Bash evaluation using crazy passwords

Question

I have some code that is loading passwords from AWS SSM and then using them through the script. I am really concerned that some funky password character is going to be used that is going to get interpreted/escaped/munged by bash. The code in question is below. Are there any obvious problems here? Can I improve this so that no password can trip this up?

updateEnvFile() {
    local user=$1
    local pass=$2
    local host=$3

    cat "${bin}/../environments/development.properties" |
    sed "s;url=jdbc:mysql://localhost/mysql;url=jdbc:mysql://$host/mysql;" |
    sed "s/username=root/username=$user/" | sed "s/password=my-secret-pw/password=$pass/"
}

updateConfig() {
    local dbs=$1
    for db in ${dbs}; do
        local user=${params["/databases/migrate/${env}/${db}.user"]}
        local pass=${params["/databases/migrate/${env}/${db}.password"]}
        local host=${params["/databases/migrate/${env}/${db}.host"]}
        updateEnvFile "${user}" "${pass}" "${host}" > "${bin}/../environments/${db}.properties"
    done
}

Answer 1

Do you really pass a single argument with space-separated names to updateConfig like this?:

updateConfig "db1 db2 db3"

It would be simpler to let the function accept any number of arguments, then the loop becomes simply

for db
do
    #...
done

(in "$@" is inferred)

---

I'm not a fan of the repetition of /databases/migrate/${env}/${db} - consider a local variable for that:

local basepath="/databases/migrate/$env/$db"
for db; do
    local user=${params["$basepath.user"]}
    local pass=${params["$basepath.password"]}
    local host=${params["$basepath.host"]}
    updateEnvFile "$user" "$pass" "$host" >"$bin/../environments/$db.properties"
done

---

When substituting shell variables using sed s command, be sure to transform the replacement to quote any backslashes or separators in the substitution:

updateEnvFile() {
    local user=${1//\\/\\\\}
    local pass=${2//\\/\\\\}
    local host=${3//\\/\\\\}

    sed -e "/^url=/s;localhost;${host//;/\\;};" \
        -e  "/^username=/s;=.*;=${user//;/\\;};" \
        -e "/^password=/s;=.*;=${pass//;/\\;};" \
        "$bin/../environments/development.properties"
}

I've also combined your long pipeline into a singled sed invocation, and simplified each replacement to separate the matching and replacement parts.

Answer 2

That cat is entirely unnecessary. Also, multiple pipes to sed are redundant.

sed by design can take a single long expression and process the data.

As for your delimiters, I'd suggest using non-printable characters when in sed:

SED_DELIM=$(echo -en "\001")

and then:

sed "s${SED_DELIM}url=jdbc:mysql://localhost/mysql${SED_DELIM}url=jdbc:mysql://$host/mysql${SED_DELIM}; s${SED_DELIM}username=root${SED_DELIM}username=$user${SED_DELIM}; s${SED_DELIM}password=my-secret-pw${SED_DELIM}password=$pass${SED_DELIM}" $file_name

Now, that looks quite long. You can evaluate individual expressions:

sed -e "s${SED_DELIM}url=jdbc:mysql://localhost/mysql${SED_DELIM}url=jdbc:mysql://$host/mysql${SED_DELIM};" \
-e "s${SED_DELIM}username=root${SED_DELIM}username=$user${SED_DELIM};" \
-e "s${SED_DELIM}password=my-secret-pw${SED_DELIM}password=$pass${SED_DELIM}" \
$file_name

I'll go ahead and also use back-references:

sed -e "s${SED_DELIM}\(url=jdbc:mysql://\)localhost\(/mysql\)${SED_DELIM}\1$host\2${SED_DELIM};" \
-e "s${SED_DELIM}\(username=\)root${SED_DELIM}\1$user${SED_DELIM};" \
-e "s${SED_DELIM}\(password=\)my-secret-pw${SED_DELIM}\1$pass${SED_DELIM}" \
$file_name