refactor: replace eval with array in build.sh

Building a command string and calling eval is vulnerable to shell
injection if branch names or fork names contain metacharacters.

Replace with a bash array (DOCKER_BUILD_CMD) and execute directly
via "${DOCKER_BUILD_CMD[@]}". USE_CACHE and TAG are now tracked as
dedicated variables rather than via string substitution, which also
removes the fragile TAG replacement logic.

Signed-off-by: Adam Warner <me@adamwarner.co.uk>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: PromoFaux

build.sh

@@ -20,8 +20,8 @@ usage() {
 
 # Set default values
 TAG="pihole:local"
-DOCKER_BUILD_CMD="docker buildx build src/. --tag ${TAG} --load --no-cache"
 FTL_FLAG=false
+USE_CACHE=false
 CORE_FORK="pi-hole"
 WEB_FORK="pi-hole"
 PADD_FORK="pi-hole"
@@ -56,6 +56,9 @@ check_branch_exists() {
     fi
 }
 
+# Collect extra --build-arg values from flags
+BUILD_ARGS=()
+
 # Parse command line arguments
 while [[ $# -gt 0 ]]; do
     key="$1"
@@ -71,7 +74,7 @@ while [[ $# -gt 0 ]]; do
             usage
         fi
         FTL_FLAG=true
-        DOCKER_BUILD_CMD+=" --build-arg FTL_SOURCE=local"
+        BUILD_ARGS+=(--build-arg "FTL_SOURCE=local")
         shift
         ;;
     -f | --ftlbranch)
@@ -82,58 +85,56 @@ while [[ $# -gt 0 ]]; do
         FTL_FLAG=true
         FTL_BRANCH="$2"
         check_branch_exists "ftl" "$FTL_BRANCH"
-        DOCKER_BUILD_CMD+=" --build-arg FTL_BRANCH=$FTL_BRANCH"
+        BUILD_ARGS+=(--build-arg "FTL_BRANCH=$FTL_BRANCH")
         shift
         shift
         ;;
     -c | --corebranch)
         CORE_BRANCH="$2"
         check_branch_exists "pi-hole" "$CORE_BRANCH" "$CORE_FORK"
-        DOCKER_BUILD_CMD+=" --build-arg CORE_BRANCH=$CORE_BRANCH"
+        BUILD_ARGS+=(--build-arg "CORE_BRANCH=$CORE_BRANCH")
         shift
         shift
         ;;
     -w | --webbranch)
         WEB_BRANCH="$2"
         check_branch_exists "web" "$WEB_BRANCH" "$WEB_FORK"
-        DOCKER_BUILD_CMD+=" --build-arg WEB_BRANCH=$WEB_BRANCH"
+        BUILD_ARGS+=(--build-arg "WEB_BRANCH=$WEB_BRANCH")
         shift
         shift
         ;;
     -p | --paddbranch)
         PADD_BRANCH="$2"
         check_branch_exists "padd" "$PADD_BRANCH"
-        DOCKER_BUILD_CMD+=" --build-arg PADD_BRANCH=$PADD_BRANCH"
+        BUILD_ARGS+=(--build-arg "PADD_BRANCH=$PADD_BRANCH")
         shift
         shift
         ;;
     -cf | --corefork)
         CORE_FORK="$2"
-        DOCKER_BUILD_CMD+=" --build-arg CORE_FORK=$CORE_FORK"
+        BUILD_ARGS+=(--build-arg "CORE_FORK=$CORE_FORK")
         shift
         shift
         ;;
     -wf | --webfork)
         WEB_FORK="$2"
-        DOCKER_BUILD_CMD+=" --build-arg WEB_FORK=$WEB_FORK"
+        BUILD_ARGS+=(--build-arg "WEB_FORK=$WEB_FORK")
         shift
         shift
         ;;
     -pf | --paddfork)
         PADD_FORK="$2"
-        DOCKER_BUILD_CMD+=" --build-arg PADD_FORK=$PADD_FORK"
+        BUILD_ARGS+=(--build-arg "PADD_FORK=$PADD_FORK")
         shift
         shift
         ;;
     -t | --tag)
-        CUSTOM_TAG="$2"
-        DOCKER_BUILD_CMD=${DOCKER_BUILD_CMD/$TAG/$CUSTOM_TAG}
-        TAG=$CUSTOM_TAG
+        TAG="$2"
         shift
         shift
         ;;
     use_cache)
-        DOCKER_BUILD_CMD=${DOCKER_BUILD_CMD/--no-cache/}
+        USE_CACHE=true
         shift
         ;;
     *)
@@ -143,9 +144,14 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
+# Build the command as an array to avoid eval and shell injection
+DOCKER_BUILD_CMD=(docker buildx build src/. --tag "${TAG}" --load)
+[ "$USE_CACHE" = false ] && DOCKER_BUILD_CMD+=(--no-cache)
+DOCKER_BUILD_CMD+=("${BUILD_ARGS[@]}")
+
 # Execute the docker build command
-echo "Executing command: $DOCKER_BUILD_CMD"
-eval "${DOCKER_BUILD_CMD}"
+echo "Executing command: ${DOCKER_BUILD_CMD[*]}"
+"${DOCKER_BUILD_CMD[@]}"
 
 # Check exit code of previous command
 if [ $? -ne 0 ]; then