在bash中扩展字符串变量以切换JSON中的值

Question

I am trying to create a bash function where I can switch environments, below is what I tried. I installed the npm json package globally to edit the relevant file inline, but that may not be needed.

devUrl () { 'https://some-url.com'; }
testUrl () { 'https://some-test-url.com'; }
switchEnv () { 'json -I -f config.json -e "this.url = (this.url == "$1" ? "$2" : "$1")"'; }
alias switch='switchEnv devUrl testUrl';

what am I missing/doing wrong?

I also tried to template the strings devUrl and testUrl inside the double quotes in the switchEnv function, but that's where I got stuck.

Update:

I tried this:

devUrl='https://some-url.com'
testUrl='https://some-test-url.com'
switchEnv() { json -I -f config.json -e "this.url = (this.url == "$devUrl" ? "$testUrl" : "$devUrl")"; }

but got the following error:

this.url = (this.url == https://some-url.com ? https://some-test-url.com : https://some-url.com)
                             ^

SyntaxError: Unexpected token :
    at new Function (<anonymous>)
    at main (/usr/local/lib/node_modules/json/lib/json.js:1289:27)

it doesn't like the : after https for some reason.

Answer 1

The below is a sample implementation that does what you're looking for; see the notes below for some details on why it was implemented as it was.

# String assignments
devUrl='https://some-url.com'
testUrl='https://some-test-url.com'
configFile="$PWD/config.json"

# Functions
switchEnv() {
  local tempfile
  tempfile=$(mktemp "$configFile.XXXXXX")
  if jq --arg a "$1" \
        --arg b "$2" \
        'if .url == $a then .url=$b else .url=$a end' <"$configFile" >"$tempfile"; then
    mv -- "$tempfile" "$configFile"
  else
    rm -f -- "$tempfile"
    return 1
  fi
}
switch() { switchEnv "$devUrl" "$testUrl"; }

---

Notes:

• Unlike aliases, function bodies should be actual code, not strings containing code.
• Storing data (as opposed to code) should be done using variables (be they strings or arrays, as appropriate).
• Passing data out-of-band from code allows a malicious value of devUrl or testUrl to escape its quoting and run arbitrary json or jq commands. This is wise, in no small part because these languages become more powerful over time: Old versions of jq had no operations that wouldn't run in constant-time, whereas modern versions of the language allow code to be expressed that can be used for denial-of-service attacks; future versions might also add I/O support, allowing malicious code to have a wider array of surprising behaviors.

---

Now, let's say you were going to ignore the warning (above) about the importance of separating data and code. How would we modify your current code to behave "correctly" (when the strings being handled are non-malicious)?

switchEnv() {
  json -I -f config.json -e 'this.url = (this.url == "'"$devUrl"'" ? "'"$testUrl"'" : "'"$devUrl"'")'; }
}