Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • 1
    In case this isn't clear from the answers, your problem is that a "here document" (<<EOF) acts like an ordinary input redirection (< file), and source < file doesn't work -- source needs to have a filename argument. Therefore, you need process substitution (<(command)), which looks like a filename argument. Commented Oct 9, 2014 at 17:27
  • An approach that's easy to make visibly safe: while IFS== read -r var value; do case $var in |*[!0-9A-Z_a-z]*) complain;; *) eval "config_$var=\$value";; esac; done <config (warning: typed in my browser, test it!) Don't forget not to allow importing variables like PATH, IFS, … A prefix like config_ is a safe approach. Commented Oct 9, 2014 at 22:13
  • +1 Although external control of configuration files in itself may be a symptom of more serious security issues that input validation alone is not sufficient to address. This, however, would have other uses as well apart from the security aspects. Commented Oct 10, 2014 at 8:18
  • @G-Man - you dont need process substitution - which differs from a standard pipe mainly in that rather than passing data to a process's stdin it hands a process a link to its stdout as an argument, generally in the form /dev/fd/[num]. Emulating this is simple: 3<<HEREDOC . /dev/fd/3\n*file contents*\nHEREDOC\n. Process substitution usually is a pipe, whereas heredocs are usually tmpfiles the shell deletes before handing them off - so they only exist as descriptors. in dash they are pipes. the other big difference is you can specify fd [num] for heredocs. Commented Oct 10, 2014 at 10:00