supress cat output in following cmd in shell script - linux

Question

curl=`-c cat <<EOS
curl -s https://api.openai.com/v1/completions
-H 'Content-Type: application/json'
-H "Authorization: Bearer foo"
-d '{
"model": "text-davinci-003",
"prompt": "$1",
"max_tokens": 4000,
"temperature": $2
}'
--insecure | jq '.choices[]'
EOS`
eval ${curl} | tee $newFileName

Answer 1

There is no need for command substitution and eval. They only make the things more complicated than they need to be.
I suspect that you used command substitution to get the expanded the values of $1 and $2 in the JSON but this is not the right way to do it. If $1 contains " the generated JSON becomes invalid. The same if $2 is not a number.
The code is even vulnerable to data injection. If $1 contains the value blah", "model": "foo and the value of $2 is 0, the argument passed to -d becomes:
{ "model": "text-davinci-003", "prompt": "blah", "model": "foo", "max_tokens": 4000, "temperature": 0 }
It is not valid JSON (it contains the key model twice) but most JSON parsers accept it and they usually use the last value assigned to the key (probably because they do not check for key uniqueness).
This makes the API handle this input object:
{ prompt": "blah", "model": "foo", "max_tokens": 4000, "temperature": 0 }
It is not easy to remove the vulnerability using what the shell script offers. You can attempt to replace " with \" but this leads to more problems (and there must be escaped many characters, anyway).
The easiest solution for this is to use jq or other JSON manipulating tool.
Using jq, the code would be like this:
# Generate the data object using `jq`...
# ...and store it into a separate variable for readability
DATA=$(jq -n -c --arg prompt "$1" --arg temp "$2" '{
model: "text-davinci-003",
prompt: $prompt,
max_tokens: 4000,
temperature: $temp
}')
curl -s \
https://api.openai.com/v1/completions \
-H 'Content-Type: application/json' \
-H "Authorization: Bearer foo" \
-d "$DATA" \
--insecure |
jq '.choices[]' |
tee "$newFileName"