JSON 字符串处理注入引号

问题描述 投票：0回答：1

我通过 Vaulwarden 实例的 UUID 获取 json 编码的秘密。 我想要循环任何 uuid 并相应地设置环境变量。

每个字段都应该有变量（见下文）

uuid_USERNAME=username
uuid_PASSWORD=password
uuid_FIELD_fieldname=fieldvalue
...

echo 确实注入单引号，以便脚本在 for 循环中中断，ehich 设置这些基于字段的环境变量。

任何人都可以给我提示如何处理这种情况吗？

致以诚挚的问候！

这是脚本：

#!/bin/bash
for item in 55f8864a-ec88-410c-ab0e-8bee2119042a
do
  entry='{"passwordHistory":[{"lastUsedDate":"2024-02-23T17:10:59.343Z","password":"versteckt_name-leerzeichen: versteckt_wert leerzeichen"},{"lastUsedDate":"2024-02-23T17:10:59.343Z","password":"TestPasswort"},{"lastUsedDate":"2024-02-23T16:45:56.662Z","password":"versteckt_name leerzeichen: versteckt_wert leerzeichen"},{"lastUsedDate":"2024-02-23T16:28:04.951Z","password":"versteckt_name: versteckt_wert"}],"revisionDate":"2024-02-23T17:14:48.810Z","creationDate":"2024-02-18T21:04:02.811Z","deletedDate":null,"object":"item","id":"55f8864a-ec88-410c-ab0e-8bee2119042a","organizationId":null,"folderId":null,"type":1,"reprompt":0,"name":"TestName","notes":"notizen notizen1 notizen2","favorite":false,"fields":[{"name":"benutzerdefiniert_name leerzeichen","value":"benutzerdefiniert_wert leerzeichen","type":0,"linkedId":null},{"name":"versteckt_name leerzeichen","value":"versteckt_wert leerzeichen","type":1,"linkedId":null},{"name":"bool_name leerzeichen","value":"false","type":2,"linkedId":null}],"login":{"fido2Credentials":[],"uris":[],"username":"TestBenutzername leerzeichen","password":"TestPasswort leerzeichen","totp":null,"passwordRevisionDate":"2024-02-23T17:10:59.343Z"},"collectionIds":[]}'
  echo $entry
  echo ${item}_USERNAME=$(echo ${entry} | jq -r ".login.username")  > GITHUB_ENV
  echo ${item}_PASSWORD=$(echo $entry | jq -r ".login.password")  >> GITHUB_ENV
  echo ${item}_NOTES=$(echo $entry | jq -r ".notes | select( . != null )") >> GITHUB_ENV
  for field in $(echo $entry | jq -cr .fields[])
  do
    echo $field
    field_name=$(echo $field | jq -r ".name" | sed -e "s/ /_/g")
    field_value=$(echo $field | jq -r ".value")
    echo ${item}_FIELD_${field_name}=${field_value} >> GITHUB_ENV
  done
done

这是 Pretty 中的 JSON：

{
  "passwordHistory": [
    {
      "lastUsedDate": "2024-02-23T17:10:59.343Z",
      "password": "versteckt_name-leerzeichen: versteckt_wert leerzeichen"
    },
    {
      "lastUsedDate": "2024-02-23T17:10:59.343Z",
      "password": "TestPasswort"
    },
    {
      "lastUsedDate": "2024-02-23T16:45:56.662Z",
      "password": "versteckt_name leerzeichen: versteckt_wert leerzeichen"
    },
    {
      "lastUsedDate": "2024-02-23T16:28:04.951Z",
      "password": "versteckt_name: versteckt_wert"
    }
  ],
  "revisionDate": "2024-02-23T17:14:48.810Z",
  "creationDate": "2024-02-18T21:04:02.811Z",
  "deletedDate": null,
  "object": "item",
  "id": "55f8864a-ec88-410c-ab0e-8bee2119042a",
  "organizationId": null,
  "folderId": null,
  "type": 1,
  "reprompt": 0,
  "name": "TestName",
  "notes": "notizen notizen1 notizen2",
  "favorite": false,
  "fields": [
    {
      "name": "benutzerdefiniert_name leerzeichen",
      "value": "benutzerdefiniert_wert leerzeichen",
      "type": 0,
      "linkedId": null
    },
    {
      "name": "versteckt_name leerzeichen",
      "value": "versteckt_wert leerzeichen",
      "type": 1,
      "linkedId": null
    },
    {
      "name": "bool_name leerzeichen",
      "value": "false",
      "type": 2,
      "linkedId": null
    }
  ],
  "login": {
    "fido2Credentials": [],
    "uris": [],
    "username": "TestBenutzername leerzeichen",
    "password": "TestPasswort leerzeichen",
    "totp": null,
    "passwordRevisionDate": "2024-02-23T17:10:59.343Z"
  },
  "collectionIds": []
}

这是输出：

55f8864a-ec88-410c-ab0e-8bee2119042a_USERNAME=TestBenutzername leerzeichen
55f8864a-ec88-410c-ab0e-8bee2119042a_PASSWORD=TestPasswort leerzeichen
55f8864a-ec88-410c-ab0e-8bee2119042a_NOTES=notizen notizen1 notizen2
{"name":"benutzerdefiniert_name
jq: parse error: Unfinished string at EOF at line 2, column 0
jq: parse error: Unfinished string at EOF at line 2, column 0
55f8864a-ec88-410c-ab0e-8bee2119042a_FIELD_=
leerzeichen","value":"benutzerdefiniert_wert
jq: parse error: Invalid numeric literal at line 1, column 12
jq: parse error: Invalid numeric literal at line 1, column 12
55f8864a-ec88-410c-ab0e-8bee2119042a_FIELD_=
leerzeichen","type":0,"linkedId":null}
jq: parse error: Invalid numeric literal at line 1, column 12
jq: parse error: Invalid numeric literal at line 1, column 12
55f8864a-ec88-410c-ab0e-8bee2119042a_FIELD_=
{"name":"versteckt_name
jq: parse error: Unfinished string at EOF at line 2, column 0
jq: parse error: Unfinished string at EOF at line 2, column 0
55f8864a-ec88-410c-ab0e-8bee2119042a_FIELD_=
leerzeichen","value":"versteckt_wert
jq: parse error: Invalid numeric literal at line 1, column 12
jq: parse error: Invalid numeric literal at line 1, column 12
55f8864a-ec88-410c-ab0e-8bee2119042a_FIELD_=
leerzeichen","type":1,"linkedId":null}
jq: parse error: Invalid numeric literal at line 1, column 12
jq: parse error: Invalid numeric literal at line 1, column 12
55f8864a-ec88-410c-ab0e-8bee2119042a_FIELD_=
{"name":"bool_name
jq: parse error: Unfinished string at EOF at line 2, column 0
jq: parse error: Unfinished string at EOF at line 2, column 0
55f8864a-ec88-410c-ab0e-8bee2119042a_FIELD_=
leerzeichen","value":"false","type":2,"linkedId":null}
jq: parse error: Invalid numeric literal at line 1, column 12
jq: parse error: Invalid numeric literal at line 1, column 12
55f8864a-ec88-410c-ab0e-8bee2119042a_FIELD_=

我尝试执行这个脚本并尝试了不同的方法，例如

echo <<< $entry
或将输出通过管道传输到文件中，然后对它们进行分类，但这并没有达到目的。

变量应该按照上面提到的方式设置。

json bash jq echo
1个回答
0
投票

您询问的问题是 

$(echo $entry | jq -cr .fields[])
的输出在空格、制表符和换行符上被分割。您希望它仅在换行符上分割。

解决此问题的一个简单方法是改用 

read
。

其他变化：

  • 修复了一系列注入错误。 （仍然假设所有变量名称都是有效的。）
  • 不同的
    echo
    做不同的事情。最好避免它，以免出现意外。
#!/bin/bash

# to_shell_lit() - Creates a shell literal
# Usage:  printf '%s\n' "...$( to_shell_lit "..." )..."
to_shell_lit() {
    printf \'
    printf %s "$1" | sed "s/'/'\\\\''/g"
    printf \'
}

output_var() {
   printf '%s=%s\n' "$1" "$( to_shell_lit "$2" )"
}

exec >GITHUB_ENV

for item in 55f8864a-ec88-410c-ab0e-8bee2119042a; do
   entry='{"passwordHistory":[{"lastUsedDate":"2024-02-23T17:10:59.343Z","password":"versteckt_name-leerzeichen: versteckt_wert leerzeichen"},{"lastUsedDate":"2024-02-23T17:10:59.343Z","password":"TestPasswort"},{"lastUsedDate":"2024-02-23T16:45:56.662Z","password":"versteckt_name leerzeichen: versteckt_wert leerzeichen"},{"lastUsedDate":"2024-02-23T16:28:04.951Z","password":"versteckt_name: versteckt_wert"}],"revisionDate":"2024-02-23T17:14:48.810Z","creationDate":"2024-02-18T21:04:02.811Z","deletedDate":null,"object":"item","id":"55f8864a-ec88-410c-ab0e-8bee2119042a","organizationId":null,"folderId":null,"type":1,"reprompt":0,"name":"TestName","notes":"notizen notizen1 notizen2","favorite":false,"fields":[{"name":"benutzerdefiniert_name leerzeichen","value":"benutzerdefiniert_wert leerzeichen","type":0,"linkedId":null},{"name":"versteckt_name leerzeichen","value":"versteckt_wert leerzeichen","type":1,"linkedId":null},{"name":"bool_name leerzeichen","value":"false","type":2,"linkedId":null}],"login":{"fido2Credentials":[],"uris":[],"username":"TestBenutzername leerzeichen","password":"TestPasswort leerzeichen","totp":null,"passwordRevisionDate":"2024-02-23T17:10:59.343Z"},"collectionIds":[]}'
   output_var "${item}_USERNAME" "$( printf '%s' "$entry" | jq -r '.login.username' )"
   output_var "${item}_PASSWORD" "$( printf '%s' "$entry" | jq -r '.login.password' )"
   output_var "${item}_NOTES"    "$( printf '%s' "$entry" | jq -r '.notes | select( . != null )' )"
   printf '%s' "$entry" | jq -cr '.fields[]' | while read -r field; do
     field_name=$( printf '%s' "$field"  | jq -r '.name | gsub( " "; "_" )' )
     field_value=$( printf '%s' "$field" | jq -r '.value' )
     output_var "${item}_FIELD_${field_name}" "$field_value"
   done
done
最新问题
© www.soinside.com 2019 - 2024. All rights reserved.