Bypassing dnsmasq dhcp-script limitations for command execution in config injection attacks

When researching networking devices, I frequently encounter a particular vulnerability: the ability to inject arbitrary options into dnsmasq's config files. These devices often delegate functionality to dnsmasq, and when they allow users to set configuration options, they might perform basic templating to generate configuration files that are then fed to dnsmasq. If the device fails to properly encode user input, it may allow users to insert newline characters and inject arbitrary options into the config file.