Bash evaluation using crazy passwords I have some code that is loading passwords from AWS SSM and then using them through the script. I am really concerned that some funky password character is going to be used that is going to get interpreted/escaped/munged by bash. The code in question is below. Are there any obvious problems here? Can I improve this so that no password can trip this up?

updateEnvFile() {
    local user=$1
    local pass=$2
    local host=$3

    cat "${bin}/../environments/development.properties" |
    sed "s;url=jdbc:mysql://localhost/mysql;url=jdbc:mysql://$host/mysql;" |
    sed "s/username=root/username=$user/" | sed "s/password=my-secret-pw/password=$pass/"
}

updateConfig() {
    local dbs=$1
    for db in ${dbs}; do
        local user=${params["/databases/migrate/${env}/${db}.user"]}
        local pass=${params["/databases/migrate/${env}/${db}.password"]}
        local host=${params["/databases/migrate/${env}/${db}.host"]}
        updateEnvFile "${user}" "${pass}" "${host}" &gt; "${bin}/../environments/${db}.properties"
    done
}
That cat is entirely unnecessary. Also, multiple pipes to sed are redundant.

sed by design can take a single long expression and process the data.

As for your delimiters, I'd suggest using non-printable characters when in sed:

SED_DELIM=$(echo -en "\001")


and then:

sed "s${SED_DELIM}url=jdbc:mysql://localhost/mysql${SED_DELIM}url=jdbc:mysql://$host/mysql${SED_DELIM}; s${SED_DELIM}username=root${SED_DELIM}username=$user${SED_DELIM}; s${SED_DELIM}password=my-secret-pw${SED_DELIM}password=$pass${SED_DELIM}" $file_name


Now, that looks quite long. You can evaluate individual expressions:

sed -e "s${SED_DELIM}url=jdbc:mysql://localhost/mysql${SED_DELIM}url=jdbc:mysql://$host/mysql${SED_DELIM};" \
-e "s${SED_DELIM}username=root${SED_DELIM}username=$user${SED_DELIM};" \
-e "s${SED_DELIM}password=my-secret-pw${SED_DELIM}password=$pass${SED_DELIM}" \
$file_name


I'll go ahead and also use back-references:

sed -e "s${SED_DELIM}\(url=jdbc:mysql://\)localhost\(/mysql\)${SED_DELIM}\1$host\2${SED_DELIM};" \
-e "s${SED_DELIM}\(username=\)root${SED_DELIM}\1$user${SED_DELIM};" \
-e "s${SED_DELIM}\(password=\)my-secret-pw${SED_DELIM}\1$pass${SED_DELIM}" \
$file_name