Passing a password (cat) to sed to replace config value

Question

I have a config file called .env which contains:

DB_PASSWORD={password}

Within /root/.mysql/db00.yml.db we have a password for the MySQL root account. I'm trying to pipe this into sed along the lines of:

cat /root/.mysql/db00.yml.db | sed -i -e "s/DB_PASSWORD=/DB_PASSWORD=(.*)/g" .env

Not having any luck, tried a few variations like:

sed -i "s/DB_PASSWORD=/DB_PASSWORD=$(cat /root/.mysql/db00.yml.db)" .env

mysqlpwd=$(cat /root/.mysql/db00.yml.db)
# Use the variable in sed -i
sed -i "s/DB_PASSWORD=/DB_PASSWORD=$mysqlpwd/g" .env

This produces the error:

root@linuxbox:/var/www/www.example.com# mysqlpwd=$(cat /root/.mysql/db00.yml.db)
root@linuxbox:/var/www/www.example.com# sed -i "s/DB_PASSWORD=/DB_PASSWORD=$mysqlpwd/g" .env
sed: -e expression #1, char 33: unknown option to `s'

Update:

Running it without /g also fails:

root@linuxbox:/var/www/www.example.com# echo $mysqlpwd
Rjcr/Sn+s/a2QbGx
root@linuxbox:/var/www/www.example.com# cat .env | grep DB_PASSWORD
DB_PASSWORD=(.*)()
root@linuxbox:/var/www/www.example.com# sed -i "s/DB_PASSWORD=/DB_PASSWORD=$mysqlpwd/" .env
sed: -e expression #1, char 33: unknown option to `s'

None of these approaches seem to work.

I am running sed 4.7, i.e.:

root@linuxbox:/var/www/www.example.com# sed --version
sed (GNU sed) 4.7

Answer 1

Passwords, by their very nature, must be allowed to contain any character that can be reliably produced by a keyboard. This means that passwords can easily contain valid sed code, or strings that, when injected into a sed editing script, breaks that script, writes to arbitrary files on the system, or, with GNU sed, execute arbitrary commands (extra interesting when you're running as root, which you appear to be).

Don't use sed when you need to use user-supplied data, unless you know exactly how to sanitize it. I would personally avoid sed for anything that would require me to double quote the sed expression (instead of single-quote it) to allow the shell to expand a variable that I had little control over.

Instead, use awk:

awk -F '=' '
    BEGIN { OFS = FS }
    NR == FNR { password = $0; next }
    $1 == "DB_PASSWORD" { sub("=.*",""); $2 = password }; 1' /root/.mysql/db00.yml.db .env >.env.new &&
mv .env.new .env

This first reads the password from the first line of the first file (it's assumed that this only contains a single line with the verbatim password).

It then treats your .env file as a file of =-delimited fields.

When the first field on a line is DB_PASSWORD, it clears everything after the first = on the line (just in case the old password contains =), and inserts the password in as the second field.

All lines, whether modified or not, are outputted to .env.new, and this file then replaces the old .env with mv.

Crucially, I never use the data read from either of the two files as code in my awk program, and I never allow awk to treat any part of the password as special. Note that using the password as the replacement string in a call to sub() would be problematic as this would treat any & in the string as special.

Answer 2

Try using a different delimiter for sed ... There are still risks of it failing depending on your actual password (e.g. if it included | or & or \1).

sed -i "s|DB_PASSWORD=|DB_PASSWORD=$mysqlpwd|" .env

Answer 3

You should not put passwords in command line arguments; they can be read by any user on the system via ps or top or many other ways. I understand that may not be likely in some automation scenarios (because no one is likely to be logged into the box) but it's still a bad idea, and there's always the possibility that some monitoring tool or some script by someone else will happen to log the processes running on the system at some point in time—thereby logging your password to who knows where.

A good answer was already given using awk; I also wrote a simple solution using ex which I'll share. This will work for any password with any special characters with the sole exception that it can't end in a backslash.

If file .env contains:

somevar1=someval
somevar2=some other val
DB_PASSWORD=
somevar3=another val
somevar4=val

And myscript contains:

/^DB_PASSWORD=$/a
!@#$#% some complicated password "^$%^&@#,.,cmxz\k'dvok][
.
0//j!
x

Just run ex .env < myscript to get results as shown:

$ ex .env < myscript
$ cat .env
somevar1=someval
somevar2=some other val
DB_PASSWORD=!@#$#% some complicated password "^$%^&@#,.,cmxz\k'dvok][
somevar3=another val
somevar4=val
$ 

Answer 4

sed -i -e "
  /^DB_PASSWORD=/c\\
DB_PASSWORD=$(sed -e 's:[\\]:&&:g' /root/.mysql/db00.yml.db)
"  ./.env

• We integrate within the sed code itself the sanitising of the password for plug worthiness in the change command c\