Prevent an injection attack in passing untrusted options to substituters

src/libstore/globals.cc

@@ -188,6 +188,10 @@ string Settings::pack()
 {
     string s;
     foreach (SettingsMap::iterator, i, settings) {
+        if (i->first.find('\n') != string::npos ||
+            i->first.find('=') != string::npos ||
+            i->second.find('\n') != string::npos)
+            throw Error("illegal option name/value");
         s += i->first; s += '='; s += i->second; s += '\n';
     }
     return s;