Protect what matters – even after you're gone. Make a plan for your digital legacy today.
Forum Discussion
stacktom
2 months agoNew Contributor
Please make the CLI examples more secure
It is more secure to surround $(command) with quotes, unless you are absolutely, positively, sure that the output will not include spaces. When it is unquoted, the shell splits the output:
$ for i in $(echo one two three) ; do echo $i ; done
one
two
three
$ for i in "$(echo one two three)" ; do echo $i ; done
one two threeThus, if a malicious person added a space to an entry, a command like this will fail:
# suppose op://prod/docker/username contained the string "FIRST SECOND"
$ docker login -u $(op read op://prod/docker/username) -p $(op read op://prod/docker/password)
time="2025-10-09T14:00:31-04:00" level=info msg="Error logging in to endpoint, trying next endpoint" endpoint="{https://SECOND 0x140006161e0}" error="Get \"https://SECOND/v2/\": remote error: tls: handshake failure"
Get "https://SECOND/v2/": remote error: tls: handshake failureIt is safer to surround it with quotes:
docker login -u "$(op read op://prod/docker/username)" -p "$(op read op://prod/docker/password)"Places where quotes should be added:
- https://developer.1password.com/docs/cli/secret-references
- https://developer.1password.com/docs/cli/secrets-scripts
- The docker example in: "op read -h"
- (possibly other places)
Thanks!
Tom
Thanks stacktom - this is great advice, we really appreciate it. I'll feed this back to the documentation team and get some eyes on this.
It sure takes a village! If you spot anything else, please don't hesitate to reach out! 🙌
All the best,
Phil & team