@@ -3,4 +3,24 @@ connection node_1;
 SELECT 1;
 1
 1
-include/assert_grep.inc [Using openssl based encryption with socat]
+FOUND 1 /Using openssl based encryption with socat: with key and crt/ in mysqld.1.err
+#
+# MDEV-39413 wsrep unsafe handling of parameters
+#
+call mtr.add_suppression('Invalid value for WSREP_SST_OPT_REMOTE_USER');
+call mtr.add_suppression('Failed to read from: wsrep_sst_mariabackup');
+call mtr.add_suppression('Process completed with error: wsrep_sst_mariabackup');
+call mtr.add_suppression('Command did not run: wsrep_sst_mariabackup');
+call mtr.add_suppression('State transfer to .* failed');
+call mtr.add_suppression('Will never receive state. Need to abort');
+call mtr.add_suppression('Error while getting data from donor node');
+call mtr.add_suppression('Cleanup after exit with status');
+call mtr.add_suppression('Removing .*/xtrabackup_galera_info file due to signal');
+connection node_2;
+# force SST again
+# using a cert with shell-unsafe CN
+# start the server
+# the server failed to start
+FOUND 1 /Invalid value for WSREP_SST_OPT_REMOTE_USER/ in mysqld.1.err
+# cleanup
+# restart
--- a/mysql-test/suite/galera/t/galera_sst_mariabackup_encrypt_with_key_server.test
+++ b/mysql-test/suite/galera/t/galera_sst_mariabackup_encrypt_with_key_server.test
@@ -1,11 +1,10 @@
 #
-# This test checks that if SST SSL is not explicitly donfigured mariabackup SST
+# This test checks that if SST SSL is not explicitly configured mariabackup SST
 # uses server SSL configuration if present.
 # Initial SST happens via mariabackup, so there is not much to do in the body
 # of the test
 #

--source include/big_test.inc
 --source include/galera_cluster.inc
 --source include/have_innodb.inc
 --source include/have_mariabackup.inc
@@ -17,9 +16,46 @@ SELECT 1;
 --source include/wait_condition.inc

 # Confirm that transfer was SSL-encrypted
--let $assert_text = Using openssl based encryption with socat
--let $assert_select = Using openssl based encryption with socat: with key and crt
--let $assert_count = 1
--let $assert_file = $MYSQLTEST_VARDIR/log/mysqld.1.err
--let $assert_only_after = CURRENT_TEST
--source include/assert_grep.inc
+--let SEARCH_FILE = $MYSQLTEST_VARDIR/log/mysqld.1.err
+--let SEARCH_PATTERN = Using openssl based encryption with socat: with key and crt
+--source include/search_pattern_in_file.inc
+
+--echo #
+--echo # MDEV-39413 wsrep unsafe handling of parameters
+--echo #
+
+call mtr.add_suppression('Invalid value for WSREP_SST_OPT_REMOTE_USER');
+call mtr.add_suppression('Failed to read from: wsrep_sst_mariabackup');
+call mtr.add_suppression('Process completed with error: wsrep_sst_mariabackup');
+call mtr.add_suppression('Command did not run: wsrep_sst_mariabackup');
+call mtr.add_suppression('State transfer to .* failed');
+call mtr.add_suppression('Will never receive state. Need to abort');
+call mtr.add_suppression('Error while getting data from donor node');
+call mtr.add_suppression('Cleanup after exit with status');
+call mtr.add_suppression('Removing .*/xtrabackup_galera_info file due to signal');
+
+--connection node_2
+--source include/shutdown_mysqld.inc
+
+--echo # force SST again
+--remove_file $MYSQLTEST_VARDIR/mysqld.2/data/grastate.dat
+--echo # using a cert with shell-unsafe CN
+--exec echo '[mysqld.2]' >> $MYSQLTEST_VARDIR/my.cnf
+--exec echo ssl-cert=$MYSQL_TEST_DIR/std_data/server-new-cert.pem >> $MYSQLTEST_VARDIR/my.cnf
+--exec echo ssl-key=$MYSQL_TEST_DIR/std_data/server-new-key.pem >> $MYSQLTEST_VARDIR/my.cnf
+
+--echo # start the server
+--error 0
+--exec $MYSQLD_LAST_CMD
+--echo # the server failed to start
+
+--let SEARCH_PATTERN = Invalid value for WSREP_SST_OPT_REMOTE_USER
+--source include/search_pattern_in_file.inc
+
+--echo # cleanup
+# we have to kill joiner's socat here, because the donor has aborted SST
+# and joiner's socat will timeout in 5 minutes
+--exec pkill -f 'socat.*server-new-cert'
+--exec echo ssl-cert=$MYSQL_TEST_DIR/std_data/server-cert.pem >> $MYSQLTEST_VARDIR/my.cnf
+--exec echo ssl-key=$MYSQL_TEST_DIR/std_data/server-key.pem >> $MYSQLTEST_VARDIR/my.cnf
+--source $MYSQL_TEST_DIR/include/start_mysqld.inc
--- a/scripts/wsrep_sst_common.sh
+++ b/scripts/wsrep_sst_common.sh
@@ -29,6 +29,15 @@ if [ "$OS" != 'Darwin' ]; then
    export LD_LIBRARY_PATH="${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}/usr/local/lib:/lib:/usr/lib:/opt/lib"
 fi

+safe()
+{
+  if [[ "${!1}" = *[\ \'\`]* ]]; then
+    wsrep_log_error "Invalid value for $1: ${!1}"
+    exit 21
+  fi
+  echo "${!1}"
+}
+
 commandex()
 {
    if [ -n "$BASH_VERSION" ]; then
--- a/scripts/wsrep_sst_mariabackup.sh
+++ b/scripts/wsrep_sst_mariabackup.sh
@@ -279,7 +279,7 @@ get_transfer()
                wsrep_log_info "Using traditional netcat as streamer"
                tcmd="$tcmd -q0"
            fi
-            tcmd="$tcmd $WSREP_SST_OPT_HOST_UNESCAPED $SST_PORT"
+            tcmd="$tcmd $(safe WSREP_SST_OPT_HOST_UNESCAPED) $SST_PORT"
        fi
    else
        tfmt='socat'
@@ -404,14 +404,14 @@ get_transfer()
                # CA verification
                verify_ca_matches_cert "$tpem" "$tcert" "$tcap"
                if [ -n "$WSREP_SST_OPT_REMOTE_USER" ]; then
-                    CN_option=",commonname='$WSREP_SST_OPT_REMOTE_USER'"
+                    CN_option=",commonname='$(safe WSREP_SST_OPT_REMOTE_USER)'"
                elif [ "$WSREP_SST_OPT_ROLE" = 'joiner' -o $encrypt -eq 4 ]
                then
                    CN_option=",commonname=''"
                elif is_local_ip "$WSREP_SST_OPT_HOST_UNESCAPED"; then
                    CN_option=',commonname=localhost'
                else
-                    CN_option=",commonname='$WSREP_SST_OPT_HOST_UNESCAPED'"
+                    CN_option=",commonname='$(safe WSREP_SST_OPT_HOST_UNESCAPED)'"
                fi
                tcmd="$tcmd,cert='$tpem',key='$tkey'"
                if [ -n "$tcert" ]; then
@@ -757,11 +757,11 @@ cleanup_at_exit()

 setup_ports()
 {
-    SST_PORT="$WSREP_SST_OPT_PORT"
+    SST_PORT="$(safe WSREP_SST_OPT_PORT)"
    if [ "$WSREP_SST_OPT_ROLE" = 'donor' ]; then
-        REMOTEIP="$WSREP_SST_OPT_HOST"
-        lsn="$WSREP_SST_OPT_LSN"
-        sst_ver="$WSREP_SST_OPT_SST_VER"
+        REMOTEIP="$(safe WSREP_SST_OPT_HOST)"
+        lsn="$(safe WSREP_SST_OPT_LSN)"
+        sst_ver="$(safe WSREP_SST_OPT_SST_VER)"
    fi
 }