I\'m writing a shell script that should be somewhat secure i.e. does not pass secure data through parameters of commands and preferably does not use temporary files. How can
Something as simple as:
echo "$blah" | my_cmd
Passing a value to stdin
in bash is as simple as:
your-command <<< "$your_variable"
Always make sure you put quotes around variable expressions!
Be cautious, that this will probably work only in
bash
and will not work insh
.
Note that the 'echo "$var" | command
operations mean that standard input is limited to the line(s) echoed. If you also want the terminal to be connected, then you'll need to be fancier:
{ echo "$var"; cat - ; } | command
( echo "$var"; cat - ) | command
This means that the first line(s) will be the contents of $var
but the rest will come from cat
reading its standard input. If the command does not do anything too fancy (try to turn on command line editing, or run like vim
does) then it will be fine. Otherwise, you need to get really fancy - I think expect
or one of its derivatives is likely to be appropriate.
The command line notations are practically identical - but the second semi-colon is necessary with the braces whereas it is not with parentheses.