From d2940eb8af510f6125677e31b1b2bd460e7d301a Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Tue, 28 Oct 2025 16:07:25 +0100
Subject: [PATCH] dns/rfc2136: mwexecf_bg, exec_safe and file_safe

PR: https://github.com/opnsense/core/issues/9325
---
 dns/rfc2136/src/etc/inc/plugins.inc.d/rfc2136.inc | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/dns/rfc2136/src/etc/inc/plugins.inc.d/rfc2136.inc b/dns/rfc2136/src/etc/inc/plugins.inc.d/rfc2136.inc
index bf346cd29..55c84297a 100644
--- a/dns/rfc2136/src/etc/inc/plugins.inc.d/rfc2136.inc
+++ b/dns/rfc2136/src/etc/inc/plugins.inc.d/rfc2136.inc
@@ -198,16 +198,15 @@ function rfc2136_configure_do($verbose = false, $int = null, $updatehost = '', $
         $upinst .= "\n";  /* mind that trailing newline! */
 
         if ($need_update) {
-            @file_put_contents("/var/etc/nsupdatecmds{$i}", $upinst);
-            unset($upinst);
-            /* invoke nsupdate */
-            $cmd = "/usr/local/bin/nsupdate -k {$keyfile}";
+            $cmds = "/var/etc/nsupdatecmds{$i}";
+            file_safe($cmds, $upinst);
+            $args = [];
+            $args[] = exec_safe('-k %s', $keyfile);
             if (isset($dnsupdate['usetcp'])) {
-                $cmd .= " -v";
+                $args[] = '-v';
             }
-            $cmd .= " /var/etc/nsupdatecmds{$i}";
-            mwexec_bg($cmd);
-            unset($cmd);
+            $args[] = exec_safe('%s', $cmds);
+            mwexecf_bg('/usr/local/bin/nsupdate ' . join(' ', $args));
         }
     }