3 ms·

That is pretty bad. Shows that "right click, copy link, type wget ', paste, type ', enter" is a receipe to get pwned. Same is probably true even when you do n

• thr0wnawaytod4y 4y ago
  pasting things into your terminal was always a problem
• koolba 4y ago
  Pasting directly into a terminal or even a script is one step removed from blindly running eval(…) with arbitrary user input. If you’re lucky it works. If you’re somewhat less lucky but still on the positive side, it doesn’t work with some syntax error that doesn’t corrupt anything. There’s no excuse for not reviewing what is being executed before actually running it.
• unhammer 4y ago
  Automating might actually make it safer, my typical idiom is `while read -r url; do wget "$url"; done < ./urls` (or `tail -zf ./urls|while…` to make it an url downloader daemon =P)
  • jwilk 4y ago
    The former can be simplified to: wget -i ./urls
    • unhammer 4y ago
      True, though in practice if I'm scripting the loop body is more like `x=$(curl -Ss "${url}") && dothing "$x" && …`
• chriswarbo 4y ago
  Reminder that copying text from a Web page is also vulnerable to "pastejacking", where the string going into the clipboard isn't the same as the user sees (e.g. adding a malicious prefix, made invisible with CSS)
• IshKebab 4y ago
  Not really though. How often do you paste code that's long enough to hide stuff like this from sources that you don't trust? Probably very rarely. The real risk of this sort of thing is basically Bash injection - people who have bash scripts as part of their infrastructure that process public data. Sounds insane, yes. But there's a scary number of people who think Bash scripting is a sane thing to do.