Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Run unknown shell script with a line-by-line confirmation prompt

gist.github.com

Post reply on HN
Print view View original

11–20 of 86 posts

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#11

Post by tyingq »

You can fool it with ^H (Insert with ^V^H in vim)

  #!/bin/sh
  rm not ^H^H^H^H expected
Gives:

  -> rm  expected
  Run command? [Y/n] 
  rm: cannot remove 'not': No such file or directory
  rm: cannot remove ''$'\b\b\b\b': No such file or directory
  rm: cannot remove 'expected': No such file or directory

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#13

Post by klyrs »

barbazoo wrote: post #4

> Useful for running unknown scripts Or just, you know, read them before you run them.

One complication is that websites can hijack your copy buffer, and the text you paste isn't the text you copied. I avoid this by pasting into an editor, not directly into a shell.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#14

Post by scintill76 »

I’ll nitpick. I think

> # Ask for only a single character of input, so the user does not need to type an extra enter

plus

> echo "Please answer by typing n (for no), y (for yes), or Enter (also for yes)"

seem like it will lead to “y[enter]” so you accidentally accept a second line before you read it.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#15

Post by wlib »

tyingq wrote: post #11

You can fool it with ^H (Insert with ^V^H in vim) #!/bin/sh rm not ^H^H^H^H expected Gives: -> rm expected Run command? [Y/n] rm: cannot remove 'not': No such file or directory rm: cannot remove ''$'\b\b\b\b': No such file or directory rm: cannot remove 'expected': No such file or directory

I updated to fix that, thanks for pointing it out. It had to do with echo printing the command with your backspace characters escaped. See if you can break it now, it's interesting how many weird cases exist in tty's.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#16

Post by macintux »

scintill76 wrote: post #14

I’ll nitpick. I think > # Ask for only a single character of input, so the user does not need to type an extra enter plus > echo "Please answer by typing n (for no), y (for yes), or Enter (also for yes)" seem like it will lead to “y[enter]” so you accidentally accept a second line before you read it.

In addition, for security reasons I think you’d want the default behavior to be no, not yes. Seems like dropping enter entirely is the right choice.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#17

Post by tyingq »

wlib wrote: post #15
tyingq wrote: post #11

You can fool it with ^H (Insert with ^V^H in vim) #!/bin/sh rm not ^H^H^H^H expected Gives: -> rm expected Run command? [Y/n] rm: cannot remove 'not': No such file or directory rm: cannot remove ''$'\b\b\b\b': No such file or directory rm: cannot remove 'expected': No such file or directory

I updated to fix that, thanks for pointing it out. It had to do with echo printing the command with your backspace characters escaped. See if you can break it now, it's interesting how many weird cases exist in tty's.

Heredocs are a little odd, because you can't see what they might be piping to.

This script, for example looks sort of innocuous when run through your tool because it's not obvious the HEREDOC is going to the stdin of a Perl interpreter. Your tool shows them like they are two separate things that don't do much by themselves.

Looking at the script itself, it's more obvious.

  #!/bin/sh
  cat
That's probably a nit, really, though. I don't know that anyone would target it on purpose.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#18

Post by jjnoakes »

klyrs wrote: post #13
barbazoo wrote: post #4

> Useful for running unknown scripts Or just, you know, read them before you run them.

One complication is that websites can hijack your copy buffer, and the text you paste isn't the text you copied. I avoid this by pasting into an editor, not directly into a shell.

Excuse my ignorance but when are you copying commands from a site you don't trust? If I don't trust a site I don't run anything it suggests to me, copy hijacking or no.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#19

Post by klyrs »

jjnoakes wrote: post #18
klyrs wrote: post #13

Earlier quoted context omitted.

One complication is that websites can hijack your copy buffer, and the text you paste isn't the text you copied. I avoid this by pasting into an editor, not directly into a shell.

Excuse my ignorance but when are you copying commands from a site you don't trust? If I don't trust a site I don't run anything it suggests to me, copy hijacking or no.

I distrust every site. What sites do you trust, and why do you assume they haven't been hacked or xss'd?

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#20

Post by wlib »

tyingq wrote: post #17
wlib wrote: post #15

Earlier quoted context omitted.

I updated to fix that, thanks for pointing it out. It had to do with echo printing the command with your backspace characters escaped. See if you can break it now, it's interesting how many weird cases exist in tty's.

Heredocs are a little odd, because you can't see what they might be piping to. This script, for example looks sort of innocuous when run through your tool because it's not obvious the HEREDOC is going to the stdin of a Perl interpreter. Your tool shows them like they are two separate things that don't do much by themselves. Looking at the script itself, it's more obvious. #!/bin/sh cat That's probably a nit, really,…

Yup, at that point it's within the scope of bash's debugger. It shows the command that is actually being run, so it expands globs, shows the command within if predicates, and so on. If bash shows a command that isn't actually about to run, that is a bash bug.
Post reply on HN