Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a bash script which runs as root:

#!/bin/bash
/var/bin/svn_co -h $1 >> /var/log/svn/status.log

If the following should somehow occur, I'm in trouble.

/var/svn/hooks.d/post-commit -h `rm / -fr`

I would like to take rm / -fr and remove all instances of ` from it.

How does one simply strip the grave accent? Or, even better, how does one validate variables and options provided as input?

share|improve this question

1 Answer 1

This is one of the reasons why we use quotes.

/var/bin/svn_co -h "$1" >> /var/log/svn/status.log
share|improve this answer
    
Sometimes even double quotes. :) –  jscott May 9 '12 at 22:56
    
But a string with backticks in it will stay literal anyway unless eval'd, just tried it. The quotes are necessary for other reasons though (whitespace can otherwise easily add unintended arguments to svn_co!). For really paranoid filtering, something like var=${var//[^[:alpha:]]/} (thanks again to another posters hint at regex brace subst!) would probably come closest, at least does not require you to echo or pre expand it into sed, tr etc... –  rackandboneman May 9 '12 at 23:24
    
The double-quotes around the arguments makes sense. Another thing to note is (based on a previous question) In sudoers I permitted www-data to run the post-commit as root: www-data ALL = (root) NOEXEC:NOPASSWD: /var/svn/hooks.d/post-commit Looking at answers from that post, and those above this seems to be more related to how the programme is being executed. Would a better solution be: /var/bin/svn_co -h "$1" >> /var/log/svn/status.log as suggested above. In addition www-data ALL = (root) NOEXEC:NOPASSWD: /var/bin/svn_co therefore by the time $1 reaches svn_co it should be safe? –  Ash May 10 '12 at 8:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.