Metadata

ID: bash-security/avoid-echo-to-sed-pipeline

Language: Bash

Severity: Notice

Category: Security

CWE: 116

Related CWEs:

• 117
• 838

Description

Feeding shell-expanded text into sed through an echo pipeline adds another program and more quoting and parsing steps than doing the same work in the shell alone, which increases the risk of mistakes and injection vulnerabilities (CWE-116). When the change is essentially string substitution, Bash parameter expansion (${var/pat/repl}, ${var//pat/repl}, ${var/#pat/repl}, ${var/%pat/repl}) is often more readable and less error-prone.

Non-Compliant Code Examples

#!/bin/bash
echo "$var" | sed 's/foo/bar/g'
echo ${x} | /usr/bin/sed -e 's/1/2/'

Compliant Code Examples

#!/bin/bash
echo hello | sed -n '1p'
echo 'literal' | sed 's/a/b/'
out="${var//foo/bar}"
printf '%s\n' "$x" | sed 's/a/b/'
echo "$var" | sed 's/(foo)/bar/'
echo "$x" | sed 's/a/b/;s/c/d/'

Seamless integrations. Try Datadog Code Security

Datadog Code Security