2 ms·
Well, it's all about risk assessment. Curl has had RCE security bugs before[1]. That doesn't mean curl is "downright dangerous" it just means that "it's safe be
by cyphar 10y ago
Well, it's all about risk assessment. Curl has had RCE security bugs before[1]. That doesn't mean curl is "downright dangerous" it just means that "it's safe because it doesn't pipe to sh" is also not a correct thing to say.
[1]: http://blog.volema.com/curl-rce.html http://blog.volema.com/curl-rce.html
- duaneb 10y agoPiping to jq and sed is just fine. I'm not sure where sh comes into this...
- cyphar 10y agoUnless there's a bug in curl, jq or sed that leads to an RCE, which is what my point was.
- verandaguy 10y agoIncidentally, cURL just had a major security audit. The dev is doing due diligence to avoid RCE vulnerabilities.