News for hackers. Stuff that matters.

A comment on ZSH Aliases. Parent comment

Re:ZSH Aliases by georgyo on Tuesday May 26, 2020 @09:08AM (#23310636)
This seems like a good way to accidently run abitrary code downloaded from the internet.

I can see opening up in an editor as useful shortcut. But actually executing code without an executable bit seems a bit more dangerous.

[ Parent | on HN ]
Re:ZSH Aliases by trashburger on Tuesday May 26, 2020 @10:55AM (#23311931)
Worse, imagine if someone set their shell as the suffix alias for .sh, just to save time on their curl shell pipes... Oh the horror. Suffix aliases should come with a big caveat.
[ Parent | on HN ]
Re:ZSH Aliases by Spivak on Tuesday May 26, 2020 @09:22PM (#23318421)
Don't worry. I got you.

    alias -s sh='_c(){ curl -sk $1 | sudo bash };_c'
Wait. Improved.

    alias -s sh='_c(){ [[ -f $1 ]] && sudo bash $1 || curl -sk $1 | sudo bash };_c'
[ Parent | on HN ]
Re:ZSH Aliases by franciscop on Tuesday May 26, 2020 @09:43AM (#23310990)
Really? Last time I downloaded a .js file by accident was never if my memory doesn't fail me (.html I remember a couple). Even if I did, I normally use the UI to manage my files. The only time I might try to do something with the CLI and a JS file is exactly to run `node file.js`, and this is just a convenience.
[ Parent | on HN ]