Shell – Do I need to encapsulate awk variables in quotes in order to sanitize them

awkquotingSecurityshellshell-script

As per an answer on stackoverflow, it's my understanding that encapsulating bash variables in double-quotes is a fairly safe way of sanitizing user input.

What about awk variables? For example, if I have something like: 

awk -v SOURCEIP="$SOURCEIP" -v REVERSEDNS="$REVERSEDNS" '{
   gsub(/^_TMPSOURCEIP_/, SOURCEIP);
   gsub(/^_TMPREVERSEDNS_/, REVERSEDNS);
   print
}' /home/foo/footemplate

Should I put quotes around the variable in the gsub lines? So it would then look like: 

awk -v SOURCEIP="$SOURCEIP" -v REVERSEDNS="$REVERSEDNS" '{
   gsub(/^_TMPSOURCEIP_/, "SOURCEIP");
   gsub(/^_TMPREVERSEDNS_/, "REVERSEDNS");
   print
}' /home/foo/footemplate

Or does this not make a difference?

Best Answer

These two examples demonstrate the difference:

$ echo _TMP_ | awk -v VAR='some "text"' '{ gsub(/_TMP_/, VAR) ; print }'
some "text"
$ echo _TMP_ | awk -v VAR='some "text"' '{ gsub(/_TMP_/, "VAR") ; print }'
VAR

When VAR is unquoted, awk treats it as a variable with the value some "text". When VAR is inside quotes, awk treats it as a three-character string.

MORE: bash has sanitizing issues. Consider:

$ VAR="rm important_file" ; $VAR

The above will erase important_file. In this way, bash is like a macro language: it will substitute for a variable and then try to execute the result. awk is different. Consider:

$ echo _TMP_ | awk -v VAR='var); print $1' '{ gsub(/_TMP_/, VAR) ; print }'
var); print $1

awk treats VAR like mere text, not like potential commands to execute.

Problems can arise, however, if one lets bash modify the awk script. In my examples above, the awk scripts were all in single-quotes. That prevents bash from messing with them.

Related Question