3 ms·
I'm not sure that this is as safe as you may think. EDIT More info. Yes this is better than curl ... | sh. But less has a lot of functionality (more than you'd
by thrownaway122 11y ago
I'm not sure that this is as safe as you may think.
EDIT More info. Yes this is better than curl ... | sh. But less has a lot of functionality (more than you'd expect) and a carefully written script could exploit some of this.
- hartator 11y agoCan you provide an example?
- thrownaway122 11y agoEDIT found link http://seclists.org/fulldisclosure/2014/Nov/74 http://seclists.org/fulldisclosure/2014/Nov/74 Basically the tldr is that gnu less is a program that has been engineered to do a lot of things over the years and this has created attack surfaces which mean that if someone was to curl .... | less on a carefully designed payload it could allow the payload to obtain a shell. I wasn't saying that it isn't safer just that it isn't totally safe.
- SmirkingRevenge 11y agoWould that really be any different that downloading the script, then opening it with less/vim/whatever locally, which is typically going to be pretty safe, unless the script is accidentally executed somehow.
- thrownaway122 11y agoWell it is exactly the same.