2 ms·
The API for the shell function is kind of neat, in that it seems to prevent you from accidentally creating shell injection vulnerabilities by calling it without
by ptx 3y ago
The API for the shell function is kind of neat, in that it seems to prevent you from accidentally creating shell injection vulnerabilities by calling it without properly quoting the arguments.
For example, in Python you could easily do this:
message = '; cat /etc/passwd'
# Whoops, shell injection vulnerability!
subprocess.run(f'echo Message: {message}', shell=True)
# Correct (assuming sh-compatible shell).
subprocess.run(f'echo Message: {shlex.quote(message)}', shell=True)
# Correct (without using shell).
subprocess.run(['/bin/echo', 'Message:', message])
But the Bun API doesn't separate quoting from executing the command, so you can't make that kind of mistake:
let message = '; cat /etc/passwd';
// Works correctly.
await $`echo Message: ${message}`.text();
// Fails safely by throwing error about incorrect usage.
await $('echo Message: ' + message).text();
- thingification 3y agoIt uses types to get quoting right? Or it quotes everything (regardless if it's already quoted)? Ironically, the first time I saw the former was in a Python templating library (in the early 2000s -- from distant memory I think it might have been the work of the MemsExchange team?)
- eddd-ddde 3y agoFormatters basically differentiate the literal parts of the string and the template arguments. There's also a neat postgres library that does the same for sql quoting.
- erhaetherth 3y agoIt is very cool, but not new. zx does that too. And I did the same thing for MySQL years ago.
- ptx 3y agoTagged templates[0], the language feature that enables this, were introduced in ECMAScript 2015 apparently – arguably at least somewhat new in the lifespan of JavaScript. :) Java is getting a similar feature with template processors[1], currently in preview. It would be nice to have it in Python as well – i.e. not just f-strings, but something that (like tagged templates) allows a template function process the interpolated values to properly encode them for whatever language is appropriate (e.g. shell, SQL, HTML, etc.). Apparently someone is working on a proposal[2], although there doesn't seem to be much recent progress. [0] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... [1] https://openjdk.org/jeps/459 https://openjdk.org/jeps/459 [2] https://github.com/jimbaker/tagstr/blob/main/docs/pep.rst https://github.com/jimbaker/tagstr/blob/main/docs/pep.rst