Read and confirm shell script before piping from curl to sh (curl -s [url] | sh)

Question

Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run.

I remember seeing a command line trick that made it was possible to read the script from the command line and then confirm execution after reading the script. If I recall correctly, it looked something like curl -s [url] | something...here | sh and didn't require any software install.

Does anyone know this trick?

Answer 1

There is a utility in moreutils called vipe that shows stdin in an editor, where you can revew and modify the file before it gets passed on to stdout.

If you don't want to install moreutils, you can accomplish something similar like so:

file=$(mktemp); curl -s "$url" > $file; $EDITOR $file; sh $file; rm $file

mktemp is in coreutils and is very likely already installed on your system.

Answer 2

I can't think of a single utility that would do what you describe, but it's easy enough to make that a shell snippet.

script=$(curl -s "$url")
printf "%s\nDo you want to run this script? [yN]" "$script"
read line
case $line in
  [Yy]|[Yy][Ee][Ss]) sh -c "$script";;
esac

This assumes the script is a text file. Null bytes are not supported: depending on the shell, they may be removed, or they may cause a line or the whole file to be truncated. Also all newlines at the end of the file are removed (the heredoc construct adds one back). This is not normally a problem for a script, but it could be, for example, if the script ends with an archive in binary format which it extracts. This is not a very reliable way of distributing a file as there is a significant risk of such a binary script to be misencoded at some point. Nonetheless, you can handle it by writing the script to a temporary file.

script_file=$(mktemp)
curl -s "$url" | tee "$script_file"
printf "Do you want to run this script? [yN]"
read line
case $line in
  [Yy]|[Yy][Ee][Ss]) sh "$script_file";;
esac
rm "$script_file"

Answer 3

Assuming your read knows -p (prompt), and the script needn't be executed with the interpreter, specified by the shebang:

curl URL | tee /tmp/x && read -p "execute?" key ; test $key = y && sh /tmp/x

Answer 4

Use this command line:

curl URL | ( cat > /tmp/file; read REPLY; [[ ! $REPLY =~ ^[Yy]$ ]] && cat /tmp/file ) | sh

You could use a small function for that:

curlsh()
{
    curl "$1" \
    | ( cat > /tmp/file;read REPLY; [[ ! $REPLY =~ ^[Yy]$ ]] && cat /tmp/file ) \
    | sh
}

And than use it this way:

curlsh http://site.in.net/path/to/script

Answer 5

It's hard to imagine why you would even want to do this, let alone where you would find a source (or sources) of scripts to download and run like this frequently enough that it needs a special-purpose tool.

Why not just download the script with curl (or wget or snarf or whatever), examine and edit it (it's a rare script that wont need some customisation for your particular system) and then run it - either by making it executable with chmod or with sh scriptname?