News for hackers. Stuff that matters.

A comment on URL is also a shell script that executes some malicious(?) code. Parent comment

Re:URL is also a shell script that executes some malicious(?... by habibur on Friday September 09, 2022 @07:28AM (#32777891)
the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now.

i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-char escape the url.

[ Parent | on HN ]
Re:URL is also a shell script that executes some malicious(?... by blueflow on Friday September 09, 2022 @07:38AM (#32777946)
Because you can exit the quoting any time with another single quote. This is literally how SQL injections worked 20 years ago.
[ Parent | on HN ]
Re:URL is also a shell script that executes some malicious(?... by Calzifer on Friday September 09, 2022 @07:38AM (#32777947)
No it is not. The single quote example is wrong because the evaluation part $(...) is unquoted. Take a closer look. The first single quote part ends after the first semicolon right before the $(
[ Parent | on HN ]
Re:URL is also a shell script that executes some malicious(?... by IshKebab on Saturday September 10, 2022 @06:22AM (#32789327)
It's not wrong, it's just demonstrating that slapping single quotes around a string is not sufficient to make it safe. You need to escape the string properly. Guess how many people do that.
[ Parent | on HN ]
Re:URL is also a shell script that executes some malicious(?... by chriswarbo on Friday September 09, 2022 @08:06AM (#32778127)
Writing '...' switches from "writing shell code" to "writing a single-quoted string". It does not switch to "writing arbitrary text" (since that would give us no way to end the string!). You should always convert arbitrary text to "single-quoted string" format: most of the time it will stay the same, e.g. "google.com"; sometimes it needs escaping to prevent benign corruption, e.g. "I'm a little teapot"; in this case it needs escaping to prevent malicious code injection.
[ Parent | on HN ]
Re:URL is also a shell script that executes some malicious(?... by paisleyrob on Friday September 09, 2022 @07:37AM (#32777944)
That's only because it's got single quotes contained within it.
[ Parent | on HN ]
Re:URL is also a shell script that executes some malicious(?... by aasasd on Friday September 09, 2022 @12:23PM (#32781206)
Syntax highlighting in the shell vaguely helps.
[ Parent | on HN ]