Shell is powerful and dangerous: injection, unsafe temp files, and world-readable secrets cause incidents. Treat all external input as hostile.
Quote variables
user="$1"
# BAD: eval "rm -rf $user"
# GOOD:
rm -rf -- "${user:?missing arg}"Never eval untrusted data. Use -- to end option parsing before paths.
Temp files safely
tmp=$(mktemp)
trap 'rm -f "$tmp"' EXIT
echo "data" > "$tmp"mktemp avoids predictable /tmp/myapp races.
curl pipe bash
Installing via curl | bash without reviewing the script is risky—download, read, then run. Align with security practices in Tools and your organization's policy.
Important interview questions and answers
- Q: Why eval is dangerous?
A: Executes arbitrary strings—attacker-controlled input becomes code. - Q: mktemp benefit?
A: Creates unique file names atomically, reducing symlink attacks.
Self-check
- What does rm -rf -- protect against?
- Why avoid curl | bash for production installs?
Pitfall: Never eval on data from users, HTTP, or git diffs without strict validation.
Interview prep
- eval risk?
Executes arbitrary strings—code injection vector.
- mktemp?
Creates unique temp paths safely.