Skip Navigation
Am I crazy in thinking that bash is good enough for production?
  • Agreed.

    Also gtfobins is a great resource in addition to shellcheck to try to make secure scripts.

    For instance I felt upon a script like this recently:

    #!/bin/bash
    # ... some stuff ...
    tar -caf archive.tar.bz2 "$@"
    

    Quotes are OK, shellcheck is happy, but, according to gtfobins, you can abuse tar, so running the script like this: ./test.sh /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh ends up spawning an interactive shell...

    So you can add up binaries insanity on top of bash's mess.

  • InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)JA
    JamonBear @sh.itjust.works
    Posts 0
    Comments 4