1

Context

I've set up a site to post scripts to which I can then execute later using the following command:

curl -so /tmp/script http://scripts.programster.org/scripts/1?output=raw && . /tmp/script

This example script outputs "hello world" to the terminal.

As you can see, that's rather long and messy and risks overwriting a user's file if they just happen to have a file called /tmp/script. I used to just pipe to bash like so:

curl -s http://scripts.programster.org/scripts/1?output=raw | bash

However, I want the command to work with scripts written in other languages such as PHP (using #!/usr/bin/php at the top of the script), hence the change to the first command.

Question

Is there a way that I can execute an online script without having to save it to the local filesystem, whilst also not knowing what program to execute it in beforehand? Perhaps there is a way to treat a url like a file which would allow me to do something like:

. http://scripts.programster.org/scripts/1?output=raw
  • Hint: You can circumvent using a fixed name for temp files by using mktemp. – Murphy Mar 14 '16 at 9:03
  • 1
    I would not use /tmp for especially this kind of use. It is not a good security practice. Given the sensitivity of some scripts, I would place them in a https site with authentication. – Rui F Ribeiro Mar 14 '16 at 9:26
3

Aside of security matters, I hope you do realise the risks of running external scripts, this can be done by combination of wget and source (dot) command

. <(wget -q -O- http://scripts.programster.org/scripts/1?output=raw)

That means sourcing the script text into current shell

wget -O- makes download ot STDOUT, -q makes it quiet (free from messages)

<(any command) is process substituion that allows interpret the output as a file

P.S. curl - equivalent forwget -q -O- is curl -s -o-

UPDATE

The above examples will sitll not make use of she-bang of the external script, but will run in the context of the calling shell. To make use of the she-bang line, one have to save the file, make executable, and only then run.

You can use mktemp which will guarantee unuque names, then you'll have take care of removing temporary files. This can be combined in a wrapper that would take the external url as paramter

Here's a working sample code for that kind of wrapper

#/bin/bash
exturl=${1?"No external url specified"}
tmpexe=$(mktemp)
trap 'rm $tmpexe' EXIT
curl -s $exturl  -o $tmpexe
chmod 0755 $tmpexe
$tmpexe

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.