trjhtr

I have some code that is loading passwords from AWS SSM and then using them through the script. I am really concerned that some funky password character is going to be used that is going to get interpreted/escaped/munged by bash. The code in question is below. Are there any obvious problems here? Can I improve this so that no password can trip this up?

updateEnvFile() 
 sed "s;url=jdbc:mysql://localhost/mysql;url=jdbc:mysql://$host/mysql;" 

updateConfig() 
 local dbs=$1
 for db in $dbs; do
 local user=$params["/databases/migrate/$env/$db.user"]
 local pass=$params["/databases/migrate/$env/$db.password"]
 local host=$params["/databases/migrate/$env/$db.host"]
 updateEnvFile "$user" "$pass" "$host" > "$bin/../environments/$db.properties"
 done

That cat is entirely unnecessary. Also, multiple pipes to sed are redundant.

sed by design can take a single long expression and process the data.

As for your delimiters, I'd suggest using non-printable characters when in sed:

SED_DELIM=$(echo -en "01")

and then:

sed "s$SED_DELIMurl=jdbc:mysql://localhost/mysql$SED_DELIMurl=jdbc:mysql://$host/mysql$SED_DELIM; s$SED_DELIMusername=root$SED_DELIMusername=$user$SED_DELIM; s$SED_DELIMpassword=my-secret-pw$SED_DELIMpassword=$pass$SED_DELIM" $file_name

Now, that looks quite long. You can evaluate individual expressions:

sed -e "s$SED_DELIMurl=jdbc:mysql://localhost/mysql$SED_DELIMurl=jdbc:mysql://$host/mysql$SED_DELIM;" 
-e "s$SED_DELIMusername=root$SED_DELIMusername=$user$SED_DELIM;" 
-e "s$SED_DELIMpassword=my-secret-pw$SED_DELIMpassword=$pass$SED_DELIM" 
$file_name

I'll go ahead and also use back-references:

sed -e "s$SED_DELIM(url=jdbc:mysql://)localhost(/mysql)$SED_DELIM1$host2$SED_DELIM;" 
-e "s$SED_DELIM(username=)root$SED_DELIM1$user$SED_DELIM;" 
-e "s$SED_DELIM(password=)my-secret-pw$SED_DELIM1$pass$SED_DELIM" 
$file_name

Do you really pass a single argument with space-separated names to updateConfig like this?:

updateConfig "db1 db2 db3"

It would be simpler to let the function accept any number of arguments, then the loop becomes simply

for db
do
 #...
done

(in "$@" is inferred)

I'm not a fan of the repetition of /databases/migrate/$env/$db - consider a local variable for that:

local basepath="/databases/migrate/$env/$db"
for db; do
 local user=$params["$basepath.user"]
 local pass=$params["$basepath.password"]
 local host=$params["$basepath.host"]
 updateEnvFile "$user" "$pass" "$host" >"$bin/../environments/$db.properties"
done

When substituting shell variables using sed s command, be sure to transform the replacement to quote any backslashes or separators in the substitution:

updateEnvFile() 
 local user=$1//\/\\
 local pass=$2//\/\\
 local host=$3//\/\\

 sed -e "/^url=/s;localhost;$host//;/\;;" 
 -e "/^username=/s;=.*;=$user//;/\;;" 
 -e "/^password=/s;=.*;=$pass//;/\;;" 
 "$bin/../environments/development.properties"

I've also combined your long pipeline into a singled sed invocation, and simplified each replacement to separate the matching and replacement parts.