How to execute a bash command stored as a string with quotes and asterisk

Executing Bash Commands with Quotes and Asterisks from a String

Learn how to safely and effectively execute bash commands stored as a string, particularly when they contain special characters like quotes and asterisks, avoiding common pitfalls.

Executing shell commands programmatically from within scripts is a common task. However, when these commands are stored as a string, especially if they contain special characters like quotes, spaces, and globbing patterns (e.g., asterisks), it can lead to unexpected behavior or security vulnerabilities. This article explores the challenges and robust solutions for correctly interpreting and executing such bash commands.

The Challenge of Special Characters

Bash interprets special characters like single quotes ('), double quotes ("), and the asterisk (*) for various purposes, including string literal definition, variable expansion, and filename globbing. When a command containing these characters is stored in a single string variable, the shell's parsing rules can become complex, leading to incorrect execution if not handled properly. For instance, an asterisk might expand to filenames when you intend it to be a literal character, or quotes might be stripped, altering the command's arguments.

command_string='echo "Hello World" *'

A command string with quotes and an asterisk

If you simply try to execute eval $command_string, the shell will first expand $command_string, then re-parse the result. This re-parsing step is where issues arise, as the quotes might be re-interpreted or stripped, and the asterisk might perform globbing in the current directory, which is usually not the desired behavior when the command is designed to be a literal string.

Solution 1: Using eval with Caution

The eval command forces the shell to re-evaluate its arguments as a new command. While powerful, it's also notoriously dangerous due to potential code injection if the string content is untrusted. However, for trusted, static command strings, eval can work if the string is carefully constructed to preserve quoting.

command_string='echo "Hello World" \*' # Escaping the asterisk
eval "$command_string"

Using eval with an escaped asterisk. Note: This still has limitations.

Execution flow using eval

Solution 2: Using an Array for Robustness

The most robust and recommended way to handle commands with special characters is to store the command and its arguments in a bash array. Each element of the array represents a single argument, preserving spaces, quotes, and other special characters exactly as intended. This bypasses the re-parsing issues associated with a single string.

command_array=("echo" "Hello World" "*") # Asterisk is treated as a literal

# To execute:
"${command_array[@]}"

Storing command and arguments in a bash array for safe execution.

When you execute "${command_array[@]}", bash expands each array element into a separate word, effectively reconstructing the command with its arguments without an intermediate parsing step that could misinterpret special characters. This is the safest method for handling commands with complex arguments.

Execution flow using a bash array

Handling Dynamic Commands

What if the command string itself is generated dynamically and you cannot directly construct an array from its components? In such cases, if you absolutely must parse a string into an array, read -a or a function that manually parses arguments might be necessary. However, this reintroduces parsing challenges. A safer approach for dynamic commands is to build the array incrementally or use printf %q to safely quote arguments if they need to be passed through an intermediate string.

# NOT RECOMMENDED FOR UNTRUSTED INPUT
dynamic_command_string='echo "Another Example" file*.txt'

# Using a function to parse (still risky with untrusted input)
parse_command() {
  local -n _cmd_array=$1 # nameref for output array
  _cmd_array=()
  while IFS= read -r -d '' arg; do
    _cmd_array+=("$arg")
  done < <(printf '%s\0' $2)
}

# Example usage:
# declare -a my_parsed_command
# parse_command my_parsed_command "$dynamic_command_string"
# "${my_parsed_command[@]}"

# A slightly safer alternative for known strings without globbing issues
# read -r -a command_array <<< "$dynamic_command_string"
# "${command_array[@]}" # This still performs word splitting and globbing on dynamic_command_string

Advanced (and risky) methods for parsing dynamic command strings into an array.

1. Step 1

Identify if your command contains special characters like quotes, spaces, or asterisks.

2. Step 2

If the command is static and trusted, store its components (command name and each argument) in a bash array.

3. Step 3

Execute the command using the array syntax: "${command_array[@]}".

4. Step 4

Avoid eval unless absolutely necessary and only with fully trusted, sanitized input.

5. Step 5

For dynamic command generation, prioritize building the command directly into an array rather than parsing a single string.