Escape special characters when replacing passwords in multiple files with a bash-script

Question

I found lot's of close questions, but not the exact fit to my use case, so had to open a new one.

Guess a system that has a password consisting of all lowercase and uppercase letters, numbers and special characters (a-z,A-Z,0-9, #) in multiple configuration files (the same password is used by a web-application on main domain, its sub-domains and all the relevant databases). Example of such file with a password would be:

$databases = array (
  'default' =>
  array (
    'default' =>
    array (
      'database' => 'database_name',
      'username' => 'datbase_user',
      'password' => 'yv[48k2)KMGx{g1b',
      'host' => 'localhost',
      'port' => '',
      'driver' => 'mysql',
      'collation' => 'utf8mb4_general_ci',
      'charset' => 'utf8mb4',
      'prefix' => '',
    ),
  ),
);

I am trying to write a bash-code that takes in automatically generated new password (with the same algorithm - all lowercase and uppercase letters, numbers and special characters), finds all occurrences of the old password in home directory of respective parent domain and its subdomains and replaces with the new password. The following one-liner works fine:

grep -rlF "$old_pass" /path/to/directory | xargs sed -i "s/$old_pass/$new_pass/g"

for passwords consisting of only letters and digits (e.g. qVYYgB5bRxUYpHg). However, while the grep part works fine, the sed part fails as soon as the system adds special characters to a generated password (e.g.aN#zDU>lve15Uwqn) giving:

sed -i "s/$old_pass/$new_pass/g" password.php
sed: -e expression #1, char 37: unterminated `s' command

What is the best way to replace all occurrences of an existing password that consists of all the letters, numbers and special characters stored in different variables in multiple files?

Answer 1

Your sed expression is wrong because you need to escape the square bracket [:

sed -i 's/yv\[48k2)KMGx{g1b/aN#zDU>lve15Uwqn/g' password.php

To avoid shell parameter expansion, use single in quote the sed expression.

If you want to match all letters, numbers and special characters (assuming punctuation), you can use class characters:

sed 's/[[:punct:][:alnum:]]*/NEWPASSWORKD/g' password.php

Answer 2

I think the possible permutations of autogenerated passwords may be beyond the scope of what you are going to be able to easily accommodate with a sed, but the crux of the matter is protecting the metacharacters. For this specific example:

$: echo "$b"              # the desired string
aN#zDU>lve15Uwqn
$: echo "$a"              # the current string, with embedded metachars
yv[48k2)KMGx{g1b
$: echo "$a" |            # pipe it to a sed to clean it
>    sed 's/\W/\\&/g'     # backquote all non-word chars
yv\[48k2\)KMGx\{g1b
$: echo "$a" | sed 's/\W/\\&/g'>a # save to a file
$: cat a
yv\[48k2\)KMGx\{g1b
$: echo "sed -E 's/$(<a)/$b/g'">x # save the sed to be run to a file
$: cat x
sed -E 's/yv\[48k2\)KMGx\{g1b/aN#zDU>lve15Uwqn/g'
$: echo $a | . x          # source it
aN#zDU>lve15Uwqn

All this saving to a file is not entirely necessary, but it makes it a little easier to manage your quoting. As Ed mentioned below, you'd basically have to do the same thing for the new password.

So your actual script:

 echo "$old_pass" | sed 's/\W/\\&/g'> old_pat
 echo "$new_pass" | sed 's/\W/\\&/g'> new_pat
 echo "sed -E 's/$(<old_pat)/$(<new_pat)/g'" > src # save the command to a file
 echo "$old_pass" | . src                        # source it

I didn't include the -i to do an inplace edit, as you'll want to vet the process first.

Hope this helps someone, but generally, this is one of those cases even I would probably use awk... or more likely, to be honest, just refactor the logic. :)

...you aren't hardcoding all those passwords in that php file, are you? :D

Answer 3

Better to use perl here due to it's support of /\Q...\E/ regex pattern that treats all letters within these tags literally (no special regex meaning).

Here is an example:

cat file

abc123
pass=yv[48k2)KMGx{g1b
foobar

Now use this perl command:

old_pass='yv[48k2)KMGx{g1b'
new_pass='aN#zDU>lve15Uwqn'

perl -pe "s~\\Q${old_pass}\\E~\\Q$new_pass~g" file

abc123
pass=aN\#zDU\>lve15Uwqn
foobar

If you don't have perl, then you may use this awk that uses sting search without using any regex:

awk -v old="$old_pass" -v new="$new_pass" 'n=index($0, old) { 
   $0 = substr($0, 1, n-1) new substr($0, n + length(old)) } 1' file