Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

41–50 of 257 posts

Re: Don't copy paste from a website to a terminal

#41

Post by [deleted] »

coldtea wrote: post #37
Albright wrote: post #2

The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-cu... and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-... . There was also a blog out there collecting instances of this, but I…

> The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. The real problem is that this is nothing different than trusting a binary download -- which many more millions (billions) do.

[deleted]

Re: Don't copy paste from a website to a terminal

#42

Post by wyldfire »

jnbiche wrote: post #33
wyldfire wrote: post #11

Earlier quoted context omitted.

No, unfortunately not. I did a "cat >/dev/null" before pasting so I could see what it was. Clever masked/hidden content, with embedded shell commands and newline to commit the commands.

I'm not understanding this approach. Cat is for files. How would you use it to protect against this trick? Do you mean you pre-typed "> /dev/null" and then pasted his git command where the cat is?

No, I just put my terminal into a mode where I could see what I pasted without any possibility executing it. If you don't give cat any arguments, it reads from stdin and writes to stdout.

I could have just as easily opened vim/emacs/notepad and done the same, or for that matter, written the contents to an actual file instead of redirecting the contents to /dev/null.

Re: Don't copy paste from a website to a terminal

#44

Post by brunosutic »

Another reason against copy-pasting from the web is using unicode characters that look like ASCII ones. This was on HN a week or so ago, but it doesn't hurt to repeat.

Example shell command:

    eⅽho 'hello world'
Copy-pasting the above command will fail with the message `eⅽho: command not found`. The reason? 'ⅽ' in 'eⅽho' is a unicode character "SMALL ROMAN NUMERAL ONE HUNDRED" that looks identical to regular ascii 'c'.

The above can also be mis-used for any programming language, not just shell commands.

Re: Don't copy paste from a website to a terminal

#45

Post by cortesoft »

dublinben wrote: post #5
Albright wrote: post #2

The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like. See also http://www.seancassidy.me/dont-pipe-to-your-shell.html and http://output.chrissnell.com/post/69023793377/stop-piping-cu... and https://www.chef.io/blog/2015/07/16/5-ways-to-deal-with-the-... . There was also a blog out there collecting instances of this, but I…

None of those commands are so long that you shouldn't just be retyping them by hand. It's obviously not an ideal way to install anything, but it's much safer than copy and pasting.

or copy them to a text editor first?

Re: Don't copy paste from a website to a terminal

#46

Post by tolle »

ajmarsh wrote: post #22

I usually go web --> text editor --> terminal. It's a pain but, it works.

Shouldn't have to be a pain? Browser plugin to paste content to editor window. Then something that runs the document its pasted into when you've read it?

However, copy, paste, (save as a script|paste in terminal), run isn't exactly the most strenuous task in the history of man either. So it'd be a fairly meaningless chain of plugins for close to zero benefit.

Re: Don't copy paste from a website to a terminal

#47

Post by keithgabryelski »

wyldfire wrote: post #11
hellofunk wrote: post #3

I don't get it... even if the pasted content has stuff I don't expect, I still see it in my shell prompt before I press Enter, no?

No, unfortunately not. I did a "cat >/dev/null" before pasting so I could see what it was. Clever masked/hidden content, with embedded shell commands and newline to commit the commands.

I do this also, although it is only a little safer: if someone added a ^D to the text it could thwart your attempt at protection:

as:

git status

^D

echo foo

Re: Don't copy paste from a website to a terminal

#48

Post by pjungwir »

jnbiche wrote: post #33
wyldfire wrote: post #11

Earlier quoted context omitted.

No, unfortunately not. I did a "cat >/dev/null" before pasting so I could see what it was. Clever masked/hidden content, with embedded shell commands and newline to commit the commands.

I'm not understanding this approach. Cat is for files. How would you use it to protect against this trick? Do you mean you pre-typed "> /dev/null" and then pasted his git command where the cat is?

Like many Unix commands, if you don't give cat any files to read, it reads from stdin instead. So first he runs the command (as he typed it), and then while cat is waiting for input he pastes in whatever he copied from the website.

Another handy convention is the magic "-" filename (which is not actually a file). Many tools interpret that to mean stdin/stdout. For example here is a trick to copy a tree of files:

    tar cf - src | (cd dest && tar xvf -)

Re: Don't copy paste from a website to a terminal

#50

Post by pyre »

Goopplesoft wrote: post #20

Aside: its not sufficient to look at a file you 'curl | bash' into bash via your browser. It is very trivial to detect curl/wget's UA (mine has: "User-Agent": "curl/7.43.0") and dynamically modify files depending on the request's UI. if 'curl' in request.UA: return 'something malicious' else: return 'something nice' Always create a local file with the content, read it, then perhaps run it.

... so this:

    wget -qO- 'http://example.com/script.sh' | less
won't work to review the script?
Post reply on HN