Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run.

I remember seeing a command line trick that made it was possible to read the script from the command line and then confirm execution after reading the script. If I recall correctly, it looked something like curl -s [url] | something...here | sh and didn't require any software install.

Does anyone know this trick?

share|improve this question

5 Answers 5

up vote 5 down vote accepted

There is a utility in moreutils called vipe that shows stdin in an editor, where you can revew and modify the file before it gets passed on to stdout.

If you don't want to install moreutils, you can accomplish something similar like so:

file=$(mktemp); curl -s "$url" > $file; $EDITOR $file; sh $file; rm $file

mktemp is in coreutils and is very likely already installed on your system.

share|improve this answer

I can't think of a single utility that would do what you describe, but it's easy enough to make that a shell snippet.

script=$(curl -s "$url")
printf "%s\nDo you want to run this script? [yN]" "$script"
read line
case $line in
  [Yy]|[Yy][Ee][Ss]) sh -c "$script";;
esac

This assumes the script is a text file. Null bytes are not supported: depending on the shell, they may be removed, or they may cause a line or the whole file to be truncated. Also all newlines at the end of the file are removed (the heredoc construct adds one back). This is not normally a problem for a script, but it could be, for example, if the script ends with an archive in binary format which it extracts. This is not a very reliable way of distributing a file as there is a significant risk of such a binary script to be misencoded at some point. Nonetheless, you can handle it by writing the script to a temporary file.

script_file=$(mktemp)
curl -s "$url" | tee "$script_file"
printf "Do you want to run this script? [yN]"
read line
case $line in
  [Yy]|[Yy][Ee][Ss]) sh "$script_file";;
esac
rm "$script_file"
share|improve this answer
    
$() should be quoted on the first line. Also, this would remove NUL characters in the input, which might conceivably be fatal (for example in the case of a self-extracting script). –  l0b0 Jan 23 '13 at 10:24
1  
@l0b0 You don't need to quote in an assignment, though it's arguably good style. Null bytes are indeed lost, as are final newlines; if you're going to include an archive in a shell script, I recommend using a text encoding such as base64. –  Gilles Jan 23 '13 at 10:51
    
All valid points, as usual. +1 –  l0b0 Jan 23 '13 at 10:53
    
@l0b0 On second thoughts, while it's somewhat risk-prone, this is a valid use case. I've updated my answer. I've also corrected a defect in my original answer which didn't allow the script to use its stdin (because the script was passed on stdin, for no good reason). –  Gilles Jan 23 '13 at 13:27

Assuming your read knows -p (prompt), and the script needn't be executed with the interpreter, specified by the shebang:

curl URL | tee /tmp/x && read -p "execute?" key ; test $key = y && sh /tmp/x
share|improve this answer

Use this command line:

curl URL | ( cat > /tmp/file; read REPLY; [[ ! $REPLY =~ ^[Yy]$ ]] && cat /tmp/file ) | sh

You could use a small function for that:

curlsh()
{
    curl "$1" \
    | ( cat > /tmp/file;read REPLY; [[ ! $REPLY =~ ^[Yy]$ ]] && cat /tmp/file ) \
    | sh
}

And than use it this way:

curlsh http://site.in.net/path/to/script
share|improve this answer

It's hard to imagine why you would even want to do this, let alone where you would find a source (or sources) of scripts to download and run like this frequently enough that it needs a special-purpose tool.

Why not just download the script with curl (or wget or snarf or whatever), examine and edit it (it's a rare script that wont need some customisation for your particular system) and then run it - either by making it executable with chmod or with sh scriptname?

share|improve this answer
    
I don't want a special-purpose tool. I remember there was an easy way to do this with standard tools. –  Olivier Lalonde Aug 25 '12 at 1:18
1  
It wouldn't be hard to write a small shell script (probably only 5 or so lines) to download a script, present it for viewing with less or something, and then ask you if you wanted to run it. I can't see that that would be any better than just downloading the script, viewing it, and then running it if it seemed OK. IMO it would be worse, it wouldn't offer any advantage but would remove the flexibility you get from just working in your shell. –  cas Aug 25 '12 at 1:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.