fish catches this. It automatically escapes the single quotes when I paste it after entering `curl '`.
No post body was provided.
URL is also a shell script that executes some malicious(?) code
41–50 of 74 posts
Re: URL is also a shell script that executes some malicious(?) code
#42Earlier quoted context omitted.
Ah yes, the legendary UN*X hacker who never pastes into his terminal.
Everyone pastes into their terminal, but you do have to be pretty naive to ever paste something blindly into your terminal (full depth of understanding of each mechanics isn't a requirement but basic understanding of high-level obvious components of the line being pasted should absolutely be). There is literally no way to secure against people being hacked if the scenario is a user blindly following instructions with…
Please tell me the specific way you check your stuff before pasting so I can tell you how it's either broken or you're the 0.001% user and nobody else does that. I've always just pasted into a text editor and recopied it from there (and even that may not be safe). On one hand, UN*X is not meant to have paste so you should just never use it. On the other hand, if you're using webshit you have to copy from it because there's no UN*X way to get at the data as the page has to be accessed in a proprietary way. On the other hand, I could just use a real OS that doesn't have deep reaching problems in the most basic things
Re: URL is also a shell script that executes some malicious(?) code
#43fish catches this. It automatically escapes the single quotes when I paste it after entering `curl '`.
> fish catches this
Oh how the turntables…
Re: URL is also a shell script that executes some malicious(?) code
#44Earlier quoted context omitted.
Ah yes, the legendary UN*X hacker who never pastes into his terminal.
Everyone pastes into their terminal, but you do have to be pretty naive to ever paste something blindly into your terminal (full depth of understanding of each mechanics isn't a requirement but basic understanding of high-level obvious components of the line being pasted should absolutely be). There is literally no way to secure against people being hacked if the scenario is a user blindly following instructions with…
(reply to sibling comment from unixbane which is [dead] for some reason:)
> tell me the specific way you check your stuff before pasting so I can tell you how it's either broken or you're the 0.001% user and nobody else does that.
I'm no 0.001% user, I'm not a shell expert and I can't catch everything but in the context of this particular post:
- I know how string quoting in programming languages broadly works (no need to know if ' or " escapes or not - just know that if there's any quotes inside the string it deserves a closer look)
- I know that $ in bash (& some other languages) precedes something dynamic (maybe variable substitution, maybe inline code, no need to know about stuff in any detail, just enough to be suspicious)
- I know pipe chars in shells generally separate commands (no need to understand io redirection in any detail here)
- I know that URLs tend to follow boring conventions - if it's not domain/alphanum/alphanum?alphanum=etc then it's suspect and needs further attention (URLs can contain many weird chars but normal ones tend not to).
The above bullets are pretty basic imo - you don't need to be a bash wizard to grok that much. If you know these, you'd never run the one-liner shown in the OP.
Extra:
- if it's a one-liner crossing scroll boundaries, that's too long (excepting very long URLs maybe if they're super-simple)
As a counter-example, here's the type of stuff most people copypaste into shells all the time:
curl http://example.com/simple/path | bash
1. as an inline threat, it's clearly harmless - the URL has no unusual special chars or $ and the command is very short - it can be read & grokked at a glance.
2. as a general threat, this is very dangerous because (a) it's unencryped/MITM-able and (b) you may or may not trust the hosted script being downloaded and eval-ed on your machine.
My overall point here is: there's plenty of valid & dangerous social engineering threats in your terminal; plainly obvious inline quoting problems ain't it.
Re: URL is also a shell script that executes some malicious(?) code
#45Earlier quoted context omitted.
Ah yes, the legendary UN*X hacker who never pastes into his terminal.
Everyone pastes into their terminal, but you do have to be pretty naive to ever paste something blindly into your terminal (full depth of understanding of each mechanics isn't a requirement but basic understanding of high-level obvious components of the line being pasted should absolutely be). There is literally no way to secure against people being hacked if the scenario is a user blindly following instructions with…
and even worse: if you find a snippey of code online, once you read it carefully and you understand that it is safe to run - you might be lazy enough to copy it from the browser and paste it in the terminal. And it can be altered with JS before you copy it so you paste something different from what you have inspected. Of course you can use a buffer (say, a text editor) or even re-type that snippet yourself - but are you sure you'll never forget to do that?
Re: URL is also a shell script that executes some malicious(?) code
#46Yes, $() inside of double quotes is expanded. This is a documented and standardized feature of all shells derived from the bourne shell.
the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now. i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-…
Syntax highlighting in the shell vaguely helps.
Re: URL is also a shell script that executes some malicious(?) code
#47I could imagine someone embedding something like this in a much larger URL, one that was full of many different characters, to make it look innocent.
Re: URL is also a shell script that executes some malicious(?) code
#48Am I missing something, or is this basically "copy this into your terminal" followed by "oh look, it did something"?
Possibly a useful pattern if you have a situation where:
1. there is some validation that checks if a URL is valid
2. this check can be bypassed with this pattern to execute code
Re: URL is also a shell script that executes some malicious(?) code
#49fun fact: k8s uses this to always install the latest version:
https://kubernetes.io/docs/tasks/tools/install-kubectl-linux...
Re: URL is also a shell script that executes some malicious(?) code
#50Earlier quoted context omitted.
Automating might actually make it safer, my typical idiom is `while read -r url; do wget "$url"; done < ./urls` (or `tail -zf ./urls|while…` to make it an url downloader daemon =P)
The former can be simplified to: wget -i ./urls
True, though in practice if I'm scripting the loop body is more like `x=$(curl -Ss "${url}") && dothing "$x" && …`