Restrict the allowed names for plugins

rowbot

@@ -66,6 +66,10 @@ is_chan() {
   [[ ${msg_args[${1:-0}]:0:1} = \# ]]
 }
 
+is_good_variable() {
+  [[ $1 =~ ^[A-Za-z_][A-Za-z0-9_]+$ ]]
+}
+
 is_parent() {
   (( BASHPID == $$ ))
 }
@@ -771,6 +775,10 @@ irc_who() {
 ###
 
 plugin_reg() {
+  if ! is_good_variable irc_plugin_array_"$1"; then
+    return 1
+  fi
+
   declare -n plugins=irc_plugin_array_"$1"
   local plugin
 
@@ -790,11 +798,12 @@ plugin_reg() {
 plugin_run() {
   # This is a false positive.
   # shellcheck disable=SC2178
-  declare -n plugins=irc_plugin_array_"$1"
-  shift
-  local plugin
 
-  if [[ -v plugins ]]; then
+  if is_good_variable irc_plugin_array_"$1" && [[ -v irc_plugin_array_"$1" ]]; then
+    declare -n plugins=irc_plugin_array_"$1"
+    shift
+    local plugin
+
     for plugin in "${plugins[@]}"; do
       "$plugin" "$@"
     done