6 ms·

Show HN: Tap curl in your editor before it gets to sh

60 points by awalGarg 10y ago

tambourine_man 10y ago
Simple, but nice
semi-extrinsic 10y ago
A much better feature is available in zsh, called safe-paste, that does this without the user having to insert "tap" or anything else manually. It relies on something called bracketed paste, where the terminal emulator sends special escape sequences to indicate the beginning and end of a paste. These are intercepted by the zsh plugin, which opens $EDITOR with the pasted content. https://github.com/robbyrussell/oh-my-zsh/blob/master/plugins/safe-paste/safe-paste.plugin.zsh https://github.com/robbyrussell/oh-my-zsh/blob/master/plugin...
- JadeNB 10y ago
  Bracketed paste mode can still be broken by a malicious web-site: https://thejh.net/misc/website-terminal-copy-paste https://thejh.net/misc/website-terminal-copy-paste . Does this solution have the same vulnerability?
  - semi-extrinsic 10y ago
    Depends on the terminal emulator you're using, I believe. It (and not zsh) needs to filter out escape sequences.
- tree_of_item 10y ago
  How is it better? Pasting is a totally different use case from `curl | sh`.
  - semi-extrinsic 10y ago
    Typical use case: * type "curl <paste>" in zsh, vim opens with "curl <pasted-url> * inspect URL, if OK in Normal mode do !!zsh<CR> (I assume emacs can also somehow eval current line in shell and replace line with output) * inspect the code downloaded (still in vim) and then execute it (or save to file then execute).
sdx23 10y ago
I don't really see, why I'd install something from some github repository if I can get it from a moreutils package that I like to have installed anyway.
- geofft 10y ago
  I think you're specifically saying that the "vipe" command does this: http://manpages.ubuntu.com/manpages/xenial/en/man1/vipe.1.html http://manpages.ubuntu.com/manpages/xenial/en/man1/vipe.1.ht... moreutils is great. Unfortunately, moreutils parallel conflicts with GNU parallel :(
- OJFord 10y ago
  Then don't. `vipe` from `moreutils` is acknowledged in this project's readme. I don't have `moreutils` installed; it's plausible that someone might want just the single package, in which case `tap` would seems OK as an alternative.
robryk 10y ago
Why do you create an env variable that contains the whole file in question when the editor returned success? Wouldn't something like: cat "$f"; rm "$f" not involve loading the whole file in memory at once? Note that using this also makes sense with self-extracting archives/shell scripts, because it lets you inspect the shell script at the beginning.
- 0xmohit 10y ago
  Moreover, dumping the file into a variable doesn't seem to be a good idea if the file were to contain null characters.
- littlepootis 10y ago
  fixed in https://github.com/awalGarg/curl-tap-sh/commit/ab4e079468a2b66093ebe6d70bd8b175affbfc78 https://github.com/awalGarg/curl-tap-sh/commit/ab4e079468a2b..., thanks
deleted 10y ago
[deleted]

60 points by awalGarg 10y ago

Simple, but nice

A much better feature is available in zsh, called safe-paste, that does this without the user having to insert "tap" or anything else manually. It relies on something called bracketed paste, where the terminal emulator sends special escape sequences to indicate the beginning and end of a paste. These are intercepted by the zsh plugin, which opens $EDITOR with the pasted content. https://github.com/robbyrussell/oh-my-zsh/blob/master/plugins/safe-paste/safe-paste.plugin.zsh https://github.com/robbyrussell/oh-my-zsh/blob/master/plugin...

JadeNB 10y ago
Bracketed paste mode can still be broken by a malicious web-site: https://thejh.net/misc/website-terminal-copy-paste https://thejh.net/misc/website-terminal-copy-paste . Does this solution have the same vulnerability?
- semi-extrinsic 10y ago
  Depends on the terminal emulator you're using, I believe. It (and not zsh) needs to filter out escape sequences.
tree_of_item 10y ago
How is it better? Pasting is a totally different use case from `curl | sh`.
- semi-extrinsic 10y ago
  Typical use case: * type "curl <paste>" in zsh, vim opens with "curl <pasted-url> * inspect URL, if OK in Normal mode do !!zsh<CR> (I assume emacs can also somehow eval current line in shell and replace line with output) * inspect the code downloaded (still in vim) and then execute it (or save to file then execute).

sdx23 10y ago

I don't really see, why I'd install something from some github repository if I can get it from a moreutils package that I like to have installed anyway.

geofft 10y ago
I think you're specifically saying that the "vipe" command does this: http://manpages.ubuntu.com/manpages/xenial/en/man1/vipe.1.html http://manpages.ubuntu.com/manpages/xenial/en/man1/vipe.1.ht... moreutils is great. Unfortunately, moreutils parallel conflicts with GNU parallel :(
OJFord 10y ago
Then don't. `vipe` from `moreutils` is acknowledged in this project's readme. I don't have `moreutils` installed; it's plausible that someone might want just the single package, in which case `tap` would seems OK as an alternative.

robryk 10y ago

Why do you create an env variable that contains the whole file in question when the editor returned success? Wouldn't something like: cat "$f"; rm "$f" not involve loading the whole file in memory at once? Note that using this also makes sense with self-extracting archives/shell scripts, because it lets you inspect the shell script at the beginning.

0xmohit 10y ago
Moreover, dumping the file into a variable doesn't seem to be a good idea if the file were to contain null characters.
littlepootis 10y ago
fixed in https://github.com/awalGarg/curl-tap-sh/commit/ab4e079468a2b66093ebe6d70bd8b175affbfc78 https://github.com/awalGarg/curl-tap-sh/commit/ab4e079468a2b..., thanks

deleted 10y ago

[deleted]