Perl code that is syntactically correct only on Fridays

Re:Perl code that is syntactically correct only on Fridays by im3w1l on Wednesday February 16, 2022 @09:52AM (#30360681)

Bash parses as it runs so something as simple as this works

  if [ $(date +%u) -ne 5 ]
  then
    exit
  fi
  (

[ Parent | on HN ]

Re:Perl code that is syntactically correct only on Fridays by lloeki on Wednesday February 16, 2022 @09:57AM (#30360759)

Bash even reads the file as it goes, so if you run a "long-running" script (a sleep is enough), edit far enough down, and write the file again, the previously started bash will end up running the new content once it gets up to reading where the change happened.

[ Parent | on HN ]

Re:Perl code that is syntactically correct only on Fridays by saba2008 on Wednesday February 16, 2022 @11:15AM (#30361882)

You can exploit it do distinguish whenever script is `curl | bash`'ed.

Add `sleep 1`, and detect pause on server. Then, if pause detected - serve attack payload. If not - somebody is careful enough to download and audit, so serve just the script.

[ Parent | on HN ]

Re:Perl code that is syntactically correct only on Fridays by jwilk on Wednesday February 16, 2022 @11:45AM (#30362242)

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

Discussed on HN:

2020: https://news.ycombinator.com/item?id=25356757 (133 comments)

2018: https://news.ycombinator.com/item?id=17636032 (146 comments)

2016: https://news.ycombinator.com/item?id=11532599 (122 comments)

[ Parent | on HN ]

Re:Perl code that is syntactically correct only on Fridays by jwilk on Wednesday February 16, 2022 @12:22PM (#30362718)

You could check syntax of the whole file (even the unreachable parts) with the -n option.

But that's not bulletproof; consider this code (adapted from <https://hal.archives-ouvertes.fr/hal-01513750/document>):

  if [ $(date +%u) -eq 5 ]
  then
      alias maybe=''
  else
      alias maybe=:
  fi
  maybe for x in; do :; done

"sh -n" always reports syntax error, even thought the script syntax is correct on Fridays.

[ Parent | on HN ]