Show HN: Nigit – Expose Shell Scripts as HTTP API • Hacker News Board

Show HN: Nigit – Expose Shell Scripts as HTTP API

#1

Post by morgenkaffee » Thu, Jan 07, 2016, 2:28 PM UTC

Show HN: Nigit – Expose Shell Scripts as HTTP API
github.com

Re: Show HN: Nigit – Expose Shell Scripts as HTTP API

#2

Post by wink » Thu, Jan 07, 2016, 2:46 PM UTC

While it's nice and handy I'd be cautious to let that run anywhere else than localhost.

To sanitize/whitelist this kind of input as in json -> go -> shell.. I'm giving up, I'm too paranoid to even think about making this safe :)

Re: Show HN: Nigit – Expose Shell Scripts as HTTP API

#3

Post by morgenkaffee » Thu, Jan 07, 2016, 3:01 PM UTC

wink wrote: post #2

While it's nice and handy I'd be cautious to let that run anywhere else than localhost. To sanitize/whitelist this kind of input as in json -> go -> shell.. I'm giving up, I'm too paranoid to even think about making this safe :)

Completely agree!

One approach is to run it in a Docker container and access it from your other micro services and never expose it to the public. This is still handy because you can isolate that old program and act as if it is an API to your other micro services.

Re: Show HN: Nigit – Expose Shell Scripts as HTTP API

#4

Post by dozzie » Thu, Jan 07, 2016, 3:01 PM UTC

How did we end with everything being "API" and nothing being "service" any longer?

Re: Show HN: Nigit – Expose Shell Scripts as HTTP API

#5

Post by wanda » Thu, Jan 07, 2016, 5:44 PM UTC

dozzie wrote: post #4

How did we end with everything being "API" and nothing being "service" any longer?

Acronyms are trendier. and fewer bytes of you're performance-obsessed.

Re: Show HN: Nigit – Expose Shell Scripts as HTTP API

#6

Post by leesalminen » Thu, Jan 07, 2016, 7:02 PM UTC

wanda wrote: post #5

dozzie wrote: post #4

How did we end with everything being "API" and nothing being "service" any longer?

Acronyms are trendier. and fewer bytes of you're performance-obsessed.

> and fewer bytes of you're performance-obsessed

Not if you include the requisite conversations about why acronyms are cool.

Re: Show HN: Nigit – Expose Shell Scripts as HTTP API

#7

Post by [deleted] » Thu, Jan 07, 2016, 7:04 PM UTC

[deleted]

Re: Show HN: Nigit – Expose Shell Scripts as HTTP API

#8

Post by throwaway7767 » Fri, Jan 08, 2016, 10:36 AM UTC

wink wrote: post #2

While it's nice and handy I'd be cautious to let that run anywhere else than localhost. To sanitize/whitelist this kind of input as in json -> go -> shell.. I'm giving up, I'm too paranoid to even think about making this safe :)

A coworker once set up a bash-based shell wrapper to provide customers with restricted access to the monitoring system. The monitoring system was written as CGI programs in C, and the shell script was there to sanitize input arguments, and that the hosts/tests being viewed matched the customers regex pattern (say, ".*\.customer\.tld").

The next day, I showed him how I could break out of that protection by sending a request with a parameter like "host=x.customerb.tld\0.customera.tld" (with a NULL byte in between).

We did a few more rounds of whack-a-mole until I finally managed to convince him this was a fundamentally bad idea.