Embeddeding short Python scripts in bash remediation?

[lordofhyphens]

Problem statement:

• Mozilla implemented several of their administrative policies in a JSON structure for Firefox on Linux (it's technically available this way on MacOS and Windows too, but you can use XML in the plist for MacOS and GPOs for Windows).
  • The entire breadth of JSON is not necessary here, just nested structures of string or boolean values.
  • Chrome remediation was able to cheat because all of the items supported are directly under the root node.
• DISA decided to utilize some of these policies in V6R1 for their STIG of Firefox.
• Standard UNIX tooling (the kind we can expect to always be installed on a system we plan to apply a STIG for) blows chunks while attempting to perform an in-place edit on JSON, enough to where the standard advice is "just install jq you fool." However, it's very unlikely that jq or node is going to be on a Linux distro, where I can assume that anything I have Firefox on is probably also packing Python 2 or 3.

To not summon the regexp parse demons, I'd like to use Python (standard modules only) inlined instead so I can just do saner things (I was already going to Jinja out a template to match these policies).

Example

#!/bin/bash
if [ -f /usr/bin/python ]; then
    echo """
import json
z=open('policies.json', 'rb')
t=json.load(z)
z.close()
if 'FirefoxHome' in t['policies']:
  t['policies']['FirefoxHome']['Pocket'] = False
else:
  t['policies']['FirefoxHome'] = dict({'Pocket': False})
z=open('policies.json', 'wb')
json.dump(t, z, indent=4, sort_keys=True)
""" | python
fi

which can operate on

{
    "policies": {
        "FirefoxHome": {
            "Pocket": "ABC 123",
            "Status": "locked"
        }
        "SSLVersionMin": "tls1.2",
        "Preferences": {
            "security.default_personal_cert": {
                "Value": "Ask Every Time",
                "Status": "locked"
            }
        },

    }
}

to yield

{
    "policies": {
        "FirefoxHome": {
            "Pocket": false, 
            "Status": "locked"
        }, 
        "Preferences": {
            "Pocket": "ABC 123", 
            "security.default_personal_cert": {
                "Status": "locked", 
                "Value": "Ask Every Time"
            }
        }, 
        "SSLVersionMin": "tls1.2"
    }
}

Alternatively, I'd like to pull in TickTick, which is MIT-licensed itself and does appear to be 100% shell (for our sins). The downside of this approach is that I'd probably have to minify it for the datastream (and stuff it in a macro that gets called over and over).

I was largely able to get the OVAL parser to play nice with a regex searching for the entire path down for a match, but extracting for a replacement was tricky.