trek10inc / awsume

A utility for easily assuming AWS IAM roles from the command line.
https://awsu.me
MIT License
485 stars 90 forks source link

Avoid leaking shell variables #265

Open cspotcode opened 3 days ago

cspotcode commented 3 days ago

The dot-sourced awsume shell script leaks AWSUME_* variables into the host shell session.

❯ echo $AWSUME_<tab>
AWSUME_1        AWSUME_2        AWSUME_3        AWSUME_4        AWSUME_5        AWSUME_6        AWSUME_7        AWSUME_COMMAND  AWSUME_FLAG     AWSUME_OUTPUT   AWSUME_PROFILE  AWSUME_STATUS 

You could argue that some are useful to certain people in specific situations -- $AWSUME_STATUS -- but I don't think the $AWSUME_[1-7] vars are useful.

This can be avoided by wrapping the dot-sourced logic in a function and using local variables within that function.

For example:

# Declare entire script in function, call the function, then unset the function
# Allows us to dot-source this script without polluting the shell environment
function __awsume() {
  local AWSUME_1 AWSUME_2 # declare local variables
  # logic here
}

__awsume "$@"
unset -f __awsume

This also avoids the noise line 183: return: can onlyreturn' from a function or sourced scriptwhich is logged whenawsume` is not dot-sourced. I know that error only happens when it's misconfigured and you get the "not being sourced" warning, so maybe not the highest priority.