3 ms·

Yup! Using curl at all is downright dangerous. /s

• cyphar 10y ago
  Well, it's all about risk assessment. Curl has had RCE security bugs before[1]. That doesn't mean curl is "downright dangerous" it just means that "it's safe because it doesn't pipe to sh" is also not a correct thing to say. [1]: http://blog.volema.com/curl-rce.html http://blog.volema.com/curl-rce.html
  • duaneb 10y ago
    Piping to jq and sed is just fine. I'm not sure where sh comes into this...
    • cyphar 10y ago
      Unless there's a bug in curl, jq or sed that leads to an RCE, which is what my point was.
  • verandaguy 10y ago
    Incidentally, cURL just had a major security audit. The dev is doing due diligence to avoid RCE vulnerabilities.