3 ms·
the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and
by habibur 4y ago
the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now.
i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-char escape the url.
- blueflow 4y agoBecause you can exit the quoting any time with another single quote. This is literally how SQL injections worked 20 years ago.
- Calzifer 4y agoNo it is not. The single quote example is wrong because the evaluation part $(...) is unquoted. Take a closer look. The first single quote part ends after the first semicolon right before the $(
- deleted 4y ago[deleted]
- IshKebab 4y agoIt's not wrong, it's just demonstrating that slapping single quotes around a string is not sufficient to make it safe. You need to escape the string properly. Guess how many people do that.
- paisleyrob 4y agoThat's only because it's got single quotes contained within it.
- deleted 4y ago[deleted]
- chriswarbo 4y agoWriting '...' switches from "writing shell code" to "writing a single-quoted string". It does not switch to "writing arbitrary text" (since that would give us no way to end the string!). You should always convert arbitrary text to "single-quoted string" format: most of the time it will stay the same, e.g. "google.com"; sometimes it needs escaping to prevent benign corruption, e.g. "I'm a little teapot"; in this case it needs escaping to prevent malicious code injection.
- aasasd 4y agoSyntax highlighting in the shell vaguely helps.