Whats the best way to strip grave accents from bash scripts

Question

I have a bash script which runs as root:

#!/bin/bash
/var/bin/svn_co -h $1 >> /var/log/svn/status.log

If the following should somehow occur, I'm in trouble.

/var/svn/hooks.d/post-commit -h `rm / -fr`

I would like to take rm / -fr and remove all instances of ` from it.

How does one simply strip the grave accent? Or, even better, how does one validate variables and options provided as input?

Ignacio Vazquez-Abrams · Answer 1 · 2012-05-09 22:07:11Z

up vote 3 down vote

This is one of the reasons why we use quotes.

/var/bin/svn_co -h "$1" >> /var/log/svn/status.log

answered May 9 '12 at 22:07

Ignacio Vazquez-Abrams
26.9k12139

	Sometimes even double quotes. :) – jscott May 9 '12 at 22:56
	But a string with backticks in it will stay literal anyway unless eval'd, just tried it. The quotes are necessary for other reasons though (whitespace can otherwise easily add unintended arguments to svn_co!). For really paranoid filtering, something like var=${var//[^[:alpha:]]/} (thanks again to another posters hint at regex brace subst!) would probably come closest, at least does not require you to echo or pre expand it into sed, tr etc... – rackandboneman May 9 '12 at 23:24
	The double-quotes around the arguments makes sense. Another thing to note is (based on a previous question) In sudoers I permitted www-data to run the post-commit as root: `www-data ALL = (root) NOEXEC:NOPASSWD: /var/svn/hooks.d/post-commit` Looking at answers from that post, and those above this seems to be more related to how the programme is being executed. Would a better solution be: `/var/bin/svn_co -h "$1" >> /var/log/svn/status.log` as suggested above. In addition `www-data ALL = (root) NOEXEC:NOPASSWD: /var/bin/svn_co` therefore by the time $1 reaches `svn_co` it should be safe? – Ash May 10 '12 at 8:20

1 Answer