iTerm2 has a 'Advanced Paste' dialog which allows you to escape special shell characters, among other things. You can invoke it with Opt-Cmd-V. I discovered this feature a couple of days ago and wondered then under what circumstances it might be useful. Now I know.
URL is also a shell script that executes some malicious(?) code
31–40 of 74 posts
Re: URL is also a shell script that executes some malicious(?) code
#32Am I missing something, or is this basically "copy this into your terminal" followed by "oh look, it did something"?
Re: URL is also a shell script that executes some malicious(?) code
#33Earlier quoted context omitted.
Because zsh has usually the url-quote-magic feature enabled which automatically escapes all special characters typed or pasted if the current argument is identified as URL.
Most likely it escapes enough to prevent code execution, but last time I tried it didn't escape all special characters out of the box: https://news.ycombinator.com/item?id=29071196
$ also gets escaped automatically for me if pasted
Re: URL is also a shell script that executes some malicious(?) code
#34[deleted]
Re: URL is also a shell script that executes some malicious(?) code
#35Somehow I thought there is something like "disable shell expansions" option or "raw strings mode" in Bash. Seems like I was wrong.
Re: URL is also a shell script that executes some malicious(?) code
#36Am I missing something, or is this basically "copy this into your terminal" followed by "oh look, it did something"?
Ah yes, the legendary UN*X hacker who never pastes into his terminal.
Re: URL is also a shell script that executes some malicious(?) code
#37Yes, $() inside of double quotes is expanded. This is a documented and standardized feature of all shells derived from the bourne shell.
Every point in the article is obvious. As a script kiddie pasting stuff from the internet (including stuff from the victim's website) back in the day, I was acutely aware of the fact that you can't paste something and hit enter anywhere ever (unless you strip out ', but even that isn't very reassuring given that the shell probably has undocumented edge cases as well as other problems at other layers such as the terminal [1]).
Anyway, shells are dumb and dangerous. A real interactive language should simply have a text box for text. I guess I could write a usual 10 paragraph rant on this but it really is that simple.
1. Day of the seal soon.
Re: URL is also a shell script that executes some malicious(?) code
#38Earlier quoted context omitted.
I mean, it like dodgy to any user familiar with URLs surely? Wouldn't wget -qO - www.example.com/script | sh catch far more of the uninitiated?
People go nuts about curl | bash but then grab random packages off pip/gem/npm/brew/VimPlug/packages.el/VS Code without so much as a second look and they can all run arbitrary code too.
If you curl | bash from http, you may get MITM'd because you're not checking the checksum. Most modern package managers at least check that what was downloaded is indeed what the original developer intended, so it's slightly better.
Re: URL is also a shell script that executes some malicious(?) code
#39Clever, but I really hope nobody is going to blindly copy-paste-go! a URL like that. Especially if you're technical enough to use a terminal, you should know better.
How is it possible to be so wrong on so many levels in just two sentences?
1. Your epistemic reasoning capabilities are broken (as in, why do you think people should know better?)
2. You are just adopting an ad-hoc philosophy based on how shells work. If interactive languages had separate text inputs instead of just parsing a stream of text from stdin, pasting would always be safe. One may be tempted to call this "UN*X braindamage".
3. You appear to possibly believe in checking a URL before opening it type voodoo as well, regardless of shell issues
Re: URL is also a shell script that executes some malicious(?) code
#40Am I missing something, or is this basically "copy this into your terminal" followed by "oh look, it did something"?
Ah yes, the legendary UN*X hacker who never pastes into his terminal.
Everyone pastes into their terminal, but you do have to be pretty naive to ever paste something blindly into your terminal (full depth of understanding of each mechanics isn't a requirement but basic understanding of high-level obvious components of the line being pasted should absolutely be).
There is literally no way to secure against people being hacked if the scenario is a user blindly following instructions without looking at / thinking about them.