| Newsgroups |
gmane.editors.sed.user |
| Message-ID |
<[email protected]> |
On 16Sep2017 11:52, Jim Hill <[email protected]> wrote:
>Yes, that's correct, I see I didn't cc: the list when I sent the
>EOD-quoting correction to the OP, oops^2.
>
>The ` *` change is a definite improvement, thanks.
>
> sed '/^</!{H;$!d};x;1d;s/.*\n$date *= *"\([^"]*\).*/cat >\1.data
><<\\EOD\n&\nEOD/' t.data
>
>Is something like this not in the sed oneliners?
Because it is so dangerous. Doing it with the shell is just what I might
consider doing, with some big glaring cautions, sufficent to change approaches.
First, make it clear to the people trying to use this script that you _do_ need
to quote the data markers (the "EOD"). I see you'd done that, avoiding $subst
in the data. Good.
But second, and this is critical, you need to be absolutely totally sure that
the marker "EOD" does not appear in the source data.
If it does appear then (a) the data will terminate earlier (just annoying) but
(b) critically, the following data will be fed to your shell as commands.
So recipes like this are VERY VERY prone to injection attacks.
Now, you _could_ do some kind of transform on the data to escape in some sense
the "EOD" marker, and undo it in the shell script. But that is hazard prone in
that it is easy to get wrong.
Because of this I would probably sidestep sed and go straight to Python or the
like where I don't need to risk interpreting data as commands.
Cheers,
Cameron Simpson <[email protected]> (formerly [email protected])