osascript using bash variable with a space

Question

I am using osascript in Bash to display a message in Notification Center (Mac OS X) via Apple Script. I am trying to pass a text variable from Bash to the script. For a variable without spaces, this works just fine, but not for one with spaces:

Defining

var1="Hello"
var2="Hello World"

and using

osascript -e 'display notification "'$var1'"'

works, but using

osascript -e 'display notification "'$var2'"'

yields

syntax error: Expected string but found end of script.

What do I need to change (I am new to this)? Thanks!

SomeGuyOnAComputer · Accepted Answer · 2018-05-25 18:40:18Z

38

You could try to use instead :

osascript -e "display notification \"$var2\""

Or :

osascript -e 'display notification "'"$var2"'"'

This fixes the problem of manipulation of variables that contains spaces in bash. However, this solution doesn't protect against injections of osascript code. So it would be better to choose one of Charles Duffy's solutions or to use bash parameter expansion :

# if you prefer escape the doubles quotes
osascript -e "display notification \"${var2//\"/\\\"}\""
# or
osascript -e 'display notification "'"${var2//\"/\\\"}"'"'

# if you prefer to remove the doubles quotes
osascript -e "display notification \"${var2//\"/}\""
# or
osascript -e 'display notification "'"${var2//\"/}"'"'

Thank to mklement0 for this very useful suggestion !

edited May 25, 2018 at 18:40

SomeGuyOnAComputer

6,3387 gold badges50 silver badges86 bronze badges

answered May 28, 2014 at 22:47

Idriss Neumann

3,8682 gold badges26 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

17 Comments

Charles Duffy Over a year ago

...and as for "X is not addressed by this answer" -- just as any answer for generating SQL that allowed injection bugs should be subject to jeers from the crowd, answers for a question on how to properly interface between bash and osascript that don't actually take proper/safe use of osascript into account have good cause to be similarly rejected.

mklement0 Over a year ago

@CharlesDuffy: I wouldn't know how to inject code in this instance (AppleScript doesn't allow placing multiple commands on 1 line; in general, though, the concern about injection is appreciated); in particular, however, the concern about values containing " is valid (in terms of breaking the command); here's the (somewhat cumbersome) remedy, using bash parameter expansion: osascript -e "display notification \"${var2//\"/\\\"}\""

Charles Duffy Over a year ago

@IdrissNeumann, would you consider adopting mklement0's suggestion re: using parameter expansion to escape any double quotes? I'd feel a lot more comfortable with your answer at the top of the page were that done.

mklement0 Over a year ago

@CharlesDuffy Well done, hadn't thought of that. With escaped double quotes, however, as I suggested (${var2//\"/\\\"}), this exploit will NOT work - or do you see a way around that, too?

Charles Duffy Over a year ago

@mklement0, ...and that's why I asked Idriss to incorporate your suggestion, rather than to withdraw the answer. I don't have an immediate escape for that, though if I were going to try to create one, I'd probably start poking around Unicode character set conversion logic (being a common weak point), and/or reading the formal language spec.

|

Charles Duffy · Accepted Answer · 2014-05-29 20:50:12Z

21

This version is completely safe against injection attacks, unlike variants trying to use string concatenation.

osascript \
  -e "on run(argv)" \
  -e "return display notification item 1 of argv" \
  -e "end" \
  -- "$var2"

...or, if one preferred to pass code in on stdin rather than argv:

osascript -- - "$var2" <<'EOF'
  on run(argv)
    return display notification item 1 of argv
  end
EOF

edited May 29, 2014 at 20:50

answered May 28, 2014 at 22:53

Charles Duffy

299k43 gold badges442 silver badges498 bronze badges

7 Comments

mklement0 Over a year ago

+1 for a robust solution for passing arbitrary arguments to osascript safely from the command line (though it may be overkill for the case at hand).

Bernd Over a year ago

Thanks for the more robust solution - I ended up accepting the other one since it is sufficient for the case at hand, where no injection attacks or variables with ` are to be expected.

chepner Over a year ago

There's no real reason not to use proper, safe code; when you don't expect an attack is when you are most vulnerable to it.

mklement0 Over a year ago

As an aside: the on run argv line works, despite not enclosing the argument - argv - in parentheses, which is normally required in AppleScript handlers. This curious syntax exception - which only works with handler name run - has been around for a long time (and therefore probably won't go away). The non-exceptional syntax works too, however: on run(argv).

mklement0 Over a year ago

@chepner: Excellent point. Fortunately, those variants of the accepted answer with escaping or removal of double quotes should be safe.

|

Collectives™ on Stack Overflow

osascript using bash variable with a space

2 Answers 2

17 Comments

7 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

17 Comments

7 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related