Script security best practices in Bash Scripting - Step-by-Step Execution

Concept Flow - Script security best practices

Start Script

↓

Check User Input

↓

Validate Input

↓

Valid

↓

Sanitize

↓

Use Safe Commands

↓

Set Permissions

↓

Log Actions

↓

End Script

The script starts by checking and validating user input, sanitizes it if valid, uses safe commands, sets proper permissions, logs actions, and ends safely.

Execution Sample

Bash Scripting

#!/bin/bash
read -p "Enter filename: " file
if [[ "$file" =~ ^[a-zA-Z0-9._-]+$ ]]; then
  touch "$file"
else
  echo "Invalid filename"
fi

This script reads a filename, validates it to allow only safe characters, then creates the file if valid, else shows an error.

Execution Table

Step	Action	Input/Condition	Result	Output
1	Prompt user for filename	User inputs: test_file.txt	Input received
2	Validate filename	test_file.txt matches regex ^[a-zA-Z0-9._-]+$	Validation passed
3	Create file	touch "test_file.txt"	File created
4	End script	No errors	Script ends normally

💡 Script ends after creating file because input was valid

Variable Tracker

Variable	Start	After Input	After Validation	Final
file	""	"test_file.txt"	"test_file.txt"	"test_file.txt"

Key Moments - 3 Insights

Why do we validate the filename with a regex before using it?

Validating the filename ensures it contains only safe characters, preventing injection of harmful commands or unexpected behavior, as shown in step 2 of the execution_table.

What happens if the filename contains spaces or special characters?

The validation fails and the script prints "Invalid filename" and does not create a file, preventing unsafe operations (see step 2 and exit behavior).

Why do we quote the variable "$file" when using it with touch?

Quoting "$file" prevents word splitting and globbing, ensuring the filename is treated as a single safe string, avoiding unintended command execution (step 3).

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of 'file' after user input?

A "test_file.txt"

B "Invalid filename"

C ""

D "touch test_file.txt"

💡 Hint

Check the 'After Input' column in variable_tracker for 'file'

At which step does the script decide not to create a file if input is unsafe?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at the 'Validate filename' action in execution_table step 2

If the user inputs 'file; rm -rf /', what would happen according to the script flow?

A File is created with that name

B Script runs 'rm -rf /' command

C Script exits with 'Invalid filename' message

D Script crashes

💡 Hint

Refer to the validation regex and the branch for invalid input in concept_flow

Concept Snapshot

Script Security Best Practices:
- Always validate and sanitize user input
- Use safe characters only (e.g., regex validation)
- Quote variables to prevent word splitting
- Set strict file permissions
- Log important actions
- Exit safely on invalid input

Full Transcript

This visual execution shows how a bash script securely handles user input for a filename. The script prompts the user, then validates the input using a regex to allow only letters, numbers, dots, underscores, and dashes. If the input passes validation, the script safely creates the file using the quoted filename to avoid command injection. If validation fails, the script prints an error and exits without running unsafe commands. Variables are tracked step-by-step to show how the filename changes from empty to user input. Key moments highlight why validation and quoting are critical to prevent security risks. The quiz tests understanding of variable values, decision points, and the effect of unsafe input. This approach helps beginners see how to write safer bash scripts by controlling input and command usage carefully.