|
Shell command interfaceThe #shell directive provides a convenient facility for invoking shell commands and capturing/parsing the results, for maximum flexibility in interfacing with the shell and other programs. Several examples are provided below.
Security concern: avoid using user-supplied values (such as CGI user variables, or variables derived from them) when building
shell commands (hackers can do things like drop in |id| or |telnet ..|).
Where there's no alternative, #shell / #endshell provides
automatic removal of hazardous shell metacharacters present in variables that are evaluated
within the #shell / #endshell construct. The developer should verify that this is working as expected.
The following are automatically removed when QUISP variables
are evaluated within a #shell / #endshell construct: " ' ` $ \ ; | ../
(this was updated with
patch 1.27-01
).
This set of characters is
configurable
and also settable dynamically using
#mode.
For this same reason it is also good practice to enclose all shell command arguments in
double quotes.
Developers must understand this potential security hole and verify that shell metacharacter screening
is indeed working as they want it to, in their application.
#shell - #endshellIssue a shell command. The shell command can be one or more lines in length. QUISP variables and other directives such as #if can be used to build the shell command. Results can be displayed directly or captured for further processing. The shell command's exit code is available via $shellexitcode() and the number of output lines is available via $shellrowcount().Usage: #shell [mode] shellcommand(s) ... #endshell mode may be one of the following:
Note: mode may optionally begin with a pound sign (#) for readability.
Note: #sql directives cannot be embedded within #shell / #endshell.
FunctionsThese functions may be used in conjunction with the #shell command:$shellrow( fieldname1, .., fieldnameN )
$shellrowcount( )
$shellexitcode( )
$shellfielddelim( s )
$shellfieldconvert( convertmode )
$shellreadheader( )
ExamplesExample 1. Get a numeric value out of the last line of a file and multiply it by 1.25: #shell processrows tail -1 today.dat | cut -f 3 #endshell #call $shellrow(TODAY_TOTAL) #set MAX = $arith(@TODAY_TOTAL*1.25)Example 2. Invoke a grep command and display the results: #set searchword = "macula" <pre> #shell grep "@searchword" /home/steve/textfiles/* #endshell </pre> #if $shellrowcount() != 0 <h3>Nothing found</h3> #endif Example 3. Same as above but add a sed command and display results as HTML table rows: #set searchword = "macula" <table cellpadding=2> #shell dumphtml grep "@searchword" /home/steve/textfiles/* | sed "s/^.*://" #endshell </table> #if $shellrowcount() != 0 <h3>Nothing found</h3> #endif Example 4. Invoke a command that computes correlations and process the results one row at a time: #shell processrows correlate all #endshell <table cellpadding=2> #while $shellrow( var1, var2, pearson, n ) == 0 <tr><td>@var1</td><td>@var2</td><td>@pearson</td><td>N = @n</td></tr> #endloop </table> #if $shellrowcount() < 1 <h3>No correlations computed</h3> #endif Example 5. Invoke a shell command and capture its exit code: #shell addlog @DATE @TIME @READING #endshell #if $shellexitcode() != 0 <h3>Addlog failed!</h3> #endif |
![]() data display engine Copyright Steve Grubb ![]() |