Safely escape values written through sed

[maghuro]

Summary

Safely escape configuration values before using them in sed replacement expressions.

Problem

Update_Custom_Settings() writes several setting values back into the configuration file using sed substitutions.

One path currently escapes a set of characters that does not include ampersand.

In a sed replacement expression, ampersand has special meaning: it expands to the entire text matched by the search expression.

For example, a setting value such as:

/tmp/a&b

can corrupt the configuration line because the ampersand is interpreted by sed instead of being written literally.

Backslashes also have special meaning in sed replacement strings and need to be escaped consistently.

Fix

Before inserting setting values into sed replacement expressions, escape the three characters that are significant for this usage:

• slash
• ampersand
• backslash

The same escaping expression is now used consistently by all three replacement paths in Update_Custom_Settings().

The value is also passed through printf instead of echo so that its contents are not subject to implementation-specific echo escape handling.

Validation

The replacement behavior was tested with both regular sed and BusyBox sed using values containing:

• normal paths
• forward slashes
• ampersands
• backslashes
• combinations of ampersands and backslashes

Values are preserved correctly in the resulting configuration assignment.

The previous behavior with an ampersand was also reproduced and resulted in configuration-line corruption.

[ExtremeFiretop]

@Martinski4GitHub

Considering this PR basically does nothing but extend your existing fix from PR:
#590

I'll merge it in as is.

[ExtremeFiretop]

I extended this PR even further in commit: 4e779db