News for hackers. Stuff that matters.

A comment on Show HN: Patchwork – Real-time notifications for OSS vulnerabilities. Parent comment

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by DoubleMalt on Wednesday January 13, 2016 @03:49PM (#10897381)
Would you bet you live on the assumptionthat there is no way a network problem could truncate the script into something, that does something unintended but harmful?

http://www.seancassidy.me/dont-pipe-to-your-shell.html

[ Parent | on HN ]
Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by kentonv on Wednesday January 13, 2016 @04:13PM (#10897541)
That problem is easily avoided by wrapping the whole script in a function and then calling it on the last line.

It looks like Patchwork's script doesn't quite do that, but it does put _most_ of its functionality into functions, and AFAICT there is no particular place in the script where a connection loss could lead to anything bad happening. Admittedly this appears to be a lucky accident rather than following best practice.

[ Parent | on HN ]
Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by dchanm on Wednesday January 13, 2016 @04:24PM (#10897624)
Hi DoubleMalt,

Thanks for the link. I've filed an issue and should have this fixed tonight

https://github.com/PatchworkSecurity/cleansweep/issues/7

[ Parent | on HN ]