URL is also a shell script that executes some malicious(?) code
1–10 of 74 posts
Re: URL is also a shell script that executes some malicious(?) code
#2fish catches this. It automatically escapes the single quotes when I paste it after entering `curl '`.
Re: URL is also a shell script that executes some malicious(?) code
#3That is pretty bad.
Shows that "right click, copy link, type wget ', paste, type ', enter" is a receipe to get pwned.
Same is probably true even when you do not paste it into a terminal but into a script. Like "Ok, I'm gonna automate downloading this ..."
Re: URL is also a shell script that executes some malicious(?) code
#4I could only get it work with bash, on zsh it does not work.
Re: URL is also a shell script that executes some malicious(?) code
#5That is pretty bad. Shows that "right click, copy link, type wget ', paste, type ', enter" is a receipe to get pwned. Same is probably true even when you do not paste it into a terminal but into a script. Like "Ok, I'm gonna automate downloading this ..."
pasting things into your terminal was always a problem
Re: URL is also a shell script that executes some malicious(?) code
#6That is pretty bad. Shows that "right click, copy link, type wget ', paste, type ', enter" is a receipe to get pwned. Same is probably true even when you do not paste it into a terminal but into a script. Like "Ok, I'm gonna automate downloading this ..."
Pasting directly into a terminal or even a script is one step removed from blindly running eval(…) with arbitrary user input.
If you’re lucky it works. If you’re somewhat less lucky but still on the positive side, it doesn’t work with some syntax error that doesn’t corrupt anything.
There’s no excuse for not reviewing what is being executed before actually running it.
Re: URL is also a shell script that executes some malicious(?) code
#7That is pretty bad. Shows that "right click, copy link, type wget ', paste, type ', enter" is a receipe to get pwned. Same is probably true even when you do not paste it into a terminal but into a script. Like "Ok, I'm gonna automate downloading this ..."
Automating might actually make it safer, my typical idiom is `while read -r url; do wget "$url"; done < ./urls` (or `tail -zf ./urls|while…` to make it an url downloader daemon =P)
Re: URL is also a shell script that executes some malicious(?) code
#8Yes, $() inside of double quotes is expanded. This is a documented and standardized feature of all shells derived from the bourne shell.
Re: URL is also a shell script that executes some malicious(?) code
#9Yes, $() inside of double quotes is expanded. This is a documented and standardized feature of all shells derived from the bourne shell.
the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now.
i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-char escape the url.
Re: URL is also a shell script that executes some malicious(?) code
#10Sounds like terminal software just needs a paste url option that sanitized before pasting.