# Using $PIPE to sanitize a variable value; am I smoking it?

**URL:** <https://forum.ansible.com/t/using-pipe-to-sanitize-a-variable-value-am-i-smoking-it/12482>\
**Category:** Ansible Project\
**Created:** [March 11, 2013, 5:09pm UTC](https://forum.ansible.com/t/using-pipe-to-sanitize-a-variable-value-am-i-smoking-it/12482 "2013-03-11T17:09:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brice\_Burgess](https://avatars.discourse-cdn.com/v4/letter/b/d2c977/32.png) [@Brice\_Burgess](https://forum.ansible.com/u/Brice_Burgess)\
**Post date:** [March 11, 2013, 5:09pm UTC](https://forum.ansible.com/t/using-pipe-to-sanitize-a-variable-value-am-i-smoking-it/12482/1 "2013-03-11T17:09:37Z")

</div>

We use anisble for provisioning and deploying our application’s “feature branches” [git branch] to an accessible environment. Under our current approach we deploy the application code to;

/apps/[application]-[branch]

using the `git` module. Because [branch] sometimes contains special characters that are not directory or URL safe (spaces, slashes, etc.). I am using $PIPE to sanitize it (sed regex replaces non alphanumeric characters with an underscore). Here’s my code;

# normalize $git\_branch, replace non-alphanumerics with `_`

branch: $PIPE(echo “$git\_branch” | sed ‘s/[^a-zA-Z0-9\_-]/\_/g’)

I have a strange feeling there’s a better, more “ansible way” to do this. Is there a better recommended approach? I also execute similar code to sanitize database names (that are based on git\_branch) for the `postgresql` module.

Many thanks for your tips,

~ Brice

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [March 11, 2013, 5:12pm UTC](https://forum.ansible.com/t/using-pipe-to-sanitize-a-variable-value-am-i-smoking-it/12482/2 "2013-03-11T17:12:44Z")

</div>

Hi Brice,

Trying to understand the use case.

Are you saying you are having users input data for where their git  
branches are stored and you don't trust that data?

It might make sense to write your own lookup plugin, and we could even  
include it in core if that made sense, that would be cleaner than the  
PIPE.. perhaps $UNTAINT as a node to perl?

--Michael

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [March 11, 2013, 5:12pm UTC](https://forum.ansible.com/t/using-pipe-to-sanitize-a-variable-value-am-i-smoking-it/12482/3 "2013-03-11T17:12:54Z")

</div>

s/node/nod/g

---

<div class="post-metadata">

**Author:** ![Brice\_Burgess](https://avatars.discourse-cdn.com/v4/letter/b/d2c977/32.png) [@Brice\_Burgess](https://forum.ansible.com/u/Brice_Burgess)\
**Post date:** [March 11, 2013, 6:57pm UTC](https://forum.ansible.com/t/using-pipe-to-sanitize-a-variable-value-am-i-smoking-it/12482/4 "2013-03-11T18:57:36Z")

</div>

Michael,

Thank you for looking at my post. I’ll try to clarify – feel free to skip towards the bottom and examine the playbook as this is verbose;

Jenkins jobs are used to test and deploy our application [using ansible] if the tests pass. Development of our application occurs in feature branches – and ansible provisions an accessible environment for each branch as part of the deployment process. So for instance if our goal is to implement “excel import functionality”, we create a git branch named “f/excel” and then instruct the application’s jenkins job to build the “f/excel” branch via a “post build task” shell script – which makes the application code accessible e.g. at http://[branch].features.application.com/ - The post build task resembles something like;

---

<div class="post-metadata">

**Author:** ![Brice\_Burgess](https://avatars.discourse-cdn.com/v4/letter/b/d2c977/32.png) [@Brice\_Burgess](https://forum.ansible.com/u/Brice_Burgess)\
**Post date:** [March 11, 2013, 7:03pm UTC](https://forum.ansible.com/t/using-pipe-to-sanitize-a-variable-value-am-i-smoking-it/12482/5 "2013-03-11T19:03:18Z")

</div>

P.s.

I like your idea about an $UNTAINT lookup, but think having $REGEX or something that allows us to search/replace may be more powerful. Again – there’s probably something already implemented that I’m unaware of 🙂