How to validate filename in bash script? - bash

Question

A little bit about my application:
I am writing a small application in bash script. The application must store personal settings to home directory.
My settings are in the form of a key/value pair which will be stored as filename/content:
for example:
~/my-github-app
├── github-account
├── github-token
My current solution for adding a key/value:
read KEY
read VALUE
# FIXME! should check for for valid filename.
# user can do injection hack by KEY="../../path/to/yourfile"
echo $VALUE > ~/my-github-app/$KEY
What is the simplest and safe way to validate $KEY?
A built-in function?
A regular expression?
I really need a reusable solution, not just for this application.
Edit:
"validate filename" mean check string for proper filename format, accepted by OS.
"bob" : good filename format
"" : bad because filename can not be empty
"*" : ?
"/" : ?
"con" : ?
....

Answer 1

The only way to make something secure is to use a whitelist. Which means instead of blacklisting bad characters you allow good ones. The reason why blacklists will always fail is that you can't blacklist all of the weird characted, you'd always forget something. Especially if you're working with unicode strings.
Filenames could contain anything. According to wikipedia:
Ext4 Allowed characters in filenames: All bytes except NUL ('\0') and '/'
Which means that whole bash scripts could be valid filenames.
So, if I were you, I would only allow a-zA-Z as valid characters. Problem solved.
That's how you do it:
# if [[ $key =~ [^a-zA-Z] ]]; then # or this. Whatever makes more sense to you
if ! [[ $key =~ ^[a-zA-Z]+$ ]]; then
echo 'Wrong key. Only a-zA-Z characters are allowed' >&2 # write to stderr
exit 1
fi

Answer 2

In addition to #Aleks-Daniel Jakimenko-A.'s answer, following script checks following conditions, If all conditions are set then True is returned:
a-z
A-Z
0-9
underscore (_)
dash (-)
period (.)
Max length is 255
First character should be a character or number: {a-z or A-z or 0-9}
my_script.sh:
#!/bin/bash
# To run: bash my_script.sh <my_string_is>
key=$1
val=$(echo "${#key}")
if [[ $key == "" ]]; then
echo "False";
exit
fi
if [[ $key == "." ]] || [[ $key == ".." ]]; then
# "." and ".." are added automatically and always exist, so you can't have a
# file named . or .. // https://askubuntu.com/a/416508/660555
echo "False";
exit
fi
if [ $val -gt 255 ]; then
# String's length check
echo "False";
exit
fi
if ! [[ $key =~ ^[0-9a-zA-Z._-]+$ ]]; then
# Checks whether valid characters exist
echo "False";
exit
fi
_key=$(echo $key | cut -c1-1)
if ! [[ $_key =~ ^[0-9a-zA-Z.]+$ ]]; then
# Checks the first character
echo "False";
exit
fi
echo "True";

Answer 3

If you just want to check if a file already exists, use the test command and use it like this for your validation :
if [[ ! -e "$KEY" ]]
then
#file doet not exists
fi

Answer 4

What do you want to validate, just that a key doesn't contain any path info?
KEY=$(basename $KEY)
This would remove any parts of the KEY that are part of the path. That said, there are plenty of things the user could enter that would probably be a bad idea. Can you perhaps have a list of allowed keys, then reject anything that isn't in that list?
If you're trying to see if a file is writable, you could check if a) it exists and is writable (-w) or b) just try to write to it and check for errors.