Acme.sh runs arbitrary commands from a remote server

Re:Acme.sh runs arbitrary commands from a remote server by tinus_hn on Friday June 09, 2023 @01:55AM (#36253834)

IMO it’s just a demonstration why you don’t write complicated or security sensitive code in shell script: it’s basically impossible to get right, there’s pitfalls around every corner and it’s extremely difficult to check for mistakes.

[ Parent | on HN ]

Re:Acme.sh runs arbitrary commands from a remote server by pazderski on Friday June 09, 2023 @05:18AM (#36255296)

I wouldn't say there are too many pitfalls. Quote all variables (acme.sh seem to do well on that part) and don't use eval (probably the reason for this problem).

[ Parent | on HN ]

Re:Acme.sh runs arbitrary commands from a remote server by Eeems on Friday June 09, 2023 @11:20AM (#36259171)

I just read the entire issue thread, yes eval was the reason.

[ Parent | on HN ]