I'm writing a shell script that should be somewhat secure i.e. does not pass secure data through parameters of commands and preferably does not use temporary files. How can I pass a variable to the stdin of a command? Or, if it's not possible, how to correctly use temporary files for such task?
Something as simple as:
echo "$blah" | my_cmd
-
7
-
2The
(cat <<END ... )
answer also works if the variable contains newlines. – Evgeni Sergeev Dec 10 '13 at 7:02 -
14Let's see how you handle
blah=-n
,blah=-e
... useprintf
instead. unix.stackexchange.com/questions/65803/… – Camilo Martin Jun 22 '14 at 4:33 -
2
-
266 years on, if I could delete this answer I would (but I can't because it's been accepted...) – Oliver Charlesworth Nov 15 '17 at 10:03
Passing a value to stdin
in bash is as simple as:
your-command <<< "$your_variable"
Always make sure you put quotes around variable expressions!
Be cautious, that this will probably work only in
bash
and will not work insh
.
-
41Herestrings
<<<
are not guaranteed to be available, they are not in POSIX base, as far as I know. They will work as expected, as long as your only running them inbash
. I only mention it, because they OP said 'shell' not specifically 'bash'. Although he did tag the question withbash
... so this still is obviously an acceptable answer. – J. M. Becker Aug 7 '12 at 13:38 -
While this may be the case, sensitive information is likely to be more easily leaked if using the
echo
method due to the creation of a pipe. The herestring command will be processed entirely bybash
, although in this situation (as as noted) you had better know that it will work on your bash, otherwise any error message produced as a result of not supporting herestrings would also leak said information. – Steven Lu Aug 13 '13 at 17:13 -
@StevenLu Wait,
echo
is a built-in. No pipe there, right? It's Unix, but it can't be that much Unix. – Camilo Martin Jun 22 '14 at 4:35 -
4@StevenLu
printf '%s\n' "$var"
produces the same results asecho "$var"
but won't break if, e.g.,var=-en
, and doesn't even require bash. – Camilo Martin Jun 23 '14 at 1:28 -
2
Note that the 'echo "$var" | command
operations mean that standard input is limited to the line(s) echoed. If you also want the terminal to be connected, then you'll need to be fancier:
{ echo "$var"; cat - ; } | command
( echo "$var"; cat - ) | command
This means that the first line(s) will be the contents of $var
but the rest will come from cat
reading its standard input. If the command does not do anything too fancy (try to turn on command line editing, or run like vim
does) then it will be fine. Otherwise, you need to get really fancy - I think expect
or one of its derivatives is likely to be appropriate.
The command line notations are practically identical - but the second semi-colon is necessary with the braces whereas it is not with parentheses.
-
( echo "$LIST"; cat - ) | sed 1q
this works for me but I need to press ctrl d when I run this script? – Gert Cuykens Oct 21 '12 at 23:44 -
Yes; the
cat -
continues to read from the keyboard until EOF or interrupt, so you need to tell it EOF by typing control-D. – Jonathan Leffler Oct 21 '12 at 23:48 -
-
You don't have to use
cat
at all if you don't want terminal input, as in the first line. Or you can usecat
to list a file. Or ... If you want the command to read terminal input, you have to tell it when it has reached the end of the input. Or you could use( echo "$var"; sed /quit/q - ) | command
; this continues until you type a line containing 'quit'. You can be endlessly inventive with how you handle it. Beware the old urban legend of a program that stopped working when the users began working with Ecuador. They'd type in the name of the capital, Quito, and the program exited. – Jonathan Leffler Oct 22 '12 at 0:17 -
OK if you say so. But why not just
echo "$LIST" | sed 1q | ...
? It all depends on what you're about. The<<EOF
notation should require an EOF at the start of a line on its own somewhere down the file. I'd not use it, I think — but I'm still not sure what you're trying to achieve. A simpleecho "$LIST" | command
orecho $LIST | command
will probably suffice in practice (and it is important that you know the significance of the difference between the two). – Jonathan Leffler Oct 22 '12 at 0:33
(cat <<END
$passwd
END
) | command
The cat
is not really needed, but it helps to structure the code better and allows you to use more commands in parentheses as input to your command.
-
But this method allows you to pass multiple lines to your command and also allows spaces in the
$passwd
– PoltoS Jan 25 '11 at 23:52 -
4This is the best answer so far that does not leak variable contents to pipe or process snooping. – user2688272 Mar 31 '17 at 17:06
I liked Martin's answer, but it has some problems depending on what is in the variable. This
your-command <<< """$your_variable"""
is better if you variable contains " or !
-
4But why? Also, I can't reproduce any problems:
foo1=-; foo2='"'; foo3=\!; cat<<<"$foo1"; cat<<<"$foo2"; cat<<<"$foo3"
works fine for me. What exactly do the three"
do? AFAIK you are just prepending and appending an empty string. – phk May 27 '16 at 8:22 -
Try something real. Like your command is ssh somehost. and your variable is a shell script. – Robert Jacobs Jan 30 '17 at 13:48
-
This robust and portable way has already appeared in comments. It should be a standalone answer.
printf '%s' "$var" | my_cmd
or
printf '%s\n' "$var" | my_cmd
Notes:
- It's better than
echo
, reasons are here: Why isprintf
better thanecho
? printf "$var"
is wrong. The first argument is format where various sequences like%s
or\n
are interpreted. To pass the variable right, it must not be interpreted as format.Usually variables don't contain trailing newlines. The former command (with
%s
) passes the variable as it is. However tools that work with text may ignore or complain about an incomplete line (see Why should text files end with a newline?). So you may want the latter command (with%s\n
) which appends a newline character to the content of the variable. Non-obvious facts:- Here string in Bash (
<<<"$var" my_cmd
) does append a newline. - Any method that appends a newline results in non-empty stdin of
my_cmd
, even if the variable is empty or undefined.
- Here string in Bash (
As per Martin's answer, there is a bash feature called Here Strings (which itself is a variant of the more widely supported Here Documents feature).
http://www.gnu.org/software/bash/manual/bashref.html#Here-Strings
3.6.7 Here Strings
A variant of here documents, the format is:
<<< word
The word is expanded and supplied to the command on its standard input.
Note that Here Strings would appear to be bash-only, so, for improved portability, you'd probably be better off with the original Here Documents feature, as per PoltoS's answer:
( cat <<EOF
$variable
EOF
) | cmd
Or, a simpler variant of the above:
(cmd <<EOF
$variable
EOF
)
You can omit (
and )
, unless you want to have this redirected further into other commands.
Try this:
echo "$variable" | command
-
but wouldn't the contents $variable show up in e.g. the output of
ps -u
when echo is running? – user283145 Jan 23 '11 at 18:31 -
2
-
2
-
Just do:
printf "$my_var" | my_cmd
If the var doesn't contain spaces then the quotes may be omitted.
If using bash then you may also do:
echo -n "$my_var" | my_cmd
Avoid using echo without -n because it will pipe the vraiable with an added linebreak at the end.
-
2doesn't work if $my_var is
%s
, printf won't print anything.my_var="%s"; printf "$my_var";
- maybe tryprintf "%s" "$my_var" | my_cmd
? – hanshenrik Sep 21 '18 at 14:38
$PATH
? So thatcat
can be replaced be/bin/cat "$@" | tee /attacker/can/read/this/file
– 12431234123412341234123 Jul 14 '17 at 10:20