News for hackers. Stuff that matters.

A comment on URL is also a shell script that executes some malicious(?) code. Parent comment

Re:URL is also a shell script that executes some malicious(?... by Calzifer on Friday September 09, 2022 @07:40AM (#32777967)
Because zsh has usually the url-quote-magic feature enabled which automatically escapes all special characters typed or pasted if the current argument is identified as URL.
[ Parent | on HN ]
Re:URL is also a shell script that executes some malicious(?... by jwilk on Friday September 09, 2022 @08:23AM (#32778259)
Most likely it escapes enough to prevent code execution, but last time I tried it didn't escape all special characters out of the box:

https://news.ycombinator.com/item?id=29071196

[ Parent | on HN ]
Re:URL is also a shell script that executes some malicious(?... by turtleman1338 on Friday September 09, 2022 @10:08AM (#32779431)
$ also gets escaped automatically for me if pasted
[ Parent | on HN ]