Fix critical security issues: command injection, HTTP downloads, eval, arch swap

[devin-ai-integration]

Summary

Security audit fixing the most critical findings across 10 scriptmodules.

Command injection via unvalidated user input (dink.sh)

User-supplied DMOD name from dialog was passed unquoted into wget, tar, sudo mv, rm — allowing shell metacharacter injection. Fixed by:

• Adding input validation: [[ ! "$search" =~ ^[a-zA-Z0-9_-]+$ ]]
• Quoting all ${search} and ${folder} expansions throughout
• Upgrading http:// → https:// for dinknetwork.com downloads

Arbitrary code execution via eval (borked3ds.sh)

eval $run executed whatever string was extracted from CSV menu data. Replaced with function-name validation:

if declare -f "$run" >/dev/null 2>&1; then
    "$run"
else
    printMsgs "dialog" "Unknown action: $run"
fi

HTTP → HTTPS for binary/source downloads (6 files)

Downloads over plain HTTP are vulnerable to MITM — an attacker on the network could substitute malicious binaries/tarballs/GPG keys:

• openbor.sh: libGL.so.1 binaries from GitHub raw
• kodi-extra.sh: Kodi APT repo list and GPG signing key
• kweb.sh: kweb tarball
• reminiscence.sh: REminiscence source tarball
• piegalaxy.sh: innoextract archives

Piping remote scripts to bash (openra.sh, openra-vpi5.sh)

curl | bash executes whatever the server returns with no inspection. Changed to download-then-execute pattern so the script is a local file before execution.

Swapped architecture binaries (piegalaxy.sh)

isPlatform "x86" was downloading the .arm wyvern binary and vice versa. Fixed the suffix swap.

Predictable temp path for pip bootstrap (retroscraper.sh)

Replaced hardcoded /tmp/get-pip.py with mktemp --suffix=.py to prevent symlink/race attacks on the world-writable /tmp/ directory.

Link to Devin session: https://app.devin.ai/sessions/320bf558ab764f4e9656c4999dcebd9a
Requested by: @Exarkuniv

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring