Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

URL is also a shell script that executes some malicious(?) code

github.com

Post reply on HN
Print view View original

11–20 of 74 posts

Re: URL is also a shell script that executes some malicious(?) code

#11

Post by paisleyrob »

habibur wrote: post #9
blueflow wrote: post #8

Yes, $() inside of double quotes is expanded. This is a documented and standardized feature of all shells derived from the bourne shell.

the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now. i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-…

That's only because it's got single quotes contained within it.

Re: URL is also a shell script that executes some malicious(?) code

#12

Post by blueflow »

habibur wrote: post #9
blueflow wrote: post #8

Yes, $() inside of double quotes is expanded. This is a documented and standardized feature of all shells derived from the bourne shell.

the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now. i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-…

Because you can exit the quoting any time with another single quote. This is literally how SQL injections worked 20 years ago.

Re: URL is also a shell script that executes some malicious(?) code

#13

Post by Calzifer »

habibur wrote: post #9
blueflow wrote: post #8

Yes, $() inside of double quotes is expanded. This is a documented and standardized feature of all shells derived from the bourne shell.

the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now. i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-…

No it is not. The single quote example is wrong because the evaluation part $(...) is unquoted. Take a closer look. The first single quote part ends after the first semicolon right before the $(

Re: URL is also a shell script that executes some malicious(?) code

#14

Post by Calzifer »

turtleman1338 wrote: post #4

I could only get it work with bash, on zsh it does not work.

Because zsh has usually the url-quote-magic feature enabled which automatically escapes all special characters typed or pasted if the current argument is identified as URL.

Re: URL is also a shell script that executes some malicious(?) code

#18

Post by [deleted] »

Calzifer wrote: post #13
habibur wrote: post #9

Earlier quoted context omitted.

the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now. i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-…

No it is not. The single quote example is wrong because the evaluation part $(...) is unquoted. Take a closer look. The first single quote part ends after the first semicolon right before the $(

[deleted]

Re: URL is also a shell script that executes some malicious(?) code

#19

Post by [deleted] »

paisleyrob wrote: post #11
habibur wrote: post #9

Earlier quoted context omitted.

the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now. i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-…

That's only because it's got single quotes contained within it.

[deleted]

Re: URL is also a shell script that executes some malicious(?) code

#20

Post by chriswarbo »

habibur wrote: post #9
blueflow wrote: post #8

Yes, $() inside of double quotes is expanded. This is a documented and standardized feature of all shells derived from the bourne shell.

the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now. i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-…

Writing '...' switches from "writing shell code" to "writing a single-quoted string". It does not switch to "writing arbitrary text" (since that would give us no way to end the string!). You should always convert arbitrary text to "single-quoted string" format: most of the time it will stay the same, e.g. "google.com"; sometimes it needs escaping to prevent benign corruption, e.g. "I'm a little teapot"; in this case it needs escaping to prevent malicious code injection.
Post reply on HN