我如何告诉Linux bash忽略反引号？

Question

I'm writing a chef recipe that calls the mysql command and executes a query. The problem is that the query passed into this command can have backticks, and I have no control over that. EG I'll do something like this:

execute "update_customer_segment_custom_condition_#{no_space_segment_name}" do action :run command "mysql --user=#{user} #{db_name} --execute="CALL someStoredProcedure(\\"A String\\", \\"A QUERY CONTAINING BACKTICKS OVER WHICH I HAVE NO CONTROL THAT NEEDS TO BE PASSED VERBATIM\\");" end

but Bash always complains about the syntax because it tries to interpret the backticks and evaluate. How can I tell it to completely ignore that character?

FYI this is being called inside a chef execute block as a command , hence using # for variables.

Answer 1

You could also use an execute resource in Chef instead of bash . That won't use bash and thus backticks have no special meaning.

EDIT:

To be more specific with the example resource you posted

execute "update_customer_segment_custom_condition_#{no_space_segment_name}" do
  command ['mysql', "--user=#{user}", db_name, '--execute="CALL someStoredProcedure(\"A String\", \"A QUERY CONTAINING BACKTICKS OVER WHICH I HAVE NO CONTROL THAT NEEDS TO BE PASSED VERBATIM\");"']
end 

The array form for command shuts off any processing by the shell.

Answer 2

this is probably because you build a string with ruby (I dont' know ruby) and then pass it into a shell execute with action run

This already has a problem as your double quotes terminate in middle string:

command " mysql --user=#{user} #{db_name} --execute= "CALL someStoredProcedure(\\"A String\\", \\"A QUERY CONTAINING BACKTICKS OVER WHICH I HAVE NO CONTROL THAT NEEDS TO BE PASSED VERBATIM\\");"

so I wonder if ruby does not give a syntax error here for the supplemental " at the end.

the string you want to generate looks (probably) like this:

mysql --user=#{user} #{db_name} --execute="CALL someStoredProcedure(\"A String\", \"A QUERY\");"

you need to generate it like that:

mysql --user=#{user} #{db_name} --execute='CALL someStoredProcedure("A String", "A QUERY");"

And the part with "A QUERY" you need to replace all occurences of ' with '\\'' else you can still get a shell code injection.